Commit fea35ef
File tree
- .github
- instructions
- skills
- asim-parser-create-parameter-parser
- asim-parser-create-parser
- asim-parser-creator-orchestrator
- asim-parser-github-pr-packager
- asim-parser-la-deployer
- asim-parser-pr-reviewer
- asim-parser-user-prompter
- asim-parser-validator
- az-cli-command-runner
- scripts
- log-analytics-workspace-queryer
- scripts
- run-solution-analyzer
- update-solution-analyzer
- workflows
- .script
- local-validation
- package-automation
- tests
- KqlvalidationsTests
- CustomFunctions
- CustomTables
- FunctionSchemasLoaders
- asimParsersTest
- detectionTemplateSchemaValidation
- utils
- ASIM
- deploy
- EmptyCustomUnifyingParsers
- Watchlists
- dev
- ASimTester
- Testers
- Forked Repos PRs
- schemas
- tools/ASIMParserCreation-Agentic
- DataConnectors
- AWS-CloudTrail-AzureFunction
- AzFunAWSCloudTrailLogsIngestion
- AWS-Config
- CloudFormation
- AWS-S3-AzureFunction
- AzFun-AWS-S3-Ingestion
- AWS-S3/CloudFormation
- CloudTrail
- images
- CloudWatch
- images
- Flow Logs
- images
- GuardDuty
- images
- OpenID
- images
- AWS-SecurityHubFindings
- CEF
- Zoom
- ZoomLogs
- microsoft-sentinel-log-analytics-logstash-output-plugin
- lib/logstash/sentinel_la
- spec
- outputs
- support/logstash
- Detections/SecurityEvent
- Hunting Queries
- AuditLogs
- DeviceProcess
- Microsoft 365 Defender
- Campaigns
- Lockbit Ransomware
- TheGentlemanRansomware
- Command and Control
- Credential Access
- Defense evasion
- Email and Collaboration Queries
- Hunting
- Malware
- Microsoft Teams protection
- Phish
- QR code
- Submissions
- Exfiltration
- Impact
- Persistence
- Privilege escalation
- MultipleDataSources
- WindowsEvent
- Logos
- MasterPlaybooks/Remediation-URL/Zscaler-Remediation-URL/Authentication
- Parsers
- ASimAgentEvent
- ARM
- ASimAgentEntity
- imAgentEvent
- vimAgentEventEmpty
- CHANGELOG
- Parsers
- ASimAlertEvent
- ARM
- ASimAlertEventBitdefenderGravityZone
- ASimAlertEventCiscoSecureEndpoint
- ASimAlertEventCrowdStrikeFalcon
- ASimAlertEventGoogleSecOps
- ASimAlertEventNetskopeSecurityCloud
- ASimAlertEventPaloAltoXDR
- ASimAlertEvent
- imAlertEvent
- vimAlertEventBitdefenderGravityZone
- vimAlertEventCiscoSecureEndpoint
- vimAlertEventCrowdStrikeFalcon
- vimAlertEventGoogleSecOps
- vimAlertEventMicrosoftDefenderXDR
- vimAlertEventNetskopeSecurityCloud
- vimAlertEventPaloAltoXDR
- CHANGELOG
- Parsers
- Tests
- ASimAssetEntity
- ARM/vimAssetEntityEmpty
- CHANGELOG
- Parsers
- ASimAuthentication
- ARM
- ASimAuthenticationCiscoDNAC
- ASimAuthenticationCiscoFTD
- ASimAuthenticationCiscoIOS
- ASimAuthenticationCiscoISEAdministrator
- ASimAuthenticationCiscoISE
- ASimAuthenticationFortinetFortigate
- ASimAuthenticationPaloAltoGlobalProtect
- ASimAuthenticationPaloAltoPanOS
- ASimAuthenticationSalesforceSC
- ASimAuthenticationVMwareESXi
- ASimAuthenticationVMwareVCenter
- ASimAuthentication
- imAuthentication
- vimAuthenticationCiscoDNAC
- vimAuthenticationCiscoFTD
- vimAuthenticationCiscoIOS
- vimAuthenticationCiscoISEAdministrator
- vimAuthenticationCiscoISE
- vimAuthenticationEmpty
- vimAuthenticationFortinetFortigate
- vimAuthenticationPaloAltoGlobalProtect
- vimAuthenticationPaloAltoPanOS
- vimAuthenticationSalesforceSC
- vimAuthenticationVMwareESXi
- vimAuthenticationVMwareVCenter
- CHANGELOG
- Parsers
- Tests
