[ASIM] Anthropic Claude Compliance - AgentEvent

.script/tests/KqlvalidationsTests/CustomTables/BV_ClaudeCompliance_ComplianceActivities_CL.json

@@ -0,0 +1,89 @@
+{
+    "Name": "BV_ClaudeCompliance_ComplianceActivities_CL",
+    "Properties": [
+        {
+            "Name": "TimeGenerated",
+            "Type": "datetime"
+        },
+        {
+            "Name": "actor",
+            "Type": "Object"
+        },
+        {
+            "Name": "claude_artifact_id",
+            "Type": "string"
+        },
+        {
+            "Name": "claude_chat_id",
+            "Type": "string"
+        },
+        {
+            "Name": "claude_file_id",
+            "Type": "string"
+        },
+        {
+            "Name": "claude_project_id",
+            "Type": "string"
+        },
+        {
+            "Name": "created_at",
+            "Type": "datetime"
+        },
+        {
+            "Name": "filename",
+            "Type": "string"
+        },
+        {
+            "Name": "id_CF",
+            "Type": "string"
+        },
+        {
+            "Name": "organization_id",
+            "Type": "string"
+        },
+        {
+            "Name": "organization_uuid",
+            "Type": "string"
+        },
+        {
+            "Name": "request_body",
+            "Type": "string"
+        },
+        {
+            "Name": "request_id",
+            "Type": "string"
+        },
+        {
+            "Name": "request_method",
+            "Type": "string"
+        },
+        {
+            "Name": "status_code",
+            "Type": "int"
+        },
+        {
+            "Name": "type_CF",
+            "Type": "string"
+        },
+        {
+            "Name": "url",
+            "Type": "string"
+        },
+        {
+            "Name": "TenantId",
+            "Type": "string"
+        },
+        {
+            "Name": "Type",
+            "Type": "string"
+        },
+        {
+            "Name": "_ResourceId",
+            "Type": "string"
+        },
+        {
+            "Name": "_ItemId",
+            "Type": "string"
+        }
+    ]
+}

Parsers/ASimAgentEvent/ARM/ASimAgentEntity/ASimAgentEntity.json → Parsers/ASimAgentEvent/ARM/ASimAgentEvent/ASimAgentEvent.json

@@ -27,7 +27,7 @@
         "displayName": "Agent Event ASIM parser",
         "category": "ASIM",
         "FunctionAlias": "ASimAgentEvent",
-        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAgentEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser| where isnotempty(SourceSpecificParser));\nlet ASimBuiltInDisabled=toscalar('ExcludeASimAgentEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(pack:bool=false){\nunion isfuzzy=true\n  vimAgentEventEmpty\n}; \nparser (pack=pack)",
+        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeASimAgentEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser| where isnotempty(SourceSpecificParser));\nlet ASimBuiltInDisabled=toscalar('ExcludeASimAgentEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(pack:bool=false){\nunion isfuzzy=true\n  vimAgentEventEmpty,\n  ASimAgentEventAnthropicClaudeCompliance (disabled=(ASimBuiltInDisabled or ('ExcludeASimAgentEventAnthropicClaudeCompliance' in (DisabledParsers))), pack=pack)\n}; \nparser (pack=pack)",
         "version": 1,
         "functionParameters": "pack:bool=False"
       }

Parsers/ASimAgentEvent/ARM/ASimAgentEntity/README.md → Parsers/ASimAgentEvent/ARM/ASimAgentEvent/README.md

@@ -14,8 +14,8 @@ For more information, see:
 - [ASIM AgentEvent normalization schema reference](https://aka.ms/ASimAgentEventDoc)
 
 For the changelog, see:
-- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAgentEvent/CHANGELOG/ASimAgentEntity.md)
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAgentEvent/CHANGELOG/ASimAgentEvent.md)
 
 <br>
 
-[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAgentEvent%2FARM%2FASimAgentEntity%2FASimAgentEntity.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAgentEvent%2FARM%2FASimAgentEntity%2FASimAgentEntity.json)
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAgentEvent%2FARM%2FASimAgentEvent%2FASimAgentEvent.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAgentEvent%2FARM%2FASimAgentEvent%2FASimAgentEvent.json)

