Skip to content

Commit

Permalink
Update ASimUserManagementSentinelOne.yaml
Browse files Browse the repository at this point in the history
  • Loading branch information
vakohl authored Mar 7, 2024
1 parent 64b9100 commit 9367a3b
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ ParserQuery: |
| parse-kv DataFields_s as (byUser: string, username: string, email: string, ipAddress: string, group: string, groupName: string, name: string, oldDescription: string, oldRole: string, description: string, role: string, userScope: string, scopeLevelName: string, scopeName: string, roleName: string, modifiedFields: string, deactivationPeriodInDays: string, descriptionChanged: string, groupType: string, newValue: string) with (pair_delimiter=",", kv_delimiter=":", quote='"')
| parse modifiedFields with 'Modified fields: ' ModifiedFields: string
| parse description_s with * "with id=" id: string "," restOfMessage
| lookup EventTypeLookup on activityType_d//;
| lookup EventTypeLookup on activityType_d
| extend
EventType = case (
activityType_d in (67, 42) and primaryDescription_s has "enabled",
Expand Down

0 comments on commit 9367a3b

Please sign in to comment.