Skip to content

Commit

Permalink
Refresh intakes documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
@sekoia-io-cross-repo-comm-app @github-actions
sekoia-io-cross-repo-comm-app[bot] authored and github-actions[bot] committed Feb 13, 2024
1 parent 4272175 commit 59adc88
Show file tree
Hide file tree
Showing 16 changed files with 3,033 additions and 180 deletions.
55 changes: 55 additions & 0 deletions ...perations_center/integrations/generated/02a74ceb-a9b0-467c-97d1-588319e39d71.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -443,6 +443,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"ip": [
"1.2.3.4",
"5.6.7.8"
],
"user": [
"vpn17590"
]
},
"rule": {
Expand All @@ -451,6 +454,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"name": "vpn17590"
}
}
Expand Down Expand Up @@ -518,6 +524,53 @@ Find below few samples of events and how they are normalized by Sekoia.io.
```


=== "test_sslvpn_log_3.json"

```json

{
"message": "\"12/07/2023:10:58:42 GMT CXA-GAT 0-PPE-0 : default SSLVPN Message 1521206 0 : \"SSO ns_sslvpn_process_sso_conn: user [email protected] clientip 1.2.3.7 request: /Citrix/CITRIXCGDWeb/clients/HTML5Client/resources/images/icon_clipboard.png sso_flags-0 p_flags-0 x_flags-200000 author_hdr_removed-0\"\"",
"event": {
"category": [
"network"
],
"code": "Message",
"dataset": "audit_sslvpn",
"kind": "event",
"type": [
"connection"
]
},
"@timestamp": "2023-12-07T10:58:42Z",
"citrix": {
"adc": {
"message": "SSO ns_sslvpn_process_sso_conn: user [email protected] clientip 1.2.3.7 request: /Citrix/CITRIXCGDWeb/clients/HTML5Client/resources/images/icon_clipboard.png sso_flags-0 p_flags-0 x_flags-200000 author_hdr_removed-0"
}
},
"client": {
"address": "1.2.3.7",
"ip": "1.2.3.7"
},
"observer": {
"name": "CXA-GAT"
},
"related": {
"ip": [
"1.2.3.7"
],
"user": [
"john.doe"
]
},
"user": {
"domain": "example.com",
"name": "john.doe"
}
}
```





Expand All @@ -534,6 +587,7 @@ The following table lists the fields that are extracted, normalized under the EC
|`citrix.adc.message` | `keyword` | |
|`citrix.adc.virtual_server.ip` | `keyword` | |
|`citrix.adc.virtual_server.port` | `keyword` | |
|`client.ip` | `ip` | IP address of the client. |
|`destination.ip` | `ip` | IP address of the destination. |
|`event.action` | `keyword` | The action captured by the event. |
|`event.category` | `keyword` | Event category. The second categorization field in the hierarchy. |
Expand All @@ -554,5 +608,6 @@ The following table lists the fields that are extracted, normalized under the EC
|`tls.cipher` | `keyword` | String indicating the cipher used during the current connection. |
|`tls.version` | `keyword` | Numeric part of the version parsed from the original string. |
|`url.original` | `wildcard` | Unmodified original url as seen in the event source. |
|`user.domain` | `keyword` | Name of the directory the user is a member of. |
|`user.name` | `keyword` | Short name or login of the user. |

186 changes: 96 additions & 90 deletions ...perations_center/integrations/generated/19cd2ed6-f90c-47f7-a46b-974354a107bb.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -490,6 +490,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Office 365 Exchange Online",
"appId": "00000002-0000-0ff1-ce00-000000000000",
"authenticationProtocol": "ropc",
"correlationId": "7ee10819-f631-4ab1-8edb-4efb7286baba",
"id": "b2fdcc8f-954d-4d88-a035-58daefab4f00",
Expand Down Expand Up @@ -626,6 +627,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Office365 Shell WCSS-Client",
"appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
"authenticationProtocol": "none",
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"id": "22253f56-6fc4-45f2-b148-d7fe15504900",
Expand Down Expand Up @@ -721,6 +723,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Microsoft App Access Panel",
"appId": "0000000c-0000-0000-c000-000000000000",
"authenticationProtocol": "none",
"correlationId": "467c1340-0762-40d2-b6fb-339235633ebb",
"id": "8795994f-0bb8-46d7-8797-8c9c385d5900",
Expand Down Expand Up @@ -802,53 +805,37 @@ Find below few samples of events and how they are normalized by Sekoia.io.
]
},
"@timestamp": "2023-08-16T15:32:05.577260Z",
"service": {
"type": "ldap",
"name": "Azure Active Directory"
},
"action": {
"name": "Sign-in activity"
},
"azuread": {
"resourceId": "/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"Level": 4,
"callerIpAddress": "1.2.3.4",
"category": "SignInLogs",
"tenantId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"durationMs": 0,
"correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"durationMs": 0,
"identity": "John DOE",
"Level": 4,
"callerIpAddress": "1.2.3.4",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"id": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"appDisplayName": "Microsoft Authentication Broker",