- test/VMware ESXi
- ASimNetworkSession
- ARM
- ASimNetworkSessionCheckPointFirewall
- ASimNetworkSessionCheckpointSmartDefense
- ASimNetworkSessionCiscoFTD
- ASimNetworkSession
- imNetworkSession
- vimNetworkSessionCheckPointFirewall
- vimNetworkSessionCheckpointSmartDefense
- vimNetworkSessionCiscoFTD
- CHANGELOG
- Parsers
- ASimProcessEvent
- ARM
- ASimProcessEventMicrosoft365D
- imProcessCreate
- imProcessEvent
- imProcessTerminate
- vimProcessCreateLinuxSysmon
- vimProcessCreateMD4IoT
- vimProcessEventMD4IoT
- vimProcessEventMicrosoft365D
- vimProcessTerminateLinuxSysmon
- vimProcessTerminateMD4IoT
- vimProcessTerminateMicrosoftSecurityEvents
- CHANGELOG
- Parsers
- ASimWebSession
- ARM
- ASimWebSessionAWSWAF
- ASimWebSessionSalesforceServiceCloudV2
- ASimWebSession
- imWebSession
- vimWebSessionAWSWAF
- vimWebSessionCiscoUmbrella
- vimWebSessionSalesforceServiceCloudV2
- CHANGELOG
- Parsers
- Tests
- Playbooks
- AS-Checkmarx-SAST-Ingestion
- Images
- Fortinet-FortiGate/FunctionApp
- Sync-Sentinel-Incident-Comments-To-M365Defender
- Update-VIPUsers-Watchlist-from-AzureAD-Group
- Sample Data
- ASIM
- Corelight
- Custom
- Fortinet FortiNDR Cloud
- Solutions
- 42Crunch API Protection
- Analytic Rules
- Data Connectors
- 42Crunch_CCF
- 42Crunch
- Data
- Package
- Parsers
- Workbooks
- sample-deployment
- ccf-forwarder
- A365 Observability
- Data Connectors
- Data
- Package
- AI Analyst Darktrace
- Data
- Package
- AWS ELB
- Data Connectors/AWSELBConnector_CCF
- Package
- AWS Security Hub
- Data
- Package
- Workbooks
- AbnormalSecurity
- Analytic Rules
- Data Connectors/AbnormalSecurity_CCF
- Sample Data
- Data
- Hunting Queries
- Package
- Parsers
- Playbooks/AbnormalSecurity-AddIncidentComment
- Workbooks
- Images/Preview
- Agari
- Data Connectors
- Agari_CCF
- AzureFunctionAgari
- Data
- Package
- Agent 365
- Data Connectors
- Data
- Package
- AirlockDigital
- Data Connectors/AirlockDigital_CCF
- Data
- Package
- Parsers
- Akamai DDOS Protection
- Data Connectors/AkamaiDDOSProtection_CCF
- Data
- Package
- Parsers
- Akamai Guardicore
- Data Connectors/AkamaiGuardicoreLogs_ccp
- Data
- Package
- Playbooks
- AkamaiGuardicoreEnrichment_dcr
- Guardicore-EnrichmentRunner
- Guardicore-ProcessIncidentEnrichment
- Workbooks
- Images/Preview
- Alibaba Cloud Networking
- Data Connectors/AlibabaCloudNetworking_CCP
- Data
- Package
- Amazon Web Services
- Analytic Rules
- Data Connectors
- Data
- Hunting Queries
- Package
- Workbooks
- AtlassianConfluenceAudit
- Data Connectors/AtlassianConfluenceAuditLogs_CCP
- Data
- Package
- AtlassianJiraAudit
- Data Connectors
- Data
- Package
- Auth0
- Data Connectors
- Data
- Package
- Azure Firewall
- Analytic Rules
- Hunting Queries
- Package
- Azure Resource Graph
- Data Connectors
- Data
- Package
- Azure SQL Database solution for sentinel
- Analytic Rules
- Hunting Queries
- Package
- AzureDevOpsAuditing
- Data Connectors/AzureDevOpsAuditLogs_CCP
- Data
- Package
- AzureSecurityBenchmark
- Analytic Rules
- Package
- Workbooks
- BeyondTrustPMCloud/Data Connectors
- AzureFunctionBeyondTrustPMCloud
- Functions
- Services
- BitSight
- Data Connectors
- BitSightDataConnector
- BitSight_CCF
- BitSight_Events_CCF
- Data
- Package
- Parsers
- Workbooks
- Blacklens
- Data Connectors/deployment
- Data
- Package
- BloodHound Enterprise
