forked from demisto/content
-
Notifications
You must be signed in to change notification settings - Fork 15
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Parsing rules fix filter 9 (demisto#28478)
* Added filter to MicrosoftCloudAppSecurity * Added release notes to MicrosoftCloudAppSecurity * Added release notes to MicrosoftCloudAppSecurity * Added filter to MicrosoftDHCP parsing rules * Added release note to MicrosoftDHCP * Modified microsoftadfs parsing rule * Added release note for microsoftadfs * Updated MicrosoftDefenderAdvancedThreatProtection parsing rule * Added release note for microsoftdefenderadvancedthreatprotection * Updated parsing rule for MicrosoftCloudAppSecurity * Modified the filter for DHCP parsing rule, and modified the readme. * Modified microsoft cloud app security readme. * Modified microsoft dhcp readme. * Modified microsoft defender advanced threat protection readme. * Modified microsoft defender advanced threat protection parsing rule. * Updated MicrosoftWindowsEvents parsing rules * Added release note for microsoftwindowsevents * Added note to microsoft windows events * Added note to microsoft windows events * Bump pack from version MicrosoftDefenderAdvancedThreatProtection to 1.15.35. * Bump pack from version MicrosoftCloudAppSecurity to 2.1.36. --------- Co-authored-by: Content Bot <bot@demisto.com>
- Loading branch information
Showing
18 changed files
with
51 additions
and
19 deletions.
There are no files selected for viewing
8 changes: 4 additions & 4 deletions
8
Packs/MicrosoftADFS/ParsingRules/MicrosoftADFSParsingRules/MicrosoftADFSParsingRules.xif
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,5 +1,5 @@ | ||
[INGEST:vendor="microsoft", product="windows", target_dataset="microsoft_adfs_raw", no_hit=drop] | ||
config case_sensitive=false | ||
| filter provider_name="AD FS Auditing" OR provider_name="AD FS" | ||
| alter _product="adfs" | ||
| alter _time = coalesce(time_created,_insert_time); | ||
config case_sensitive = false | ||
| filter provider_name = "AD FS Auditing" OR provider_name="AD FS" | ||
| alter _product = "adfs" | ||
| alter _time = if(to_string(time_created) ~= "\d{2}:\d{2}:\d{2}.*", time_created, _insert_time); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
#### Parsing Rules | ||
##### Microsoft ADFS Collection Parsing Rule | ||
- Added a filter in the parsing rule to enhance its logic. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 changes: 2 additions & 1 deletion
3
...softCloudAppSecurity/ParsingRules/MicrosoftCloudAppSecurity/MicrosoftCloudAppSecurity.xif
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,3 @@ | ||
[INGEST:vendor="Microsoft", product="defender_cloud_apps", target_dataset="microsoft_defender_cloud_apps_raw", no_hit=keep] | ||
alter _time = to_timestamp(to_integer(timestamp), "millis"); | ||
filter to_string(timestamp) ~= "\d{13,}" | ||
| alter _time = to_timestamp(to_integer(timestamp), "millis"); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,4 @@ | ||
## License Information | ||
Available for E3 (EMS), E5, and standalone licenses. | ||
|
||
Note: Time parsing is supported only when the field "timestamp" is in epoch milliseconds format (for example 1674208800123). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
#### Parsing Rules | ||
##### Microsoft Cloud App Security Parsing Rule | ||
- Added a filter in the parsing rule to enhance its logic. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8 changes: 5 additions & 3 deletions
8
Packs/MicrosoftDHCP/ParsingRules/MicrosoftDHCP/MicrosoftDHCP.xif
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,6 @@ | ||
[INGEST:vendor="microsoft", product="DHCP", target_dataset="microsoft_dhcp_raw", no_hit=keep] | ||
alter tmp_time = concat(date, " ", time," ", `timezone`) | ||
|alter _time=parse_timestamp("%D %X %Ez", tmp_time) | ||
|fields -tmp_time; | ||
// Support only date time of format: MM/dd/yy hh:mm:ss [+|-]nn:nn. For example: "01/10/21 10:00:00 +03:00". | ||
filter date ~= "\d{2}\/\d{2}\/\d{2}" and time ~= "\d{2}:\d{2}:\d{2}.*" and `timezone` ~= "[\+|-]\d{2}\:?\d{2}" | ||
| alter tmp_time = concat(date, " ", time," ", `timezone`) | ||
| alter _time = parse_timestamp("%D %X %Ez", tmp_time) | ||
| fields -tmp_time; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
#### Parsing Rules | ||
##### Microsoft DHCP | ||
- Added a filter in the parsing rule to enhance its logic. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4 changes: 3 additions & 1 deletion
4
...s/MicrosoftDefenderAdvancedThreatProtection/MicrosoftDefenderAdvancedThreatProtection.xif
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 changes: 3 additions & 0 deletions
3
Packs/MicrosoftDefenderAdvancedThreatProtection/ReleaseNotes/1_15_35.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
#### Parsing Rules | ||
##### Microsoft Defender Advanced Threat Protection Parsing Rule | ||
- Added a filter in the parsing rule to enhance its logic. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4 changes: 2 additions & 2 deletions
4
Packs/MicrosoftWindowsEvents/ParsingRules/MicrosoftWindowsEvents/MicrosoftWindowsEvents.xif
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,4 @@ | ||
[INGEST:vendor="microsoft", product="windows", target_dataset="microsoft_windows_raw", no_hit=drop] | ||
config case_sensitive=false | ||
| filter provider_name!="AD FS Auditing" OR provider_name!="AD FS" | ||
| alter _time = coalesce(time_created,_insert_time); | ||
| filter provider_name != "AD FS Auditing" OR provider_name != "AD FS" | ||
| alter _time = if(to_string(time_created) ~= "\d{2}:\d{2}:\d{2}.*", time_created, _insert_time); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,4 @@ | ||
#### Parsing Rules | ||
##### Microsoft Windows Events Parsing Rule | ||
- Added a filter in the parsing rule to enhance its logic. | ||
- Please notice "Microsoft Logs Base" pack is deprecated, if you have it installed, please remove it and use the "Microsoft Windows Event Logs" pack instead. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters