default.yml

---
description: Pipeline for parsing azure signin logs.
processors:
  - set:
      field: event.ingested
      value: '{{_ingest.timestamp}}'
  - set:
      field: ecs.version
      value: '1.11.0'
  - rename:
      field: azure
      target_field: azure-eventhub
      ignore_missing: true
  - json:
      field: message
      target_field: azure.signinlogs
  - drop:
      if: ctx.azure.signinlogs.category != 'SignInLogs'
  - date:
      field: azure.signinlogs.time
      target_field: '@timestamp'
      ignore_failure: false
      formats:
          - ISO8601
  - rename:
      field: message
      target_field: event.original
  - remove:
      field: azure.signinlogs.time
      ignore_missing: true
  - rename:
      field: azure.signinlogs.resourceId
      target_field: azure.resource_id
      ignore_missing: true
  - grok:
      field: azure.signinlogs.callerIpAddress
      patterns:
        - \[%{IPORHOST:source.ip}\]:%{INT:source.port:int}
        - "%{IPORHOST:source.ip}:%{INT:source.port:int}"
        - "%{IPORHOST:source.ip}"
      ignore_missing: true
      ignore_failure: true
  - remove:
      field: azure.signinlogs.callerIpAddress
      if: 'ctx.source?.ip != null'
      ignore_missing: true
  - set:
      field: client.ip
      value: '{{source.ip}}'
      ignore_empty_value: true
  - append:
      field: related.ip
      value: '{{source.ip}}'
      allow_duplicates: false
      if: 'ctx.source?.ip != null'
  - rename:
      field: azure.signinlogs.Level
      target_field: log.level
      ignore_missing: true
  - rename:
      field: azure.signinlogs.durationMs
      target_field: event.duration
      ignore_missing: true
  - script:
      lang: painless
      source: ctx.event.duration = ctx.event.duration * params.param_nano
      params:
          param_nano: 1000000
  - rename:
      field: azure.signinlogs.location
      target_field: geo.country_iso_code
      ignore_missing: true
  - rename:
      field: azure.signinlogs.resultType
      target_field: azure.signinlogs.result_type
      ignore_missing: true
  - rename:
      field: azure.signinlogs.operationName
      target_field: azure.signinlogs.operation_name
      ignore_missing: true
  - convert:
      field: azure.signinlogs.operation_name
      target_field: event.action
      type: string
      ignore_missing: true
  - rename:
      field: azure.signinlogs.resultSignature
      target_field: azure.signinlogs.result_signature
      ignore_missing: true
  - rename:
      field: azure.signinlogs.resultDescription
      target_field: azure.signinlogs.result_description
      ignore_missing: true
  - rename:
      field: azure.signinlogs.operationVersion
      target_field: azure.signinlogs.operation_version
      ignore_missing: true
  - rename:
      field: azure.signinlogs.tenantId
      target_field: azure.tenant_id
      ignore_missing: true
  - rename:
      field: azure.signinlogs.correlationId
      target_field: azure.correlation_id
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.networkLocationDetails
      target_field: azure.signinlogs.properties.network_location_details
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.resourceId
      target_field: azure.signinlogs.properties.resource_id
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.appliedConditionalAccessPolicies
      target_field: azure.signinlogs.properties.applied_conditional_access_policies
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.authenticationDetails
      target_field: azure.signinlogs.properties.authentication_details
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.authenticationRequirementPolicies
      target_field: azure.signinlogs.properties.authentication_requirement_policies
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.authenticationProcessingDetails
      target_field: azure.signinlogs.properties.authentication_processing_details
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.deviceDetail
      target_field: azure.signinlogs.properties.device_detail
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.device_detail.deviceId
      target_field: azure.signinlogs.properties.device_detail.device_id
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.device_detail.operatingSystem
      target_field: azure.signinlogs.properties.device_detail.operating_system
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.device_detail.displayName
      target_field: azure.signinlogs.properties.device_detail.display_name
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.device_detail.trustType
      target_field: azure.signinlogs.properties.device_detail.trust_type
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.createdDateTime
      target_field: azure.signinlogs.properties.created_at
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.userDisplayName
      target_field: azure.signinlogs.properties.user_display_name
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.correlationId
      target_field: azure.signinlogs.properties.correlation_id
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.userPrincipalName
      target_field: azure.signinlogs.properties.user_principal_name