Parsers/ASimAgentEvent/ARM/ASimAgentEventAnthropicClaudeCompliance/ASimAgentEventAnthropicClaudeCompliance.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "Workspace": {
+      "type": "string",
+      "metadata": {
+        "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group."
+      }
+    },
+    "WorkspaceRegion": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "The region of the selected workspace. The default value will use the Region selection above."
+      }
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+      "apiVersion": "2020-08-01",
+      "name": "[concat(parameters('Workspace'), '/ASimAgentEventAnthropicClaudeCompliance')]",
+      "location": "[parameters('WorkspaceRegion')]",
+      "properties": {
+        "etag": "*",
+        "displayName": "Agent Event ASIM parser for Anthropic Claude Compliance",
+        "category": "ASIM",
+        "FunctionAlias": "ASimAgentEventAnthropicClaudeCompliance",
+        "query": "let Parser = (\n    disabled: bool=false,\n    pack: bool=false\n)\n{\n    BV_ClaudeCompliance_ComplianceActivities_CL\n    | where not(disabled)\n    | where type_CF != 'compliance_api_accessed' //filter out API requests for logs\n    | project-rename\n        EventStartTime = created_at,\n        EventUid = _ItemId,\n        EventOriginalUid = id_CF,\n        EventType = type_CF\n    | extend\n        EventSchema = 'AgentEvent',\n        EventSchemaVersion = '0.1.0',\n        EventCount = toint(1),\n        EventVendor = 'Anthropic',\n        EventProduct = 'Claude Enterprise',\n        TargetAgentId = coalesce(claude_project_id, claude_chat_id, claude_file_id),\n        EventEndTime = TimeGenerated\n    | evaluate bag_unpack(actor)\n    | project-rename\n        ActorUserId = user_id,\n        SrcIpAddr = ip_address\n    | extend\n        ActorUsername = coalesce(email_address, unauthenticated_email_address),\n        ActorUsernameType = iff(isnotempty(coalesce(email_address, unauthenticated_email_address)), 'UPN', '')\n    | extend AdditionalFields = iff (\n        pack,\n        bag_pack(\n            'request_id', request_id,\n            'request_method', request_method,\n            'status_code', status_code,\n            'url', url,\n            'claude_chat_id', claude_chat_id,\n            'claude_file_id', claude_file_id,\n            'claude_project_id', claude_project_id,\n            'user_agent', user_agent,\n            'status_code', status_code\n        ),\n        dynamic({})\n    )\n    | project\n        TimeGenerated,\n        Type,\n        EventStartTime,\n        EventEndTime,\n        EventUid,\n        EventOriginalUid,\n        EventType,\n        EventSchema,\n        EventSchemaVersion,\n        EventCount,\n        EventVendor,\n        EventProduct,\n        TargetAgentId,\n        ActorUserId,\n        SrcIpAddr,\n        ActorUsername,\n        ActorUsernameType,\n        AdditionalFields,\n        EventResult = case(\n            status_code >= 200 and status_code < 300, 'Success',\n            status_code >= 400 and status_code < 500, 'Failure',\n            status_code >= 500, 'Failure',\n            isempty(status_code), '',\n            ''\n        ),\n        Dvc = SrcIpAddr\n};\nParser\n(\n    disabled = disabled,\n    pack = pack\n)   ",
+        "version": 1,
+        "functionParameters": "disabled:bool=False,pack:bool=False"
+      }
+    }
+  ]
+}

Parsers/ASimAgentEvent/ARM/ASimAgentEventAnthropicClaudeCompliance/README.md

@@ -0,0 +1,21 @@
+# Anthropic Claude Compliance ASIM AgentEvent Normalization Parser
+
+ARM template for ASIM AgentEvent schema parser for Anthropic Claude Compliance.
+
+This ASIM parser supports normalizing the Anthropic Claude Compliance logs (via Codeless Connector Framework by BlueVoyant) to the ASIM Agent normalized schema.
+
+
+The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
+
+For more information, see:
+
+- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
+- [Deploy all of ASIM](https://aka.ms/DeployASIM)
+- [ASIM AgentEvent normalization schema reference](https://aka.ms/ASimAgentEventDoc)
+
+For the changelog, see:
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAgentEvent/CHANGELOG/ASimAgentEventAnthropicClaudeCompliance.md)
+
+<br>
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAgentEvent%2FARM%2FASimAgentEventAnthropicClaudeCompliance%2FASimAgentEventAnthropicClaudeCompliance.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAgentEvent%2FARM%2FASimAgentEventAnthropicClaudeCompliance%2FASimAgentEventAnthropicClaudeCompliance.json)

