mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 12:33:51 +00:00
Mick
c182d837ee
Dockerized SecOps toolkit with: - Coverage Map: STAR rule vs SDL parser field coverage analysis - Ingest Dashboard: PowerQuery-powered event volume and source breakdown - Onboarding Assistant: AI-guided log source onboarding with Claude - Parser management via SDL MCP integration Stack: FastAPI + PostgreSQL backend, nginx-served HTML frontend, Docker Compose. PowerQuery runs via Scalyr XDR API (SDL_XDR_URL + SDL_LOG_READ_KEY). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
33 lines
1.8 KiB
Plaintext
33 lines
1.8 KiB
Plaintext
{
|
|
attributes: {
|
|
"dataSource.category": "security",
|
|
"dataSource.name": "Azure AD",
|
|
"dataSource.vendor": "Azure"
|
|
},
|
|
formats: [
|
|
{
|
|
format: ".*${parse=json}{attrBlacklist=(targetResources)}$"
|
|
rewrites: [
|
|
{ input: "activityDateTime", output: "security_finding.time_dt", match: ".*", replace: "$0" },
|
|
{ input: "activityDisplayName", output: "security_finding.activity_name", match: ".*", replace: "$0" },
|
|
{ input: "category", output: "security_finding.category_name", match: ".*", replace: "$0" },
|
|
{ input: "correlationId", output: "metadata.correlation_uid", match: ".*", replace: "$0" },
|
|
{ input: "id", output: "security_finding.activity_id", match: ".*", replace: "$0" },
|
|
{ input: "initiatedByUserId", output: "user.account_uid", match: ".*", replace: "$0" },
|
|
{ input: "initiatedByUserIpAddress", output: "user.ip", match: ".*", replace: "$0" },
|
|
{ input: "initiatedByUserUserPrincipalName", output: "user.name", match: ".*", replace: "$0" },
|
|
{ input: "operationType", output: "security_finding.type_name", match: ".*", replace: "$0" },
|
|
{ input: "result", output: "security_finding.result", match: ".*", replace: "$0" },
|
|
{ input: "resultReason", output: "security_finding.result_reason", match: ".*", replace: "$0" }
|
|
]
|
|
}, {
|
|
format: ".*targetResources\":..$targetResources.{parse=json}$"
|
|
rewrites: [
|
|
{ input: "targetResources.displayName", output: "target.name", match: ".*", replace: "$0" },
|
|
{ input: "targetResources.id", output: "target.id", match: ".*", replace: "$0" },
|
|
{ input: "targetResources.type", output: "target.type", match: ".*", replace: "$0" },
|
|
{ input: "targetResources.userPrincipalName", output: "target.userName", match: ".*", replace: "$0" }
|
|
]
|
|
}
|
|
]
|
|
} |