diff --git a/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/metadata.json b/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/metadata.json index 12978872ed..a7741ef6cd 100644 --- a/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "CISCO", "supported_format": "SYSLOG", "category": "Firewall", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..5b07d21938 --- /dev/null +++ b/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,423 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Teardown TCP connection 8374291 for outside:1.1.1.2/443 to inside:1.1.1.3/53412 duration 0:00:15 bytes 142", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CISCO_PIX_FIREWALL", + "productEventType": "PIX-6-302013", + "productName": "CISCO_FWSM", + "vendorName": "CISCO" + }, + "network": { + "ipProtocol": "TCP" + }, + "observer": { + "ip": [ + "1.1.1.1" + ] + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.3" + ] + }, + "ip": [ + "1.1.1.3" + ], + "port": 53412, + "resource": { + "type": "PIX" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "actionDetails": "Teardown", + "severity": "INFORMATIONAL" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.2" + ] + }, + "ip": [ + "1.1.1.2" + ], + "port": 443 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Built GRE src outside:1.1.1.5 dst JFS-PEER:1.1.1.6 access-list allowed", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CISCO_PIX_FIREWALL", + "productEventType": "PIX-7-302014", + "productName": "CISCO_FWSM", + "vendorName": "CISCO" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.6" + ] + }, + "ip": [ + "1.1.1.6" + ], + "resource": { + "type": "PIX" + } + }, + "securityResult": [ + { + "severity": "INFORMATIONAL" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.5" + ] + }, + "ip": [ + "1.1.1.5" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Deny UDP src outside:1.1.1.7/53 dst inside:1.1.1.8/54321 by access-group acl_inbound", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CISCO_PIX_FIREWALL", + "productEventType": "PIX-5-111008", + "productName": "CISCO_FWSM", + "vendorName": "CISCO" + }, + "network": { + "ipProtocol": "UDP" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.8" + ] + }, + "ip": [ + "1.1.1.8" + ], + "port": 54321, + "resource": { + "type": "PIX" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "actionDetails": "Deny", + "severity": "LOW" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.7" + ] + }, + "ip": [ + "1.1.1.7" + ], + "port": 53 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Deny ICMP src outside:2.2.2.1 dst inside:2.2.2.2 (type 8, code 0) by access-group acl_icmp", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CISCO_PIX_FIREWALL", + "productEventType": "FWSM-4-106023", + "productName": "CISCO_FWSM", + "vendorName": "CISCO" + }, + "network": { + "ipProtocol": "ICMP" + }, + "observer": { + "ip": [ + "1.1.1.9" + ] + }, + "principal": { + "asset": { + "ip": [ + "2.2.2.2" + ] + }, + "ip": [ + "2.2.2.2" + ], + "resource": { + "type": "FWSM" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "actionDetails": "Deny", + "severity": "MEDIUM" + } + ], + "target": { + "asset": { + "ip": [ + "2.2.2.1" + ] + }, + "ip": [ + "2.2.2.1" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Inbound TCP connection denied from 2.2.2.3/49152 to 2.2.2.4/80 by access-group acl_external", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CISCO_PIX_FIREWALL", + "productEventType": "PIX-3-710003", + "productName": "CISCO_FWSM", + "vendorName": "CISCO" + }, + "network": { + "direction": "INBOUND", + "ipProtocol": "TCP" + }, + "principal": { + "asset": { + "ip": [ + "2.2.2.3" + ] + }, + "ip": [ + "2.2.2.3" + ], + "port": 49152, + "resource": { + "type": "PIX" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "actionDetails": "denied", + "severity": "ERROR" + } + ], + "target": { + "asset": { + "ip": [ + "2.2.2.4" + ] + }, + "ip": [ + "2.2.2.4" + ], + "port": 80 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Denied inbound UDP from 2.2.2.6/5060 to 2.2.2.7/5060 on interface outside", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CISCO_PIX_FIREWALL", + "productEventType": "PIX-2-106001", + "productName": "CISCO_FWSM", + "vendorName": "CISCO" + }, + "network": { + "direction": "INBOUND", + "ipProtocol": "UDP" + }, + "observer": { + "ip": [ + "2.2.2.5" + ] + }, + "principal": { + "asset": { + "ip": [ + "2.2.2.6" + ] + }, + "ip": [ + "2.2.2.6" + ], + "port": 5060, + "resource": { + "type": "PIX" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "actionDetails": "Denied", + "severity": "HIGH" + } + ], + "target": { + "asset": { + "ip": [ + "2.2.2.7" + ] + }, + "ip": [ + "2.2.2.7" + ], + "port": 5060 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Authentication succeeded for user dummy_user_01 from 2.2.2.8", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "CISCO_PIX_FIREWALL", + "productEventType": "PIX-1-106021", + "productName": "CISCO_FWSM", + "vendorName": "CISCO" + }, + "principal": { + "resource": { + "type": "PIX" + } + }, + "securityResult": [ + { + "severity": "CRITICAL" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Teardown UDP src outside:2.2.2.9/53 dst JFS-PEER:3.3.3.1/12345 duration 0:01:00 bytes 450", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "CISCO_PIX_FIREWALL", + "productEventType": "ASA-6-302015", + "productName": "CISCO_FWSM", + "vendorName": "CISCO" + }, + "network": { + "ipProtocol": "UDP" + }, + "principal": { + "asset": { + "ip": [ + "3.3.3.1" + ] + }, + "ip": [ + "3.3.3.1" + ], + "port": 12345, + "resource": { + "type": "ASA" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "actionDetails": "Teardown", + "severity": "INFORMATIONAL" + } + ], + "target": { + "asset": { + "ip": [ + "2.2.2.9" + ] + }, + "ip": [ + "2.2.2.9" + ], + "port": 53 + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..d00b92f919 --- /dev/null +++ b/content/parsers/third_party/community/CISCO_PIX_FIREWALL_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,32 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "Jan 15 10:20:30 1.1.1.1 %PIX-6-302013: Teardown TCP connection 8374291 for outside:1.1.1.2/443 to inside:1.1.1.3/53412 duration 0:00:15 bytes 142" + }, + { + "data": "\u003c166\u003eJan 15 2026 10:22:00: %PIX-7-302014: Built GRE src outside:1.1.1.5 dst JFS-PEER:1.1.1.6 access-list allowed" + }, + { + "data": "\u003c166\u003eJan 15 2026 10:23:00: %PIX-5-111008: Deny UDP src outside:1.1.1.7/53 dst inside:1.1.1.8/54321 by access-group acl_inbound" + }, + { + "data": "Jan 15 10:24:00 1.1.1.9 %FWSM-4-106023: Deny ICMP src outside:2.2.2.1 dst inside:2.2.2.2 (type 8, code 0) by access-group acl_icmp" + }, + { + "data": "\u003c166\u003eJan 15 2026 10:25:00: %PIX-3-710003: Inbound TCP connection denied from 2.2.2.3/49152 to 2.2.2.4/80 by access-group acl_external" + }, + { + "data": "Jan 15 10:26:00 2.2.2.5 %PIX-2-106001: Denied inbound UDP from 2.2.2.6/5060 to 2.2.2.7/5060 on interface outside" + }, + { + "data": "\u003c166\u003eJan 15 2026 10:27:00: %PIX-1-106021: Authentication succeeded for user dummy_user_01 from 2.2.2.8" + }, + { + "data": "\u003c166\u003eJan 15 2026 10:28:00: %ASA-6-302015: Teardown UDP src outside:2.2.2.9/53 dst JFS-PEER:3.3.3.1/12345 duration 0:01:00 bytes 450" + } + ], + "type": "CISCO_PIX_FIREWALL" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/metadata.json b/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/metadata.json index 9bd37bba9b..b9734070b0 100644 --- a/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "DELL_CYBERSENSE", "supported_format": "SYSLOG", "category": "Data Security", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..d0cc99c95b --- /dev/null +++ b/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,421 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "infection_classes": [ + "Ransomware.Locky", + "Trojan.Agent" + ] + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productEventType": "[ANOM_101] - Ransomware Attack Detected", + "productName": "CyberSense", + "productVersion": "8.6.0", + "vendorName": "Dell Inc." + }, + "principal": { + "asset": { + "hostname": "masked-host-01.corp" + }, + "file": { + "fullPath": "/data/shares/accounting.docx" + }, + "hostname": "masked-host-01.corp", + "url": "http://malicious.dummy.com/test" + }, + "securityResult": [ + { + "detectionFields": [ + { + "key": "crjobid", + "value": "1001" + }, + { + "key": "engine_id", + "value": "eng_sec_01" + } + ] + } + ], + "target": { + "asset": { + "hostname": "target-host-masked.corp" + }, + "hostname": "target-host-masked.corp" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productEventType": "[ERR_01] - Error Stimulator Event", + "productName": "CyberSense", + "productVersion": "8.6.0", + "vendorName": "Dell" + }, + "principal": { + "asset": { + "hostname": "masked-host-02.corp" + }, + "hostname": "masked-host-02.corp" + }, + "securityResult": [ + { + "detectionFields": [ + { + "key": "engine_id", + "value": "eng_err_01" + } + ] + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productEventType": "[ANOM_STANDALONE] - Scan