Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refresh intakes documentation #1599

Merged
merged 1 commit into from
Feb 20, 2024
Merged

Refresh intakes documentation #1599

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions ...perations_center/integrations/generated/02a74ceb-a9b0-467c-97d1-588319e39d71.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -443,6 +443,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"ip": [
"1.2.3.4",
"5.6.7.8"
],
"user": [
"vpn17590"
]
},
"rule": {
Expand All @@ -451,6 +454,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"name": "vpn17590"
}
}

Expand Down Expand Up @@ -518,6 +524,53 @@ Find below few samples of events and how they are normalized by Sekoia.io.
```


=== "test_sslvpn_log_3.json"

```json

{
"message": "\"12/07/2023:10:58:42 GMT CXA-GAT 0-PPE-0 : default SSLVPN Message 1521206 0 : \"SSO ns_sslvpn_process_sso_conn: user [email protected] clientip 1.2.3.7 request: /Citrix/CITRIXCGDWeb/clients/HTML5Client/resources/images/icon_clipboard.png sso_flags-0 p_flags-0 x_flags-200000 author_hdr_removed-0\"\"",
"event": {
"category": [
"network"
],
"code": "Message",
"dataset": "audit_sslvpn",
"kind": "event",
"type": [
"connection"
]
},
"@timestamp": "2023-12-07T10:58:42Z",
"citrix": {
"adc": {
"message": "SSO ns_sslvpn_process_sso_conn: user [email protected] clientip 1.2.3.7 request: /Citrix/CITRIXCGDWeb/clients/HTML5Client/resources/images/icon_clipboard.png sso_flags-0 p_flags-0 x_flags-200000 author_hdr_removed-0"
}
},
"client": {
"address": "1.2.3.7",
"ip": "1.2.3.7"
},
"observer": {
"name": "CXA-GAT"
},
"related": {
"ip": [
"1.2.3.7"
],
"user": [
"john.doe"
]
},
"user": {
"domain": "example.com",
"name": "john.doe"
}
}

```





Expand All @@ -534,6 +587,7 @@ The following table lists the fields that are extracted, normalized under the EC
|`citrix.adc.message` | `keyword` | |
|`citrix.adc.virtual_server.ip` | `keyword` | |
|`citrix.adc.virtual_server.port` | `keyword` | |
|`client.ip` | `ip` | IP address of the client. |
|`destination.ip` | `ip` | IP address of the destination. |
|`event.action` | `keyword` | The action captured by the event. |
|`event.category` | `keyword` | Event category. The second categorization field in the hierarchy. |
Expand All @@ -554,5 +608,6 @@ The following table lists the fields that are extracted, normalized under the EC
|`tls.cipher` | `keyword` | String indicating the cipher used during the current connection. |
|`tls.version` | `keyword` | Numeric part of the version parsed from the original string. |
|`url.original` | `wildcard` | Unmodified original url as seen in the event source. |
|`user.domain` | `keyword` | Name of the directory the user is a member of. |
|`user.name` | `keyword` | Short name or login of the user. |

186 changes: 96 additions & 90 deletions ...perations_center/integrations/generated/19cd2ed6-f90c-47f7-a46b-974354a107bb.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -490,6 +490,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Office 365 Exchange Online",
"appId": "00000002-0000-0ff1-ce00-000000000000",
"authenticationProtocol": "ropc",
"correlationId": "7ee10819-f631-4ab1-8edb-4efb7286baba",
"id": "b2fdcc8f-954d-4d88-a035-58daefab4f00",
Expand Down Expand Up @@ -626,6 +627,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Office365 Shell WCSS-Client",
"appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
"authenticationProtocol": "none",
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"id": "22253f56-6fc4-45f2-b148-d7fe15504900",
Expand Down Expand Up @@ -721,6 +723,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"operationVersion": "1.0",
"properties": {
"appDisplayName": "Microsoft App Access Panel",
"appId": "0000000c-0000-0000-c000-000000000000",
"authenticationProtocol": "none",
"correlationId": "467c1340-0762-40d2-b6fb-339235633ebb",
"id": "8795994f-0bb8-46d7-8797-8c9c385d5900",
Expand Down Expand Up @@ -802,53 +805,37 @@ Find below few samples of events and how they are normalized by Sekoia.io.
]
},
"@timestamp": "2023-08-16T15:32:05.577260Z",
"service": {
"type": "ldap",
"name": "Azure Active Directory"
},
"action": {
"name": "Sign-in activity"
},
"azuread": {
"resourceId": "/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"Level": 4,
"callerIpAddress": "1.2.3.4",
"category": "SignInLogs",
"tenantId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"durationMs": 0,
"correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"durationMs": 0,
"identity": "John DOE",
"Level": 4,
"callerIpAddress": "1.2.3.4",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"id": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"appDisplayName": "Microsoft Authentication Broker",
"appId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"authenticationProtocol": "none",
"correlationId": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"riskState": "none",
"id": "93f63260-ad9a-4087-b7e0-d9010cb919dd",
"riskDetail": "none",
