Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added SonicWall ASIM Network Session parser #9592

Merged
merged 47 commits into from
Mar 11, 2024
Merged

Added SonicWall ASIM Network Session parser #9592

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
47 commits
Select commit Hold shift + click to select a range
218922c
Added ASIM Network Session parser files.
jaimeesc Dec 11, 2023
b745a2a
Added ASIM Network Session parser files.
jaimeesc Dec 11, 2023
3fc1d0e
Added ASIM Network Session data/schema test files.
jaimeesc Dec 11, 2023
8c2aacb
Added ASIM sample data
jaimeesc Dec 11, 2023
8fdd8f2
Delete Parsers/ASimNetworkSession/Tests/SonicWall_SonicOS_ASimNetwork…
jaimeesc Jan 26, 2024
f55f794
Delete Parsers/ASimNetworkSession/Tests/SonicWall_SonicOS_vimNetworkS…
jaimeesc Jan 26, 2024
8ff1e5c
Delete Parsers/ASimNetworkSession/Tests/SonicWall_SonicOS_vimNetworkS…
jaimeesc Jan 26, 2024
6fd58f6
Delete Parsers/ASimNetworkSession/Tests/SonicWall_SonicOS_ASimNetwork…
jaimeesc Jan 26, 2024
cfb4448
Uploaded new test result files
jaimeesc Jan 26, 2024
b1ee75d
Updated ARM template
jaimeesc Jan 26, 2024
e805a4a
Updated template for vimNetworkSession parser
jaimeesc Jan 26, 2024
7fda9c5
Updated NetworkSession parser. Added to im*/vim*
jaimeesc Jan 26, 2024
ab8b75c
Fixed merge conflicts
jaimeesc Jan 26, 2024
8b631c7
Merge branch 'master' into networksession
jaimeesc Jan 26, 2024
a9024e5
Updating template
jaimeesc Jan 26, 2024
61b7526
Updating template
jaimeesc Jan 26, 2024
a254820
Keeping CollectorHostName field to satisfy validation
jaimeesc Jan 26, 2024
c8a2b8f
Added vendor and product
jaimeesc Jan 26, 2024
4eef1be
Rolled back ASimTester.csv
jaimeesc Jan 30, 2024
62b07b3
Updated template
jaimeesc Jan 30, 2024
3856744
Updated template
jaimeesc Jan 30, 2024
56fde7b
Updated parser queries
jaimeesc Jan 30, 2024
cd7839d
Added Vendor/Product info
jaimeesc Jan 30, 2024
5e77d05
Replacing imNetworkSession.yaml
jaimeesc Jan 30, 2024
8d2e7e5
Restoring to what should be the current file
jaimeesc Jan 30, 2024
7c1915d
Updated with new SonicWall entry
jaimeesc Jan 30, 2024
75d196c
Replacing NetworkSession sample log file
jaimeesc Jan 31, 2024
9c39054
Delete Sample Data/ASIM/SonicWallFirewall/SonicWall_SonicOS_NetworkSe…
jaimeesc Jan 31, 2024
651b8ef
Removed 2 spaces
jaimeesc Feb 5, 2024
55afca7
Updated data/schema test files
jaimeesc Feb 16, 2024
2e24e9d
Updated vim/asim Network Session parsers
jaimeesc Feb 16, 2024
4ab092d
Updated network session arm template
jaimeesc Feb 16, 2024
40ba6d5
Updating vim network session arm template
jaimeesc Feb 16, 2024
35bd3c1
Removed CollectorHostName reference
jaimeesc Feb 16, 2024
4bfb1bb
Replacing ASimTester CSV
jaimeesc Feb 26, 2024
8537f4e
Merge branch 'master' into networksession
jaimeesc Feb 26, 2024
7ff028e
Updated parser yaml files
jaimeesc Feb 29, 2024
e20edd4
Updated SonicWall asim/vim test files
jaimeesc Feb 29, 2024
592e445
Updated arm template
jaimeesc Feb 29, 2024
43bb395
Updated arm template
jaimeesc Feb 29, 2024
1462e95
Synchronized with current master. Added changes.
jaimeesc Mar 4, 2024
bc248de
Update ASimNetworkSessionSonicWallFirewall.yaml
vakohl Mar 8, 2024
805d1c8
Update vimNetworkSessionSonicWallFirewall.yaml
vakohl Mar 8, 2024
fb8f546
Update ASimTester.csv
vakohl Mar 8, 2024
c475a28
Merge branch 'master' into networksession
vakohl Mar 8, 2024
fb68cf5
Update ASimNetworkSessionSonicWallFirewall.yaml
vakohl Mar 8, 2024
cfddd26
Update vimNetworkSessionSonicWallFirewall.yaml
vakohl Mar 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions ...kSession/ARM/ASimNetworkSessionSonicWallFirewall/ASimNetworkSessionSonicWallFirewall.json
View file
Open in desktop

Large diffs are not rendered by default.

18 changes: 18 additions & 0 deletions Parsers/ASimNetworkSession/ARM/ASimNetworkSessionSonicWallFirewall/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
# SonicWall Firewall ASIM NetworkSession Normalization Parser

ARM template for ASIM NetworkSession schema parser for SonicWall firewalls.

