-
Notifications
You must be signed in to change notification settings - Fork 57
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
151ea8d
commit dce2cc0
Showing
7 changed files
with
1,767 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1119,6 +1119,110 @@ Find below few samples of events and how they are normalized by Sekoia.io. | |
| "user": { | ||
| "email": "[email protected]", | ||
| "full_name": "bar foo" | ||
| }, | ||
| "user_agent": { | ||
| "device": { | ||
| "name": "iPhone" | ||
| }, | ||
| "name": "Mobile Safari UI/WKWebView", | ||
| "original": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148", | ||
| "os": { | ||
| "name": "iOS", | ||
| "version": "14.4" | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
| === "user_risk_detection_2.json" | ||
|
|
||
| ```json | ||
|
|
||
| { | ||
| "message": "{\"time\": \"3/24/2022 2:42:35 PM\", \"resourceId\": \"/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam\", \"operationName\": \"User Risk Detection\", \"operationVersion\": \"1.0\", \"category\": \"UserRiskEvents\", \"tenantId\": \"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\", \"resultSignature\": \"None\", \"durationMs\": 0, \"callerIpAddress\": \"11.22.33.44\", \"correlationId\": \"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\", \"identity\": \"bar foo\", \"Level\": 4, \"location\": \"fr\", \"properties\": {\"id\": \"ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080\", \"requestId\": \"d38b6ab7-65b0-419c-b83a-a5787d6fa100\", \"correlationId\": \"325294e4-4026-4cc7-889d-b4be570b3254\", \"riskType\": \"unfamiliarFeatures\", \"riskEventType\": \"unfamiliarFeatures\", \"riskState\": \"atRisk\", \"riskLevel\": \"low\", \"riskDetail\": \"none\", \"source\": \"IdentityProtection\", \"detectionTimingType\": \"realtime\", \"activity\": \"signin\", \"ipAddress\": \"11.22.33.44\", \"location\": {\"city\": \"\", \"state\": \"\", \"countryOrRegion\": \"FR\", \"geoCoordinates\": {\"altitude\": 0, \"latitude\": 46, \"longitude\": 2}}, \"activityDateTime\": \"2023-10-26T5:32:08.107Z\", \"detectedDateTime\": \"2023-10-26T5:32:08.107Z\", \"lastUpdatedDateTime\": \"2023-10-26T5:35:05.938Z\", \"userId\": \"4c64c30a-7a60-4211-bef1-5e4279854e85\", \"userDisplayName\": \"bar foo\", \"userPrincipalName\": \"[email protected]\", \"additionalInfo\": \"[{\\\"Key\\\":\\\"riskReasons\\\",\\\"Value\\\":[\\\"UnfamiliarASN\\\",\\\"UnfamiliarBrowser\\\",\\\"UnfamiliarDevice\\\",\\\"UnfamiliarIP\\\",\\\"UnfamiliarLocation\\\",\\\"UnfamiliarEASId\\\",\\\"UnfamiliarTenantIPsubnet\\\"]},{\\\"Key\\\":\\\"userAgent\\\",\\\"Value\\\":\\\"Mozilla/5.0 (Linux; Android 12; CPH2005 Build/RKQ1.211103.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/117.0.0.0 Mobile Safari/537.36 PKeyAuth/1.0\\\"},{\\\"Key\\\":\\\"alertUrl\\\",\\\"Value\\\":null}]\", \"tokenIssuerType\": \"AzureAD\", \"resourceTenantId\": null, \"homeTenantId\": \"2d0c1986-ef7b-4bbf-8428-3c837471e7ad\", \"userType\": \"member\", \"crossTenantAccessType\": \"none\"}}", | ||
| "event": { | ||
| "category": [ | ||
| "iam" | ||
| ], | ||
| "reason": "unfamiliarFeatures", | ||
| "type": [ | ||
| "connection" | ||
| ] | ||
| }, | ||
| "@timestamp": "2022-03-24T14:42:35Z", | ||
| "action": { | ||
| "name": "User Risk Detection" | ||
| }, | ||
| "azuread": { | ||
| "Level": 4, | ||
| "callerIpAddress": "11.22.33.44", | ||
| "category": "UserRiskEvents", | ||
| "correlationId": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080", | ||
| "durationMs": 0, | ||
| "identity": "bar foo", | ||
| "operationName": "User Risk Detection", | ||
| "operationVersion": "1.0", | ||
| "properties": { | ||
| "activity": "signin", | ||
| "correlationId": "325294e4-4026-4cc7-889d-b4be570b3254", | ||
| "detectionTimingType": "realtime", | ||
| "id": "ef7868bd7e94b06ecd6cc965fc826c85d367bb5b9b083da9a26686786a791080", | ||
| "requestId": "d38b6ab7-65b0-419c-b83a-a5787d6fa100", | ||
| "riskDetail": "none", | ||
| "riskEventType": "unfamiliarFeatures", | ||
| "riskLevel": "low", | ||
| "riskReasons": [ | ||
| "UnfamiliarASN", | ||
| "UnfamiliarBrowser", | ||
| "UnfamiliarDevice", | ||
| "UnfamiliarEASId", | ||
| "UnfamiliarIP", | ||
| "UnfamiliarLocation", | ||
| "UnfamiliarTenantIPsubnet" | ||
| ], | ||
| "riskState": "atRisk", | ||
| "source": "IdentityProtection" | ||
| }, | ||
| "resourceId": "/tenants/2d0c1986-ef7b-4bbf-8428-3c837471e7ad/providers/microsoft.aadiam", | ||
| "tenantId": "2d0c1986-ef7b-4bbf-8428-3c837471e7ad" | ||
| }, | ||
| "related": { | ||
| "ip": [ | ||
| "11.22.33.44" | ||
| ] | ||
| }, | ||
| "service": { | ||
| "name": "Azure Active Directory", | ||
| "type": "ldap" | ||
| }, | ||
| "source": { | ||
| "address": "11.22.33.44", | ||
| "geo": { | ||
| "country_iso_code": "fr", | ||
| "location": { | ||
| "lat": 46, | ||
| "lon": 2 | ||
| } | ||
| }, | ||
| "ip": "11.22.33.44" | ||
| }, | ||
| "user": { | ||
| "email": "[email protected]", | ||
| "full_name": "bar foo" | ||
| }, | ||
| "user_agent": { | ||
| "device": { | ||
| "name": "Oppo CPH2005" | ||
| }, | ||
| "name": "Chrome Mobile WebView", | ||
| "original": "Mozilla/5.0 (Linux; Android 12; CPH2005 Build/RKQ1.211103.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/117.0.0.0 Mobile Safari/537.36 PKeyAuth/1.0", | ||
| "os": { | ||
| "name": "Android", | ||
| "version": "12" | ||
| }, | ||
| "version": "117.0.0" | ||
| } | ||
| } | ||
|
|
@@ -1178,6 +1282,7 @@ The following table lists the fields that are extracted, normalized under the EC | |
| |`azuread.properties.riskLevel` | `keyword` | | | ||
| |`azuread.properties.riskLevelAggregated` | `keyword` | riskLevelAggregated | | ||
| |`azuread.properties.riskLevelDuringSignIn` | `keyword` | riskLevelDuringSignIn | | ||
| |`azuread.properties.riskReasons` | `array` | | | ||
| |`azuread.properties.riskState` | `keyword` | | | ||
| |`azuread.properties.source` | `keyword` | | | ||
| |`azuread.properties.status.additionalDetails` | `keyword` | | | ||
|
|
||
Oops, something went wrong.