-
Notifications
You must be signed in to change notification settings - Fork 57
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
95b4f66
commit e550558
Showing
215 changed files
with
25,859 additions
and
7,255 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
114 changes: 114 additions & 0 deletions
114
...ns_center/integrations/generated/041e915e-2fb6-4604-9b24-902c9daa2d3c_sample.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
|
|
||
| ### Raw Events Samples | ||
|
|
||
| In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured. | ||
|
|
||
|
|
||
| === "test_journal" | ||
|
|
||
|
|
||
| ```json | ||
| { | ||
| "aggregateId": "vC80NNxvOWKkBPnzSs04FA_1715699686", | ||
| "processingId": "PGZfGuxEAu_kE-nGy1sjThBr5EYbm1ZcDKg-vXbRHLA_1715699686", | ||
| "accountId": "CDE22A102", | ||
| "timestamp": 1715699697146, | ||
| "senderEnvelope": "[email protected]", | ||
| "recipients": "[email protected]", | ||
| "direction": "Inbound", | ||
| "type": "journal", | ||
| "subtype": null, | ||
| "_offset": 105760, | ||
| "_partition": 137 | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
|
|
||
| === "test_process" | ||
|
|
||
|
|
||
| ```json | ||
| { | ||
| "aggregateId": "J5JwSy0HNvG7AvCg1sgDvQ_1715708284", | ||
| "processingId": "hP5f7mBanAVkWJWfh4vYvca3zOi9I3jROBmH3Z_Kysk_1715708284", | ||
| "accountId": "CDE22A102", | ||
| "action": "Hld", | ||
| "timestamp": 1715708287466, | ||
| "senderEnvelope": "[email protected]", | ||
| "messageId": "<CAF7=BmDb+6qHo+J5EB9oH+S4ncJOfEMsUYAEirX4MRZRJX+esw@mail.gmail.com>", | ||
| "subject": "Moderate", | ||
| "holdReason": "Spm", | ||
| "totalSizeAttachments": "0", | ||
| "numberAttachments": "0", | ||
| "attachments": null, | ||
| "emailSize": "3466", | ||
| "type": "process", | ||
| "subtype": "Hld", | ||
| "_offset": 105825, | ||
| "_partition": 137 | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
|
|
||
| === "test_process_with_attachment" | ||
|
|
||
|
|
||
| ```json | ||
| { | ||
| "processingId": "processingId", | ||
| "aggregateId": "aggregateId", | ||
| "numberAttachments": "2", | ||
| "attachments": "tpsreport.doc", | ||
| "subject": "siem_process - email subject line", | ||
| "senderEnvelope": "[email protected]", | ||
| "messageId": "messageId", | ||
| "eventType": "process", | ||
| "accountId": "C0A0", | ||
| "action": "Allow", | ||
| "holdReason": null, | ||
| "subType": "Allow", | ||
| "totalSizeAttachments": "642", | ||
| "timestamp": 1689685338609, | ||
| "emailSize": "56422" | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
|
|
||
| === "test_receipt" | ||
|
|
||
|
|
||
| ```json | ||
| { | ||
| "aggregateId": "J5JwSy0HNvG7AvCg1sgDvQ_1715708284", | ||
| "processingId": "hP5f7mBanAVkWJWfh4vYvca3zOi9I3jROBmH3Z_Kysk_1715708284", | ||
| "accountId": "CDE22A102", | ||
| "timestamp": 1715708286579, | ||
| "action": "Acc", | ||
| "senderEnvelope": "[email protected]", | ||
| "messageId": "<CAF7=BmDb+6qHo+J5EB9oH+S4ncJOfEMsUYAAarX4MRZRJX+esw@mail.gmail.com>", | ||
| "subject": "Moderate", | ||
| "recipients": "[email protected]", | ||
| "senderIp": "209.123.123.123", | ||
| "rejectionType": null, | ||
| "rejectionCode": null, | ||
| "direction": "Inbound", | ||
| "numberAttachments": "0", | ||
| "senderHeader": "[email protected]", | ||
| "rejectionInfo": null, | ||
| "tlsVersion": "TLSv1.3", | ||
| "tlsCipher": "TLS_AES_256_GCM_SHA384", | ||
| "spamInfo": "[]", | ||
| "spamProcessingDetail": "{\"spf\":{\"allow\":true,\"info\":\"ALLOW\"},\"dkim\":{\"allow\":true,\"info\":\"ALLOW\"},\"dmarc\":{\"allow\":true,\"info\":\"ALLOW\"}}", | ||
| "virusFound": null, | ||
| "type": "receipt", | ||
| "subtype": "Acc", | ||
| "_offset": 105826, | ||
| "_partition": 137 | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,14 +18,14 @@ In details, the following table denotes the type of events produced by this inte | |
| | ---- | ------ | | ||
| | Kind | `` | | ||
| | Category | `authentication`, `configuration`, `file`, `iam`, `session` | | ||
| | Type | `access`, `admin`, `connection` | | ||
| | Type | `access`, `admin`, `change`, `connection` | | ||
|
|
||
|
|
||
|
|
||
|
|
||
| ### Transformed Events Samples after Ingestion | ||
|
|
||