This ASIM parser supports filtering and normalizing SonicWall SonicOS syslog data (ArcSight format) ingested by Microsoft Sentinel to the ASIM Network Session normalized schema.


The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.

For more information, see:

- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
- [Deploy all of ASIM](https://aka.ms/DeployASIM)
- [ASIM NetworkSession normalization schema reference](https://aka.ms/ASimNetworkSessionDoc)

<br>

[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimNetworkSession%2FARM%2FASimNetworkSessionSonicWallFirewall%2FASimNetworkSessionSonicWallFirewall.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimNetworkSession%2FARM%2FASimNetworkSessionSonicWallFirewall%2FASimNetworkSessionSonicWallFirewall.json)
18 changes: 18 additions & 0 deletions Parsers/ASimNetworkSession/ARM/vimNetworkSessionSonicWallFirewall/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
# SonicWall Firewall ASIM NetworkSession Normalization Parser

ARM template for ASIM NetworkSession schema parser for SonicWall Firewalls.

This ASIM parser supports filtering and normalizing SonicWall SonicOS syslog data (ArcSight format) ingested by Microsoft Sentinel to the ASIM Network Session normalized schema.


The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.

For more information, see:

- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
- [Deploy all of ASIM](https://aka.ms/DeployASIM)
- [ASIM NetworkSession normalization schema reference](https://aka.ms/ASimNetworkSessionDoc)

<br>

[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimNetworkSession%2FARM%2FvimNetworkSessionSonicWallFirewall%2FvimNetworkSessionSonicWallFirewall.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimNetworkSession%2FARM%2FvimNetworkSessionSonicWallFirewall%2FvimNetworkSessionSonicWallFirewall.json)
46 changes: 46 additions & 0 deletions ...orkSession/ARM/vimNetworkSessionSonicWallFirewall/vimNetworkSessionSonicWallFirewall.json
View file
Open in desktop

Large diffs are not rendered by default.

432 changes: 432 additions & 0 deletions Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionSonicWallFirewall.yaml
View file
Open in desktop

Large diffs are not rendered by default.

481 changes: 481 additions & 0 deletions Parsers/ASimNetworkSession/Parsers/vimNetworkSessionSonicWallFirewall.yaml
View file
Open in desktop

Large diffs are not rendered by default.

29 changes: 29 additions & 0 deletions Parsers/ASimNetworkSession/Tests/SonicWall_SonicOS_ASimNetworkSession_DataTest.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
Result
"(0) Error: 1 invalid value(s) (up to 10 listed) in 1000 records (100.0%) for field [DvcIpAddr] of type [IP Address]: [""18C24135E8B6""] (Schema:NetworkSession)"
"(0) Error: 1 invalid value(s) (up to 10 listed) in 1000 records (100.0%) for field [EventProduct] of type [Enumerated]: [""SonicOS""] (Schema:NetworkSession)"
jaimeesc marked this conversation as resolved.
Show resolved Hide resolved
"(0) Error: 1 invalid value(s) (up to 10 listed) in 931 records (93.1%) for field [DvcAction] of type [Enumerated]: [""NA""] (Schema:NetworkSession)"
jaimeesc marked this conversation as resolved.
Show resolved Hide resolved
"(0) Error: 2 invalid value(s) (up to 10 listed) in 2000 records (200.0%) for field [EventVendor] of type [Enumerated]: [""SonicWall""] (Schema:NetworkSession)"
jaimeesc marked this conversation as resolved.
Show resolved Hide resolved
"(2) Info: Empty value in 1000 records (100.0%) in optional field [DstFQDN] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [DstNatIpAddr] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [DstNatPortNumber] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [DvcFQDN] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [DvcOriginalAction] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [SrcFQDN] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [SrcNatIpAddr] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [SrcNatPortNumber] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [ThreatConfidence] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [ThreatIpAddr] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in optional field [ThreatOriginalConfidence] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in recommended field [DstDomain] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in recommended field [DstHostname] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in recommended field [DvcDomain] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in recommended field [DvcHostname] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in recommended field [SrcDomain] (Schema:NetworkSession)"
"(2) Info: Empty value in 1000 records (100.0%) in recommended field [SrcHostname] (Schema:NetworkSession)"
jaimeesc marked this conversation as resolved.
Show resolved Hide resolved
"(2) Info: Empty value in 14 records (1.4%) in optional field [DvcInboundInterface] (Schema:NetworkSession)"
"(2) Info: Empty value in 157 records (15.7%) in optional field [DvcOutboundInterface] (Schema:NetworkSession)"
"(2) Info: Empty value in 445 records (44.5%) in optional field [DstMacAddr] (Schema:NetworkSession)"
"(2) Info: Empty value in 606 records (60.6%) in optional field [DstZone] (Schema:NetworkSession)"
"(2) Info: Empty value in 606 records (60.6%) in optional field [SrcZone] (Schema:NetworkSession)"
"(2) Info: Empty value in 660 records (66.0%) in optional field [SrcUsername] (Schema:NetworkSession)"
"(2) Info: Empty value in 792 records (79.2%) in optional field [SrcMacAddr] (Schema:NetworkSession)"
Loading