mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 20:37:12 +00:00
marc
7c1687efce
Brought in 35 upstream commits (MITRE heatmap, health score, dependency map,
PowerQuery playground, onboarding tracker, product grouping, modern UI redesign).
Preserved fork additions:
backend/routers/quality.py KV scanner, pattern refs, JS keys, JSON mode,
/parsers + /sync-from-sdl endpoints
parsers/ 96 OCSF + tenant parsers
tools/stormshield-verify/ end-to-end ingest regression test
.gitignore un-ignored parsers/*
CHANGES.md, PATCHES.md
220 lines
10 KiB
Plaintext
220 lines
10 KiB
Plaintext
// SentinelOne AI SIEM Parser: Microsoft Windows Security Event Log
|
|
// OCSF Schema Version: 1.1.0
|
|
// Maps Windows Security XML events to OCSF classes
|
|
// Primary Classes: Authentication (3002), Account Change (3001), Process Activity (1007)
|
|
|
|
{
|
|
"parserName": "WindowsSecurity-OCSF",
|
|
"version": "1.0.0",
|
|
"vendor": "Microsoft",
|
|
"product": "Windows Security",
|
|
"format": "xml",
|
|
|
|
"patterns": [
|
|
// Successful Logon (4624)
|
|
{
|
|
"pattern": "<EventID>4624</EventID>",
|
|
"rewrites": [
|
|
{"set": "class_uid", "value": "3002"},
|
|
{"set": "class_name", "value": "Authentication"},
|
|
{"set": "category_uid", "value": "3"},
|
|
{"set": "category_name", "value": "Identity & Access Management"},
|
|
{"set": "activity_id", "value": "1"},
|
|
{"set": "activity_name", "value": "Logon"},
|
|
{"set": "type_uid", "value": "300201"},
|
|
|
|
// Metadata
|
|
{"set": "metadata.version", "value": "1.1.0"},
|
|
{"set": "metadata.product.name", "value": "Windows Security"},
|
|
{"set": "metadata.product.vendor_name", "value": "Microsoft"},
|
|
{"xpath": "//System/EventRecordID", "to": "metadata.uid"},
|
|
{"xpath": "//System/Computer", "to": "metadata.product.feature.name"},
|
|
|
|
// Time
|
|
{"xpath": "//System/TimeCreated/@SystemTime", "to": "time"},
|
|
|
|
// User (Target)
|
|
{"xpath": "//EventData/Data[@Name='TargetUserName']", "to": "user.name"},
|
|
{"xpath": "//EventData/Data[@Name='TargetDomainName']", "to": "user.domain"},
|
|
{"xpath": "//EventData/Data[@Name='TargetUserSid']", "to": "user.uid"},
|
|
{"xpath": "//EventData/Data[@Name='TargetLogonId']", "to": "session.uid"},
|
|
|
|
// Actor (Subject)
|
|
{"xpath": "//EventData/Data[@Name='SubjectUserName']", "to": "actor.user.name"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectDomainName']", "to": "actor.user.domain"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectUserSid']", "to": "actor.user.uid"},
|
|
|
|
// Logon type mapping
|
|
{"xpath": "//EventData/Data[@Name='LogonType']", "to": "logon_type_id"},
|
|
{"lookup": "logon_type_id", "map": {
|
|
"2": "Interactive",
|
|
"3": "Network",
|
|
"4": "Batch",
|
|
"5": "Service",
|
|
"7": "Unlock",
|
|
"8": "NetworkCleartext",
|
|
"9": "NewCredentials",
|
|
"10": "RemoteInteractive",
|
|
"11": "CachedInteractive"
|
|
}, "to": "logon_type"},
|
|
|
|
// Source endpoint
|
|
{"xpath": "//EventData/Data[@Name='IpAddress']", "to": "src_endpoint.ip"},
|
|
{"xpath": "//EventData/Data[@Name='IpPort']", "to": "src_endpoint.port"},
|
|
{"xpath": "//EventData/Data[@Name='WorkstationName']", "to": "src_endpoint.name"},
|
|
|
|
// Authentication details
|
|
{"xpath": "//EventData/Data[@Name='AuthenticationPackageName']", "to": "auth_protocol"},
|
|
{"xpath": "//EventData/Data[@Name='LogonProcessName']", "to": "logon_process.name"},
|
|
|
|
// Process
|
|
