Update ASimUserManagementSentinelOne.yaml

Azure · Mar 7, 2024 · 504e326 · 504e326
1 parent 0d08b0a
commit 504e326
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/Parsers/ASimUserManagement/Parsers/ASimUserManagementSentinelOne.yaml b/Parsers/ASimUserManagement/Parsers/ASimUserManagementSentinelOne.yaml
@@ -65,7 +65,13 @@ ParserQuery: |
       | parse description_s with * "with id=" id: string "," restOfMessage
       | lookup EventTypeLookup on activityType_d//;
       | extend
-          EventType = iff(activityType_d in (67, 42) and primaryDescription_s has "enabled", "UserEnabled", "UserDisabled"),
+          EventType = case (
+                activityType_d in (67, 42) and primaryDescription_s has "enabled",
+                "UserEnabled",
+                activityType_d in (67, 42) and primaryDescription_s has "disabled",
+                "UserDisabled",
+                EventType
+            ),
           PreviousPropertyValue = case(
                               activityType_d in (67, 42) and primaryDescription_s has "enabled",
                               "disabled",
@@ -169,4 +175,4 @@ ParserQuery: |
           SourceSystem,
           newValue
   };
-  parser(disabled=disabled)
+  parser(disabled=disabled)