"appId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"authenticationProtocol": "none",
"correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"riskState": "none",
"id": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"riskDetail": "none",
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "0",
"additionalDetails": "MFA completed in Azure AD"
},
"authenticationProtocol": "none",
"appDisplayName": "Microsoft Authentication Broker"
}
},
"source": {
"ip": "1.2.3.4",
"geo": {
"city_name": "Paris",
"region_name": "Paris",
"country_iso_code": "FR",
"location": {
"lon": 2.351828,
"lat": 48.856578
"additionalDetails": "MFA completed in Azure AD",
"errorCode": "0"
}
},
"address": "1.2.3.4"
"resourceId": "/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam",
"tenantId": "93f63260-ad9a-4087-b7e0-d9010cb919dd"
},
"error": {
"code": "0",
Expand All @@ -859,25 +846,42 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"type": "Ios"
}
},
"related": {
"ip": [
"1.2.3.4"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "1.2.3.4",
"geo": {
"city_name": "Paris",
"country_iso_code": "FR",
"location": {
"lat": 48.856578,
"lon": 2.351828
},
"region_name": "Paris"
},
"ip": "1.2.3.4"
},
"user": {
"full_name": "John DOE",
"email": "[email protected]"
"email": "[email protected]",
"full_name": "John DOE"
},
"user_agent": {
"original": "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148",
"device": {
"name": "iPhone"
},
"name": "Mobile Safari UI/WKWebView",
"original": "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148",
"os": {
"name": "iOS",
"version": "16.6"
}
},
"related": {
"ip": [
"1.2.3.4"
]
}
}
Expand All @@ -896,92 +900,93 @@ Find below few samples of events and how they are normalized by Sekoia.io.
]
},
"@timestamp": "2023-10-04T13:09:02.679994Z",
"service": {
"type": "ldap",
"name": "Azure Active Directory"
},
"action": {
"name": "Sign-in activity"
},
"azuread": {
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"Level": 4,
"callerIpAddress": "11.11.11.11",
"category": "SignInLogs",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b",
"durationMs": 0,
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"durationMs": 0,
"identity": "DOE Jane",
"Level": 4,
"callerIpAddress": "11.11.11.11",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"appDisplayName": "Microsoft Authentication Broker",
"appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
"authenticationProtocol": "deviceCode",
"correlationId": "11d70870-823f-4450-828a-aba3cf69af8d",
"riskState": "none",
"deviceDetail": {
"isCompliant": true,
"isManaged": true,
"trustType": "Azure AD joined"
},
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"riskDetail": "none",
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "0"
},
"authenticationProtocol": "deviceCode",
"appDisplayName": "Microsoft Authentication Broker",
"deviceDetail": {
"isCompliant": true,
"isManaged": true,
"trustType": "Azure AD joined"
}
}
},
"source": {
"ip": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"region_name": "Gironde",
"country_iso_code": "FR",
"location": {
"lon": -0.5805000066757202,
"lat": 44.84040069580078
}
},
"address": "11.11.11.11"
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
},
"error": {
"code": "0"
},
"host": {
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"hostname": "LPTC-PC1M4VZQ",
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"name": "LPTC-PC1M4VZQ",
"os": {
"type": "Ios"
}
},
"related": {
"hosts": [
"LPTC-PC1M4VZQ"
],
"ip": [
"11.11.11.11"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"country_iso_code": "FR",
"location": {
"lat": 44.84040069580078,
"lon": -0.5805000066757202
},
"region_name": "Gironde"
},
"name": "LPTC-PC1M4VZQ"
"ip": "11.11.11.11"
},
"user": {
"full_name": "Jane DOE",
"email": "[email protected]"
"email": "[email protected]",
"full_name": "Jane DOE"
},
"user_agent": {
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98",
"device": {
"name": "Other"
},
"name": "Edge",
"version": "116.0.1938",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98",
"os": {
"name": "Windows",
"version": "10"
}
},
"related": {
"hosts": [
"LPTC-PC1M4VZQ"
],
"ip": [
"11.11.11.11"
]
},
"version": "116.0.1938"
}
}
Expand Down Expand Up @@ -1157,6 +1162,7 @@ The following table lists the fields that are extracted, normalized under the EC
|`azuread.privateLinkDetails` | `list` | |
|`azuread.properties.activity` | `keyword` | |
|`azuread.properties.appDisplayName` | `keyword` | appDisplayName |
|`azuread.properties.appId` | `keyword` | appId |
|`azuread.properties.authenticationProtocol` | `keyword` | authenticationProtocol |
|`azuread.properties.correlationId` | `keyword` | |
|`azuread.properties.detectionTimingType` | `keyword` | |
Expand Down
Loading

0 comments on commit 59adc88

Please sign in to comment.