mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 20:37:12 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
114 lines
4.0 KiB
Plaintext
114 lines
4.0 KiB
Plaintext
// SentinelOne AI SIEM Parser: Microsoft DNS Debug Log
|
|
// OCSF Schema Version: 1.1.0
|
|
// Maps Microsoft DNS debug logs to OCSF classes
|
|
// Primary Class: DNS Activity (4003)
|
|
|
|
{
|
|
"parserName": "MicrosoftDNS-OCSF",
|
|
"version": "1.0.0",
|
|
"vendor": "Microsoft",
|
|
"product": "DNS Server",
|
|
"format": "regex",
|
|
|
|
"patterns": [
|
|
// DNS Query/Response
|
|
{
|
|
"pattern": "^(\\d+/\\d+/\\d+)\\s+(\\d+:\\d+:\\d+\\s+[AP]M)\\s+(\\w+)\\s+PACKET\\s+(\\w+)\\s+(UDP|TCP)\\s+(Rcv|Snd)\\s+([\\d.]+)\\s+(\\w+)\\s+([RQ\\s]+)\\s+\\[([^\\]]+)\\]\\s+(\\w+)\\s+(.+)$",
|
|
"rewrites": [
|
|
{"set": "class_uid", "value": "4003"},
|
|
{"set": "class_name", "value": "DNS Activity"},
|
|
{"set": "category_uid", "value": "4"},
|
|
{"set": "category_name", "value": "Network Activity"},
|
|
|
|
// Activity based on direction
|
|
{"group": 6, "to": "direction"},
|
|
{"lookup": "direction", "map": {"Rcv": 1, "Snd": 2}, "to": "activity_id"},
|
|
{"lookup": "direction", "map": {"Rcv": "Query", "Snd": "Response"}, "to": "activity_name"},
|
|
|
|
// Metadata
|
|
{"set": "metadata.version", "value": "1.1.0"},
|
|
{"set": "metadata.product.name", "value": "Microsoft DNS"},
|
|
{"set": "metadata.product.vendor_name", "value": "Microsoft"},
|
|
{"group": 3, "to": "metadata.uid"},
|
|
{"group": 4, "to": "metadata.log_name"},
|
|
|
|
// Time
|
|
{"concat": ["$1", " ", "$2"], "to": "time"},
|
|
|
|
// Protocol
|
|
{"group": 5, "to": "connection_info.protocol_name"},
|
|
|
|
// Client IP
|
|
{"group": 7, "to": "src_endpoint.ip"},
|
|
|
|
// Transaction ID
|
|
{"group": 8, "to": "query_info.uid"},
|
|
|
|
// Flags
|
|
{"group": 9, "to": "query_info.flags"},
|
|
{"group": 10, "to": "rcode_name"},
|
|
|
|
// Query type
|
|
{"group": 11, "to": "query_info.type"},
|
|
|
|
// Query name (decode DNS format)
|
|
{"group": 12, "to": "query_info.hostname", "transform": "decodeDnsName"},
|
|
|
|
// Response code mapping
|
|
{"lookup": "rcode_name", "map": {
|
|
"NOERROR": 0, "FORMERR": 1, "SERVFAIL": 2, "NXDOMAIN": 3,
|
|
"NOTIMP": 4, "REFUSED": 5, "YXDOMAIN": 6, "YXRRSET": 7
|
|
}, "to": "rcode_id"},
|
|
|
|
// Status based on response code
|
|
{"set": "status_id", "value": "1", "if": "NOERROR"},
|
|
{"set": "status", "value": "Success", "if": "NOERROR"},
|
|
{"set": "status_id", "value": "2", "if": "REFUSED|NXDOMAIN|SERVFAIL"},
|
|
{"set": "status", "value": "Failure", "if": "REFUSED|NXDOMAIN|SERVFAIL"},
|
|
|
|
// Observables
|
|
{"array": "observables", "append": {"type": "IP Address", "type_id": 2, "value": "$7"}},
|
|
{"array": "observables", "append": {"type": "Hostname", "type_id": 1, "value": "$query_info.hostname"}}
|
|
]
|
|
}
|
|
],
|
|
|
|
"transforms": {
|
|
"decodeDnsName": {
|
|
"description": "Converts DNS wire format (4)mail(4)corp(5)local(0) to mail.corp.local",
|
|
"regex": "\\((\\d+)\\)([^(]+)",
|
|
"replace": "$2.",
|
|
"trim": "."
|
|
}
|
|
},
|
|
|
|
"query_type_mappings": {
|
|
"A": {"id": 1, "name": "A (IPv4 Address)"},
|
|
"AAAA": {"id": 28, "name": "AAAA (IPv6 Address)"},
|
|
"MX": {"id": 15, "name": "MX (Mail Exchange)"},
|
|
"TXT": {"id": 16, "name": "TXT (Text)"},
|
|
"CNAME": {"id": 5, "name": "CNAME (Canonical Name)"},
|
|
"NS": {"id": 2, "name": "NS (Name Server)"},
|
|
"SOA": {"id": 6, "name": "SOA (Start of Authority)"},
|
|
"PTR": {"id": 12, "name": "PTR (Pointer)"},
|
|
"SRV": {"id": 33, "name": "SRV (Service)"},
|
|
"AXFR": {"id": 252, "name": "AXFR (Zone Transfer)"},
|
|
"ANY": {"id": 255, "name": "ANY (All Records)"}
|
|
},
|
|
|
|
"security_indicators": {
|
|
"zone_transfer": {
|
|
"condition": "query_info.type == 'AXFR'",
|
|
"severity_id": 4,
|
|
"severity": "High",
|
|
"finding_info.title": "DNS Zone Transfer Attempt"
|
|
},
|
|
"any_query": {
|
|
"condition": "query_info.type == 'ANY'",
|
|
"severity_id": 3,
|
|
"severity": "Medium",
|
|
"finding_info.title": "DNS ANY Query (Potential Amplification)"
|
|
}
|
|
}
|
|
}
|