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "0",
"additionalDetails": "MFA completed in Azure AD"
},
"authenticationProtocol": "none",
"appDisplayName": "Microsoft Authentication Broker"
}
},
"source": {
"ip": "1.2.3.4",
"geo": {
"city_name": "Paris",
"region_name": "Paris",
"country_iso_code": "FR",
"location": {
"lon": 2.351828,
"lat": 48.856578
"additionalDetails": "MFA completed in Azure AD",
"errorCode": "0"
}
},
"address": "1.2.3.4"
"resourceId": "/tenants/93f63260-ad9a-4087-b7e0-d9010cb919dd/providers/Microsoft.aadiam",
"tenantId": "93f63260-ad9a-4087-b7e0-d9010cb919dd"
},
"error": {
"code": "0",
Expand All @@ -859,25 +846,42 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"type": "Ios"
}
},
"related": {
"ip": [
"1.2.3.4"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "1.2.3.4",
"geo": {
"city_name": "Paris",
"country_iso_code": "FR",
"location": {
"lat": 48.856578,
"lon": 2.351828
},
"region_name": "Paris"
},
"ip": "1.2.3.4"
},
"user": {
"full_name": "John DOE",
"email": "[email protected]"
"email": "[email protected]",
"full_name": "John DOE"
},
"user_agent": {
"original": "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148",
"device": {
"name": "iPhone"
},
"name": "Mobile Safari UI/WKWebView",
"original": "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148",
"os": {
"name": "iOS",
"version": "16.6"
}
},
"related": {
"ip": [
"1.2.3.4"
]
}
}

Expand All @@ -896,92 +900,93 @@ Find below few samples of events and how they are normalized by Sekoia.io.
]
},
"@timestamp": "2023-10-04T13:09:02.679994Z",
"service": {
"type": "ldap",
"name": "Azure Active Directory"
},
"action": {
"name": "Sign-in activity"
},
"azuread": {
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"Level": 4,
"callerIpAddress": "11.11.11.11",
"category": "SignInLogs",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b",
"durationMs": 0,
"correlationId": "e68960e2-8996-448c-ba7a-e54eeb8ff2ed",
"durationMs": 0,
"identity": "DOE Jane",
"Level": 4,
"callerIpAddress": "11.11.11.11",
"operationName": "Sign-in activity",
"operationVersion": "1.0",
"properties": {
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"appDisplayName": "Microsoft Authentication Broker",
"appId": "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7",
"authenticationProtocol": "deviceCode",
"correlationId": "11d70870-823f-4450-828a-aba3cf69af8d",
"riskState": "none",
"deviceDetail": {
"isCompliant": true,
"isManaged": true,
"trustType": "Azure AD joined"
},
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"riskDetail": "none",
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskEventTypes": [],
"riskEventTypes_v2": [],
"riskLevelAggregated": "none",
"riskLevelDuringSignIn": "none",
"riskState": "none",
"status": {
"errorCode": "0"
},
"authenticationProtocol": "deviceCode",
"appDisplayName": "Microsoft Authentication Broker",
"deviceDetail": {
"isCompliant": true,
"isManaged": true,
"trustType": "Azure AD joined"
}
}
},
"source": {
"ip": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"region_name": "Gironde",
"country_iso_code": "FR",
"location": {
"lon": -0.5805000066757202,
"lat": 44.84040069580078
}
},
"address": "11.11.11.11"
"resourceId": "/tenants/34314e6e-4023-4e4b-a15e-143f63244e2b/providers/Microsoft.aadiam",
"tenantId": "34314e6e-4023-4e4b-a15e-143f63244e2b"
},
"error": {
"code": "0"
},
"host": {
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"hostname": "LPTC-PC1M4VZQ",
"id": "e14254f4-4288-4c00-8689-80823c4f4cb5",
"name": "LPTC-PC1M4VZQ",
"os": {
"type": "Ios"
}
},
"related": {
"hosts": [
"LPTC-PC1M4VZQ"
],
"ip": [
"11.11.11.11"
]
},
"service": {
"name": "Azure Active Directory",
"type": "ldap"
},
"source": {
"address": "11.11.11.11",
"geo": {
"city_name": "Bordeaux",
"country_iso_code": "FR",
"location": {
"lat": 44.84040069580078,
"lon": -0.5805000066757202
},
"region_name": "Gironde"
},
"name": "LPTC-PC1M4VZQ"
"ip": "11.11.11.11"
},
"user": {
"full_name": "Jane DOE",
"email": "[email protected]"
"email": "[email protected]",
"full_name": "Jane DOE"
},
"user_agent": {
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98",
"device": {
"name": "Other"
},
"name": "Edge",
"version": "116.0.1938",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.98",
"os": {
"name": "Windows",
"version": "10"
}
},
"related": {
"hosts": [
"LPTC-PC1M4VZQ"
],
"ip": [
"11.11.11.11"
]
},
"version": "116.0.1938"
}
}

Expand Down Expand Up @@ -1157,6 +1162,7 @@ The following table lists the fields that are extracted, normalized under the EC
|`azuread.privateLinkDetails` | `list` | |
|`azuread.properties.activity` | `keyword` | |
|`azuread.properties.appDisplayName` | `keyword` | appDisplayName |
|`azuread.properties.appId` | `keyword` | appId |
|`azuread.properties.authenticationProtocol` | `keyword` | authenticationProtocol |
|`azuread.properties.correlationId` | `keyword` | |
|`azuread.properties.detectionTimingType` | `keyword` | |
Expand Down
Loading
Loading