{"xpath": "//EventData/Data[@Name='ProcessId']", "to": "actor.process.pid"},
|
|
{"xpath": "//EventData/Data[@Name='ProcessName']", "to": "actor.process.file.path"},
|
|
|
|
// Status
|
|
{"set": "status_id", "value": "1"},
|
|
{"set": "status", "value": "Success"}
|
|
]
|
|
},
|
|
|
|
// Failed Logon (4625)
|
|
{
|
|
"pattern": "<EventID>4625</EventID>",
|
|
"rewrites": [
|
|
{"set": "class_uid", "value": "3002"},
|
|
{"set": "class_name", "value": "Authentication"},
|
|
{"set": "activity_id", "value": "1"},
|
|
{"set": "activity_name", "value": "Logon"},
|
|
{"set": "status_id", "value": "2"},
|
|
{"set": "status", "value": "Failure"},
|
|
|
|
{"set": "metadata.version", "value": "1.1.0"},
|
|
{"set": "metadata.product.name", "value": "Windows Security"},
|
|
{"set": "metadata.product.vendor_name", "value": "Microsoft"},
|
|
|
|
{"xpath": "//EventData/Data[@Name='TargetUserName']", "to": "user.name"},
|
|
{"xpath": "//EventData/Data[@Name='TargetDomainName']", "to": "user.domain"},
|
|
{"xpath": "//EventData/Data[@Name='Status']", "to": "status_code"},
|
|
{"xpath": "//EventData/Data[@Name='SubStatus']", "to": "status_detail"},
|
|
{"xpath": "//EventData/Data[@Name='FailureReason']", "to": "message"},
|
|
{"xpath": "//EventData/Data[@Name='IpAddress']", "to": "src_endpoint.ip"},
|
|
{"xpath": "//EventData/Data[@Name='WorkstationName']", "to": "src_endpoint.name"},
|
|
{"xpath": "//EventData/Data[@Name='LogonType']", "to": "logon_type_id"},
|
|
|
|
// Severity for failed auth
|
|
{"set": "severity_id", "value": "3"},
|
|
{"set": "severity", "value": "Medium"}
|
|
]
|
|
},
|
|
|
|
// Process Creation (4688)
|
|
{
|
|
"pattern": "<EventID>4688</EventID>",
|
|
"rewrites": [
|
|
{"set": "class_uid", "value": "1007"},
|
|
{"set": "class_name", "value": "Process Activity"},
|
|
{"set": "category_uid", "value": "1"},
|
|
{"set": "category_name", "value": "System Activity"},
|
|
{"set": "activity_id", "value": "1"},
|
|
{"set": "activity_name", "value": "Launch"},
|
|
{"set": "type_uid", "value": "100701"},
|
|
|
|
{"set": "metadata.version", "value": "1.1.0"},
|
|
{"set": "metadata.product.name", "value": "Windows Security"},
|
|
{"set": "metadata.product.vendor_name", "value": "Microsoft"},
|
|
|
|
// Actor
|
|
{"xpath": "//EventData/Data[@Name='SubjectUserName']", "to": "actor.user.name"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectDomainName']", "to": "actor.user.domain"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectUserSid']", "to": "actor.user.uid"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectLogonId']", "to": "actor.session.uid"},
|
|
|
|
// New Process
|
|
{"xpath": "//EventData/Data[@Name='NewProcessId']", "to": "process.pid"},
|
|
{"xpath": "//EventData/Data[@Name='NewProcessName']", "to": "process.file.path"},
|
|
{"xpath": "//EventData/Data[@Name='CommandLine']", "to": "process.cmd_line"},
|
|
{"xpath": "//EventData/Data[@Name='TokenElevationType']", "to": "process.integrity"},
|
|
|
|
// Parent Process
|
|
{"xpath": "//EventData/Data[@Name='ProcessId']", "to": "process.parent_process.pid"},
|
|
{"xpath": "//EventData/Data[@Name='ParentProcessName']", "to": "process.parent_process.file.path"},
|
|
|
|
// Labels
|
|
{"xpath": "//EventData/Data[@Name='MandatoryLabel']", "to": "process.integrity_id"}
|
|
]
|
|
},
|
|
|
|
// Special Privileges (4672)
|
|
{
|
|
"pattern": "<EventID>4672</EventID>",
|
|
"rewrites": [
|
|