Parsers/ASimAgentEvent/ARM/FullDeploymentAgentEvent.json

@@ -21,11 +21,31 @@
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",
-      "name": "linkedASimAgentEntity",
+      "name": "linkedASimAgentEvent",
       "properties": {
         "mode": "Incremental",
         "templateLink": {
-          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAgentEvent/ARM/ASimAgentEntity/ASimAgentEntity.json",
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAgentEvent/ARM/ASimAgentEvent/ASimAgentEvent.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedASimAgentEventAnthropicClaudeCompliance",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAgentEvent/ARM/ASimAgentEventAnthropicClaudeCompliance/ASimAgentEventAnthropicClaudeCompliance.json",
           "contentVersion": "1.0.0.0"
         },
         "parameters": {
@@ -58,6 +78,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedvimAgentEventAnthropicClaudeCompliance",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAgentEvent/ARM/vimAgentEventAnthropicClaudeCompliance/vimAgentEventAnthropicClaudeCompliance.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",

Parsers/ASimAgentEvent/ARM/imAgentEvent/imAgentEvent.json

@@ -27,7 +27,7 @@
         "displayName": "Agent Event ASIM filtering parser",
         "category": "ASIM",
         "FunctionAlias": "imAgentEvent",
-        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAgentEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser | where isnotempty(SourceSpecificParser));\nlet vimBuiltInDisabled=toscalar('ExcludevimAgentEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(\n  starttime: datetime=datetime(null), \n  endtime: datetime=datetime(null), \n  agentid_has_any: dynamic=dynamic([]),\n  agentname_has_any: dynamic=dynamic([]),\n  username_has_any: dynamic=dynamic([]),\n  pack:bool=false)\n{\nunion isfuzzy=true\n  vimAgentEventEmpty\n};\nparser (starttime=starttime, endtime=endtime, agentid_has_any=agentid_has_any, agentname_has_any=agentname_has_any, username_has_any=username_has_any, pack=pack)",
+        "query": "let DisabledParsers=materialize(_GetWatchlist('ASimDisabledParsers') | where SearchKey in ('Any', 'ExcludeimAgentEvent') | extend SourceSpecificParser=column_ifexists('SourceSpecificParser','') | distinct SourceSpecificParser | where isnotempty(SourceSpecificParser));\nlet vimBuiltInDisabled=toscalar('ExcludevimAgentEvent' in (DisabledParsers) or 'Any' in (DisabledParsers)); \nlet parser=(\n  starttime: datetime=datetime(null), \n  endtime: datetime=datetime(null), \n  agentid_has_any: dynamic=dynamic([]),\n  agentname_has_any: dynamic=dynamic([]),\n  username_has_any: dynamic=dynamic([]),\n  pack:bool=false)\n{\nunion isfuzzy=true\n  vimAgentEventEmpty,\n  vimAgentEventAnthropicClaudeCompliance (starttime=starttime, endtime=endtime, agentid_has_any=agentid_has_any, agentname_has_any=agentname_has_any, username_has_any=username_has_any, disabled=(vimBuiltInDisabled or ('ExcludevimAgentEventAnthropicClaudeCompliance' in (DisabledParsers))), pack=pack)\n};\nparser (starttime=starttime, endtime=endtime, agentid_has_any=agentid_has_any, agentname_has_any=agentname_has_any, username_has_any=username_has_any, pack=pack)",
         "version": 1,
         "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),agentid_has_any:dynamic=dynamic([]),agentname_has_any:dynamic=dynamic([]),username_has_any:dynamic=dynamic([]),pack:bool=False"
       }

Parsers/ASimAgentEvent/ARM/vimAgentEventAnthropicClaudeCompliance/README.md

@@ -0,0 +1,21 @@
+# Anthropic Claude Compliance ASIM AgentEvent Normalization Parser
+
+ARM template for ASIM AgentEvent schema parser for Anthropic Claude Compliance.
+
+This ASIM parser supports normalizing the Anthropic Claude Compliance logs (via Codeless Connector Framework by BlueVoyant) to the ASIM Agent normalized schema.
+
+
+The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
+
+For more information, see:
+
+- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
+- [Deploy all of ASIM](https://aka.ms/DeployASIM)
+- [ASIM AgentEvent normalization schema reference](https://aka.ms/ASimAgentEventDoc)
+
+For the changelog, see:
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAgentEvent/CHANGELOG/vimAgentEventAnthropicClaudeCompliance.md)
+
+<br>
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAgentEvent%2FARM%2FvimAgentEventAnthropicClaudeCompliance%2FvimAgentEventAnthropicClaudeCompliance.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAgentEvent%2FARM%2FvimAgentEventAnthropicClaudeCompliance%2FvimAgentEventAnthropicClaudeCompliance.json)