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.userId
      target_field: azure.signinlogs.properties.user_id
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.appId
      target_field: azure.signinlogs.properties.app_id
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.appDisplayName
      target_field: azure.signinlogs.properties.app_display_name
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.ipAddress
      target_field: azure.signinlogs.properties.ip_address
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.clientAppUsed
      target_field: azure.signinlogs.properties.client_app_used
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.conditionalAccessStatus
      target_field: azure.signinlogs.properties.conditional_access_status
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.originalRequestId
      target_field: azure.signinlogs.properties.original_request_id
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.isInteractive
      target_field: azure.signinlogs.properties.is_interactive
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.tokenIssuerName
      target_field: azure.signinlogs.properties.token_issuer_name
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.tokenIssuerType
      target_field: azure.signinlogs.properties.token_issuer_type
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.processingTimeInMilliseconds
      target_field: azure.signinlogs.properties.processing_time_ms
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.riskDetail
      target_field: azure.signinlogs.properties.risk_detail
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.riskLevelAggregated
      target_field: azure.signinlogs.properties.risk_level_aggregated
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.riskLevelDuringSignIn
      target_field: azure.signinlogs.properties.risk_level_during_signin
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.riskState
      target_field: azure.signinlogs.properties.risk_state
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.resourceDisplayName
      target_field: azure.signinlogs.properties.resource_display_name
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.status.errorCode
      target_field: azure.signinlogs.properties.status.error_code
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.status.failureReason
      target_field: message
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.status.additionalDetails
      target_field: message
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.location.city
      target_field: geo.city_name
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.location.state
      target_field: geo.country_name
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.location.geoCoordinates.latitude
      target_field: geo.location.lat
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.location.geoCoordinates.longitude
      target_field: geo.location.lon
      ignore_missing: true
  - rename:
      field: azure.signinlogs.properties.servicePrincipalId
      target_field: azure.signinlogs.properties.service_principal_id
      ignore_missing: true
  - remove:
      field:
        - azure.signinlogs.properties.location
      ignore_missing: true
  - set:
      field: event.kind
      value: event
  - set:
      field: event.category
      value:
        - authentication
  - set:
      field: event.type
      value:
        - info
  - set:
      field: event.outcome
      value: success
      if: "ctx?.azure?.signinlogs?.properties?.status?.error_code == null || ctx.azure.signinlogs.properties.status.error_code == 0"
  - set:
      field: event.outcome
      value: failure
      if: "ctx?.azure?.signinlogs?.properties?.status?.error_code != null && ctx.azure.signinlogs.properties.status.error_code > 0"
  - grok:
      field: azure.signinlogs.properties.user_principal_name
      patterns:
        - '%{USERNAME:user.name}@%{HOSTNAME:user.domain}'
        - '%{GREEDYDATA:user.name}'
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: azure.signinlogs.properties.user_display_name
      target_field: user.full_name
      ignore_missing: true
      type: string
  - convert:
      field: azure.signinlogs.properties.user_id
      target_field: user.id
      ignore_missing: true
      type: string
  - geoip:
      field: source.ip
      target_field: source.geo
      ignore_missing: true
  - geoip:
      database_file: GeoLite2-ASN.mmdb
      field: source.ip
      target_field: source.as
      properties:
        - asn
        - organization_name
      ignore_missing: true
  - rename:
      field: source.as.asn
      target_field: source.as.number
      ignore_missing: true
  - rename:
      field: source.as.organization_name
      target_field: source.as.organization.name
      ignore_missing: true
  - pipeline:
      name: '{{ IngestPipeline "azure-shared-pipeline" }}'
  - remove:
      field: event.original
      if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))"
      ignore_failure: true
      ignore_missing: true
on_failure:
  - set:
      field: error.message
      value: '{{ _ingest.on_failure_message }}'