- Data Connectors
- BloodHoundDataConnector
- Package
- Workbooks
- BlueVoyant Anthropic ClaudeCompliance
- Data Connectors/BlueVoyantAnthropicClaudeCompliance_CCF
- Data
- Package
- Box
- Data Connectors
- Data
- Package
- Censys
- Data
- Package
- Playbooks
- CensysAddIncidentComment
- CensysAlertEnrichment
- CensysAlertRescan
- CensysEntityEnrichmentCertificate
- CensysEntityEnrichmentHost
- CensysEntityEnrichmentWebProperty
- CensysHostHistory
- CensysIOCLookup
- CensysIncidentEnrichment
- CensysRelatedInfrastructure
- CensysRescan
- Workbooks
- Check Point Cyberint Alerts
- Analytic Rules
- Data Connectors/CyberintArgosAlertsLogs_ccp
- Data
- Package
- Parsers
- Playbooks
- Enrichment
- CPEM_FetchAttachments
- CPEM_IOCEnrichment
- Response
- CPEM_CredentialLeakResponse
- CPEM_PhishingTakedown
- CPEM_VulnerabilityMonitoring
- Sync
- CPEM_AutomationRules
- CPEM_InboundSync
- CPEM_ManualStatusUpdate
- CPEM_OutboundSync
- Workbooks
- Images/Preview
- docs
- Check Point Cyberint IOC
- Data Connectors/CyberintArgosIOCLogs_ccp
- Data
- Package
- Cisco ETD
- Data Connectors/CiscoETD_ccp
- Data
- Package
- Workbooks
- CiscoDuoSecurity/Data Connectors
- AzureFunctionCiscoDuo
- CiscoMeraki
- Package
- data
- CiscoSEG
- Analytic Rules
- Data
- Package
- CiscoUmbrella
- Data Connectors
- CiscoUmbrella_CCP
- Data
- Package
- Parsers
- Citrix Analytics CCF
- Data Connectors/CitrixAnalytics_CCF
- Data
- Package
- Workbooks
- Images/Preview
- Claroty
- Analytic Rules
- Data
- Hunting Queries
- Package
- Workbooks
- Cloudflare CCF
- Data Connectors/CloudflareLog_CCF
- Data
- Package
- Workbooks
- Images/Logo
- Cloudflare/Data Connectors
- CofenseIntelligence/Data Connectors/CofenseIntelligenceDataConnector
- DownloadThreatReports
- Commvault Security IQ
- Data Connectors
- ContrastADR
- Analytic Rules
- Data Connectors
- AzureFunctionContrastADR
- ContrastADRCCF
- Data
- Package
- Parsers
- Workbooks
- Corelight
- Data
- Package
- Parsers
- Workbooks
- Cribl
- Data
- Package
- Workbooks
- CrowdStrike Falcon Endpoint Protection
- Analytic Rules
- Data Connectors
- CrowdStrikeAPI_ccp
- CrowdStrikeFalconAdversaryIntelligence
- CrowdStrikeFalconThreatIntelConnector
- CrowdStrikeS3FDR_ccp
- CrowdstrikeReplicatorCLv2
- Data
- Package
- Workbooks
- CyberArkAudit
- Data Connectors
- .python_packages
- lib/site-packages
- PyJWT-2.8.0.dist-info
- azure_core-1.30.1.dist-info
- azure_functions-1.18.0.dist-info
- azure_identity-1.15.0.dist-info
- azure_monitor_ingestion-1.0.3.dist-info
- azure_storage_blob-12.19.0.dist-info
- azure
- core
- pipeline
- policies
- transport
- polling
- rest
- tracing
- ext
- utils
- functions
- _thirdparty
- werkzeug
- decorators
- extension
- identity
- _credentials
- _internal
- aio
- _credentials
- _internal
- monitor/ingestion
- _operations
- aio
- _operations
- storage/blob
- _generated
- aio
- operations
- models
- operations
- aio
- certifi-2024.2.2.dist-info
- certifi
- cffi-1.16.0.dist-info
- charset_normalizer-3.3.2.dist-info
- charset_normalizer
- cli
- cryptography-42.0.5.dist-info
- cryptography
- hazmat
- backends
- openssl
- bindings
- _rust
- openssl
- openssl
- primitives
- asymmetric
- ciphers
- kdf
- serialization
- twofactor
- x509
- idna-3.6.dist-info
- idna
- isodate-0.6.1.dist-info
- isodate
- tests
- jwt
- msal-1.28.0.dist-info
