Mirrors/marcredhat-siem-toolkit-patched
1
0
Fork 0
mirror of https://github.com/marcredhat/SIEM-toolkit-patched synced 2026-06-11 05:41:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit: SIEM Toolkit for SentinelOne

Browse Source 
Dockerized SecOps toolkit with:
- Coverage Map: STAR rule vs SDL parser field coverage analysis
- Ingest Dashboard: PowerQuery-powered event volume and source breakdown
- Onboarding Assistant: AI-guided log source onboarding with Claude
- Parser management via SDL MCP integration

Stack: FastAPI + PostgreSQL backend, nginx-served HTML frontend, Docker Compose.
PowerQuery runs via Scalyr XDR API (SDL_XDR_URL + SDL_LOG_READ_KEY).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Mick
2026-05-19 11:39:26 -04:00
commit c182d837ee
42 changed files with 2273 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
parsers/microsoft_azuread-latest
+33
View File
@@ -0,0 +1,33 @@
{
attributes: {
"dataSource.category": "security",
"dataSource.name": "Azure AD",
"dataSource.vendor": "Azure"
},
formats: [
{
format: ".*${parse=json}{attrBlacklist=(targetResources)}$"
rewrites: [
{ input: "activityDateTime", output: "security_finding.time_dt", match: ".*", replace: "$0" },
{ input: "activityDisplayName", output: "security_finding.activity_name", match: ".*", replace: "$0" },
{ input: "category", output: "security_finding.category_name", match: ".*", replace: "$0" },
{ input: "correlationId", output: "metadata.correlation_uid", match: ".*", replace: "$0" },
{ input: "id", output: "security_finding.activity_id", match: ".*", replace: "$0" },
{ input: "initiatedByUserId", output: "user.account_uid", match: ".*", replace: "$0" },
{ input: "initiatedByUserIpAddress", output: "user.ip", match: ".*", replace: "$0" },
{ input: "initiatedByUserUserPrincipalName", output: "user.name", match: ".*", replace: "$0" },
{ input: "operationType", output: "security_finding.type_name", match: ".*", replace: "$0" },
{ input: "result", output: "security_finding.result", match: ".*", replace: "$0" },
{ input: "resultReason", output: "security_finding.result_reason", match: ".*", replace: "$0" }
]
}, {
format: ".*targetResources\":..$targetResources.{parse=json}$"
rewrites: [
{ input: "targetResources.displayName", output: "target.name", match: ".*", replace: "$0" },
{ input: "targetResources.id", output: "target.id", match: ".*", replace: "$0" },
{ input: "targetResources.type", output: "target.type", match: ".*", replace: "$0" },
{ input: "targetResources.userPrincipalName", output: "target.userName", match: ".*", replace: "$0" }
]
}
]
}