{"set": "class_uid", "value": "3002"},
|
|
{"set": "class_name", "value": "Authentication"},
|
|
{"set": "activity_id", "value": "2"},
|
|
{"set": "activity_name", "value": "Logon: Privileged"},
|
|
|
|
{"set": "metadata.version", "value": "1.1.0"},
|
|
{"set": "metadata.product.name", "value": "Windows Security"},
|
|
|
|
{"xpath": "//EventData/Data[@Name='SubjectUserName']", "to": "user.name"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectDomainName']", "to": "user.domain"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectUserSid']", "to": "user.uid"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectLogonId']", "to": "session.uid"},
|
|
{"xpath": "//EventData/Data[@Name='PrivilegeList']", "to": "user.privileges"},
|
|
|
|
{"set": "is_admin", "value": "true"}
|
|
]
|
|
},
|
|
|
|
// User Account Created (4720)
|
|
{
|
|
"pattern": "<EventID>4720</EventID>",
|
|
"rewrites": [
|
|
{"set": "class_uid", "value": "3001"},
|
|
{"set": "class_name", "value": "Account Change"},
|
|
{"set": "category_uid", "value": "3"},
|
|
{"set": "category_name", "value": "Identity & Access Management"},
|
|
{"set": "activity_id", "value": "1"},
|
|
{"set": "activity_name", "value": "Create"},
|
|
{"set": "type_uid", "value": "300101"},
|
|
|
|
{"set": "metadata.version", "value": "1.1.0"},
|
|
{"set": "metadata.product.name", "value": "Windows Security"},
|
|
|
|
// Actor (who created)
|
|
{"xpath": "//EventData/Data[@Name='SubjectUserName']", "to": "actor.user.name"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectDomainName']", "to": "actor.user.domain"},
|
|
{"xpath": "//EventData/Data[@Name='SubjectUserSid']", "to": "actor.user.uid"},
|
|
|
|
// Target (new account)
|
|
{"xpath": "//EventData/Data[@Name='TargetUserName']", "to": "user.name"},
|
|
{"xpath": "//EventData/Data[@Name='TargetDomainName']", "to": "user.domain"},
|
|
{"xpath": "//EventData/Data[@Name='TargetSid']", "to": "user.uid"},
|
|
{"xpath": "//EventData/Data[@Name='SamAccountName']", "to": "user.account.name"},
|
|
{"xpath": "//EventData/Data[@Name='DisplayName']", "to": "user.full_name"},
|
|
{"xpath": "//EventData/Data[@Name='UserPrincipalName']", "to": "user.email_addr"}
|
|
]
|
|
}
|
|
],
|
|
|
|
"event_id_mappings": {
|
|
"4624": {"class": "Authentication", "activity": "Logon", "status": "Success"},
|
|
"4625": {"class": "Authentication", "activity": "Logon", "status": "Failure"},
|
|
"4634": {"class": "Authentication", "activity": "Logoff", "status": "Success"},
|
|
"4648": {"class": "Authentication", "activity": "Logon: Explicit Credentials"},
|
|
"4672": {"class": "Authentication", "activity": "Logon: Privileged"},
|
|
"4688": {"class": "Process Activity", "activity": "Launch"},
|
|
"4689": {"class": "Process Activity", "activity": "Terminate"},
|
|
"4720": {"class": "Account Change", "activity": "Create"},
|
|
"4722": {"class": "Account Change", "activity": "Enable"},
|
|
"4723": {"class": "Account Change", "activity": "Password Change"},
|
|
"4724": {"class": "Account Change", "activity": "Password Reset"},
|
|
"4725": {"class": "Account Change", "activity": "Disable"},
|
|
"4726": {"class": "Account Change", "activity": "Delete"},
|
|
"4728": {"class": "Group Membership", "activity": "Add"},
|
|
"4729": {"class": "Group Membership", "activity": "Remove"},
|
|
"4732": {"class": "Group Membership", "activity": "Add"},
|
|
"4733": {"class": "Group Membership", "activity": "Remove"}
|
|
}
|
|
}
|