- msal_extensions-1.1.0.dist-info
- msal_extensions
- msal
- oauth2cli
- packaging-24.0.dist-info
- packaging
- portalocker-2.8.2.dist-info
- portalocker
- pycparser-2.22.dist-info
- pycparser
- ply
- requests-2.31.0.dist-info
- requests-2.32.2.dist-info
- requests
- six-1.16.0.dist-info
- typing_extensions-4.10.0.dist-info
- urllib3-2.2.1.dist-info
- licenses
- urllib3
- contrib
- emscripten
- util
- Package
- CyberArkEPM
- Data Connectors
- CyberArkEPMSentinelConnector
- DataConnectors
- CyberArkEPMSentinelConnector
- Hunting Queries
- Package
- Parsers
- Workbooks
- data
- Cybersixgill-Actionable-Alerts
- Data Connectors/CybersixgillAlerts_CCF
- Data
- Hunting Queries
- Package
- Parsers
- Workbooks
- Cyjax
- Data Connectors
- CyjaxIOCIngestion
- Data
- Package
- Parsers
- Playbooks
- CyjaxAdHocEnrichment
- CyjaxAddCommentToIncident
- CyjaxDataBreaches
- CyjaxDomainMonitor
- CyjaxIncidentEnrichment
- Workbooks
- Cyren-CrowdStrike-ThreatIntelligence
- Data
- Package
- Playbooks
- Images
- Cyren-Defender-ThreatIntelligence
- Data
- Package
- Playbooks
- Images
- Cyren-SentinelOne-ThreatIntelligence
- Data
- Package
- Playbooks
- CyrenThreatIntelligence
- Data Connectors/CyrenThreatIntel_CCF
- Data
- Package
- D3SmartSOAR
- Analytic Rules
- Data
- Package
- Darktrace
- Analytic Rules
- Data Connectors
- ccf
- Data
- Package
- Workbooks
- Images/Preview
- Dataminr Pulse/Data Connectors/DataminrPulseAlerts
- Digital Shadows
- Analytic Rules
- Data Connectors
- Digital Shadows/DigitalShadowsConnectorAzureFunction
- DigitalShadowsConnectorAzureFunction
- Data
- Package
- Dynatrace
- Data Connectors
- DynatraceAttacksV1
- DynatraceAttacksV2
- DynatraceAuditLogsV1
- DynatraceAuditLogsV2
- DynatraceProblemsV1
- DynatraceProblemsV2
- DynatraceRuntimeVulnerabilitiesV1
- DynatraceRuntimeVulnerabilitiesV2
- Data
- Package
- Parsers
- Playbooks/Add_DynatraceApplicationSecurityAttackSourceIpThreatIntelligence
- ESET Protect Platform/Data Connectors
- ElasticAgent
- Data Connectors/ElasticAgent_CCF
- Data
- Package
- ExtraHop
- Data Connectors/ExtraHopDataConnector
- ExtraHopSentinelActivity
- Data
- Package
- Parsers
- FieldEffectMDR
- Analytic Rules
- Data Connectors
- Data
- Package
- Parsers
- Filewall for Microsoft 365
- Analytic Rules
- Data Connectors/FilewallM365Logs_CCP
- Data
- Package
- Parsers
- Workbooks
- Images
- Logos
- Preview
- Flare
- Analytic Rules
- Data
- Package
- Playbooks/credential-warning
- Workbooks
- Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel
- Package
- Playbooks/FortinetFortigateFunctionApp
- Fortinet FortiNDR Cloud
- Data Connectors
- fortinetFortiNdrCloudDataConn
- OrchestratorWatchdog
- sentinel
- Data
- Package
- Parsers
- Workbooks
- GitHub
- Data Connectors
- GitHubAuditLogs_AzStorage
- GithubWebhookV2
- GithubWebhookConnectorV2
- Package
- Parsers
- Workbooks
- data
- Global Secure Access
- Analytic Rules
- Data
- Package
- Workbooks
- Google Cloud Platform Cloud Monitoring/Data Connectors
- Google Threat Intelligence
- Analytic Rules/RelevanceSystemAlerts
- Data Connectors/GTIRelevanceSystemAlerts
- RelevanceSystemAlerts
- Data
- Package
- Parsers
- GoogleDirectory
- Data
- Package
- Playbooks
- GoogleDirectoryAPIConnector
- GoogleSecOps
- Analytic Rules
- Data Connectors/GoogleSecOpsDetectionAlerts
- AzureStorageToSentinel