| This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the [built-in detection rules](/docs/xdr/features/detect/rules_catalog) and hunting activities in the [events page](/docs/xdr/features/investigate/events). Understanding these transformations is essential for analysts to create effective detection mechanisms with [custom detection rules](/docs/xdr/features/detect/sigma) and to leverage the full potential of the collected data. | ||
| This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the [built-in detection rules](/xdr/features/detect/rules_catalog) and hunting activities in the [events page](/xdr/features/investigate/events). Understanding these transformations is essential for analysts to create effective detection mechanisms with [custom detection rules](/xdr/features/detect/sigma) and to leverage the full potential of the collected data. | ||
|
|
||
| === "test_admin_sample1.json" | ||
|
|
||
|
|
@@ -727,6 +727,65 @@ This section demonstrates how the raw logs will be transformed by our parsers. I | |
| ``` | ||
|
|
||
|
|
||
| === "test_suspend_user.json" | ||
|
|
||
| ```json | ||
|
|
||
| { | ||
| "message": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2024-07-09T14:05:42.528Z\",\"uniqueQualifier\":\"0123456789101112131\",\"applicationName\":\"admin\",\"customerId\":\"C03foh000\"},\"etag\":\"BvGfkzKoKVD0NM7VdXdzkXDD-nHLkyMjheL_9Z5X0\",\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":\"102788027662650927386\"},\"ipAddress\":\"1.2.3.4\",\"events\":[{\"type\":\"USER_SETTINGS\",\"name\":\"SUSPEND_USER\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"[email protected]\"}]}]}", | ||
| "event": { | ||
| "action": "SUSPEND_USER", | ||
| "category": [ | ||
| "configuration" | ||
| ], | ||
| "dataset": "admin#reports#activity", | ||
| "type": [ | ||
| "change" | ||
| ] | ||
| }, | ||
| "@timestamp": "2024-07-09T14:05:42.528000Z", | ||
| "cloud": { | ||
| "account": { | ||
| "id": "C03foh000" | ||
| } | ||
| }, | ||
| "google": { | ||
| "report": { | ||
| "actor": { | ||
| "email": "[email protected]" | ||
| }, | ||
| "parameters": { | ||
| "name": "USER_EMAIL", | ||
| "value": "[email protected]" | ||
| } | ||
| } | ||
| }, | ||
| "network": { | ||
| "application": "admin" | ||
| }, | ||
| "related": { | ||
| "ip": [ | ||
| "1.2.3.4" | ||
| ], | ||
| "user": [ | ||
| "john.doe" | ||
| ] | ||
| }, | ||
| "source": { | ||
| "address": "1.2.3.4", | ||
| "ip": "1.2.3.4" | ||
| }, | ||
| "user": { | ||
| "domain": "test.fr", | ||
| "email": "[email protected]", | ||
| "id": "102788027662650927386", | ||
| "name": "john.doe" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
| === "test_target_user.json" | ||
|
|
||
| ```json | ||
|
|
@@ -955,6 +1014,8 @@ The following table lists the fields that are extracted, normalized under the EC | |
| |`google.report.chat.message.id` | `keyword` | Message id | | ||
| |`google.report.chat.room.name` | `keyword` | Room name | | ||
| |`google.report.meet.code` | `keyword` | Meet code | | ||
| |`google.report.parameters.name` | `keyword` | Name of the item associated with the activity | | ||
| |`google.report.parameters.value` | `keyword` | Value of the item associated with the activity | | ||
| |`google.report.parameters.visibility` | `keyword` | Visibility of the Drive item associated with the activity | | ||
| |`google.report.token.app_name` | `keyword` | Token authorization application name | | ||
| |`google.report.token.type` | `keyword` | Token type | | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -968,6 +968,42 @@ In this section, you will find examples of raw logs as generated natively by the | |
|
|
||
|
|
||
|
|
||
| === "test_suspend_user" | ||
|
|
||
|
|
||
| ```json | ||
| { | ||
| "kind": "admin#reports#activity", | ||
| "id": { | ||
| "time": "2024-07-09T14:05:42.528Z", | ||
| "uniqueQualifier": "0123456789101112131", | ||
| "applicationName": "admin", | ||
| "customerId": "C03foh000" | ||
| }, | ||
| "etag": "BvGfkzKoKVD0NM7VdXdzkXDD-nHLkyMjheL_9Z5X0", | ||
| "actor": { | ||
| "callerType": "USER", | ||
| "email": "[email protected]", | ||
| "profileId": "102788027662650927386" | ||
| }, | ||
| "ipAddress": "1.2.3.4", | ||
| "events": [ | ||
| { | ||
| "type": "USER_SETTINGS", | ||
| "name": "SUSPEND_USER", | ||
| "parameters": [ | ||
| { | ||
| "name": "USER_EMAIL", | ||
| "value": "[email protected]" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
|
|
||
| === "test_target_user" | ||
|
|
||
|
|
||
|
|
||
Oops, something went wrong.