- GoogleSecOpsToStorage
- Data
- Package
- Parsers
- GoogleWorkspaceReports
- Data Connectors/GoogleWorkspaceTemplate_ccp
- Data
- Package
- GravityZone
- Analytic Rules
- Data Connectors
- Data
- Package
- GreyNoiseThreatIntelligence
- Data Connectors
- GreyNoiseAPISentinelConnector
- Data
- Package
- Workbooks
- Halcyon
- Data Connectors
- Halcyon_ccp_v2
- Halcyon_ccp
- Data
- Package
- Parsers
- HolmSecurity
- Data Connectors
- HolmSecurityAssetLogs_ccf
- Data
- Package
- Hybrid Attack - Cloud & Identity
- .vscode
- Data
- Hunting Queries
- CredentialAccess
- DefenseEvasion
- Discovery
- Exfiltration
- InitialAccess
- LateralMovement
- Persistence
- Package
- Workbooks
- Images/Preview
- Illumio Insight
- Data Connectors/IllumioInsightsGraph_CCP
- Data
- Package
- IllumioSaaS/Data Connectors/OnPremHealthFunctionApp
- ImpervaCloudWAF
- Data Connectors/ImpervaCloudWAFLogs_ccf
- Data
- Package
- Infoblox NIOS/Package
- Infoblox/Data Connectors/InfobloxCloudDataConnector/InfobloxDossierHttpStarter
- Island
- Data Connectors
- IslandV2_CCP
- Data
- Package
- JoeSandbox
- Data Connectors
- JoeSandbox
- Data
- Package
- Playbooks
- CustomConnector/JoeSandboxEnrichment_FunctionAppConnector
- JoeSandboxGetIOCs
- JoeSandbox-Submit-File-Outlook-Attachment
- JoeSandbox-Submit-Url-Sentinel-Incident
- Lookout Cloud Security Platform for Microsoft Sentinel/Data Connectors/LookoutCSConnector
- Lookout
- Analytic Rules
- Data Connectors/LookoutStreamingConnector_ccp
- Data
- Package
- Parsers
- Playbooks
- Lookout-DeviceCompliance-Remediation
- Lookout-MobileThreat-NotifyAndEnrich
- Lookout-SmishingAlert-UserNotify
- Workbooks
- MISP2Sentinel
- Data Connectors
- Data
- Package
- Microsoft 365 Audit General and DLP
- Data Connectors
- M365AuditDLP_CCF
- M365AuditGeneral_CCF
- Data
- Package
- Microsoft Copilot
- Data Connectors
- Package
- Microsoft Defender XDR
- Analytic Rules
- Data Connectors
- Data
- Hunting Queries
- Email and Collaboration Queries
- Custom Detections
- Microsoft Teams protection
- Phish
- Submissions
- Package
- Microsoft Entra ID Assets
- Data Connectors
- Data
- Package
- Microsoft Entra ID Protection
- Analytic Rules
- Package
- Microsoft Entra ID
- Analytic Rules
- Data
- Package
- Watchlists
- Mulesoft
- Data Connectors
- MulesoftCloudHubAlerts_CCF
- MulesoftLogs_CCF
- Data
- Package
- Parsers
- NC Protect Data Connector
- NXLog BSM macOS
- Data Connectors
- Data
- Package
- NXLog FIM
- Data Connectors
- Data
- Package
- NXLog LinuxAudit
- Data Connectors
- Data
- Package
- NXLogAixAudit
- Data Connectors
- Data
- Package
- Parsers
- NXLogDnsLogs
- Data Connectors
- Data
- Package
- Parsers
- NetskopeWebTx
- Analytic Rules
- Data Connectors/NetskopeWebTx_CCF
- Data
- Package
- Parsers
- Workbooks
- Images
- NetskopeWebtxDashboard
- NordStellar/Data Connectors/NordStellar_ccf
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
39 | 39 | | |
40 | 40 | | |
41 | 41 | | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
42 | 74 | | |
43 | 75 | | |
44 | 76 | | |
| |||
51 | 83 | | |
52 | 84 | | |
53 | 85 | | |
54 | | - | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
55 | 90 | | |
56 | | - | |
| 91 | + | |
57 | 92 | | |
58 | 93 | | |
59 | 94 | | |
| |||
128 | 163 | | |
129 | 164 | | |
130 | 165 | | |
131 | | - | |
| 166 | + | |
0 commit comments