Summary", + "productName": "CyberSense", + "productVersion": "8.6.0", + "vendorName": "Dell" + }, + "principal": { + "asset": { + "hostname": "masked-host-03.corp" + }, + "hostname": "masked-host-03.corp" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "crjobids": "cr_job_777", + "crpolicy": "policy_hourly_snap", + "lanjobdefname": "def_snap_hourly", + "lanjobinstid": "inst_snap_001", + "tty": "pts/1" + }, + "metadata": { + "description": "Emergency admin intervention initiated", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productName": "DELL_CYBERSENSE", + "vendorName": "DELL_CYBERSENSE" + }, + "network": { + "sessionId": "sess_audit_01" + }, + "principal": { + "asset": { + "hostname": "masked-client-01.corp.internal" + }, + "hostname": "masked-client-01.corp.internal", + "process": { + "commandLine": "command \"net config\"" + } + }, + "securityResult": [ + { + "severity": "CRITICAL" + } + ], + "target": { + "resource": { + "name": "db_users_vault", + "productObjectId": "vault-db-uuid-8888" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "crjobids": "[999]", + "crpolicy": "policy_tier1", + "lanjobdefname": "def_tier1", + "lanjobinstid": "101", + "tty": "pts/4" + }, + "metadata": { + "description": "Ransomware encryption activity identified on backup storage}", + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productEventType": "[CS_ALERT_01] - Critical Ransomware Alert", + "productName": "CyberSense Appliance", + "productVersion": "8.4.2", + "vendorName": "Dell EMC" + }, + "network": { + "sessionId": "sess_cef_888" + }, + "principal": { + "asset": { + "hostname": "masked-client-02.corp.internal" + }, + "hostname": "masked-client-02.corp.internal" + }, + "target": { + "resource": { + "name": "db_crm_prod", + "productObjectId": "crm-uuid-9999-0000" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "tty": "pts/2" + }, + "metadata": { + "description": "Routine task error logged", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productName": "DELL_CYBERSENSE", + "vendorName": "DELL_CYBERSENSE" + }, + "network": { + "sessionId": "sess_generic_01" + }, + "principal": { + "asset": { + "hostname": "masked-client-03.corp.internal" + }, + "hostname": "masked-client-03.corp.internal", + "process": { + "commandLine": "command \"check db\"" + } + }, + "securityResult": [ + { + "severity": "ERROR" + } + ], + "target": { + "resource": { + "name": "db_generic", + "productObjectId": "uuid-1234" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "tty": "pts/3" + }, + "metadata": { + "description": "Warning threshold reached", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productName": "DELL_CYBERSENSE", + "vendorName": "DELL_CYBERSENSE" + }, + "principal": { + "asset": { + "hostname": "masked-client-04.corp.internal" + }, + "hostname": "masked-client-04.corp.internal", + "process": { + "commandLine": "command \"status\"" + } + }, + "securityResult": [ + { + "severity": "HIGH" + } + ], + "target": { + "resource": { + "name": "db_warn" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "tty": "pts/4" + }, + "metadata": { + "description": "Notice audit event generated", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productName": "DELL_CYBERSENSE", + "vendorName": "DELL_CYBERSENSE" + }, + "principal": { + "asset": { + "hostname": "masked-client-05.corp.internal" + }, + "hostname": "masked-client-05.corp.internal", + "process": { + "commandLine": "command \"audit\"" + } + }, + "securityResult": [ + { + "severity": "MEDIUM" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "tty": "pts/5" + }, + "metadata": { + "description": "Informational msg recorded", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productName": "DELL_CYBERSENSE", + "vendorName": "DELL_CYBERSENSE" + }, + "principal": { + "asset": { + "hostname": "masked-client-06.corp.internal" + }, + "hostname": "masked-client-06.corp.internal", + "process": { + "commandLine": "command \"info\"" + } + }, + "securityResult": [ + { + "severity": "INFORMATIONAL" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Analysis finished}", + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productEventType": "[EVT_01] - Data Analysis Completed", + "productName": "CyberSense", + "productVersion": "8.0", + "vendorName": "Dell" + }, + "principal": { + "asset": { + "hostname": "masked-client-07.corp.internal" + }, + "hostname": "masked-client-07.corp.internal" + }, + "target": { + "resource": { + "name": "vault_prod" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "STATUS_UPDATE", + "logType": "DELL_CYBERSENSE", + "productEventType": "[EVT_BATCH_NULL] - Batched Null Test", + "productName": "CyberSense", + "productVersion": "8.0", + "vendorName": "Dell" + }, + "principal": { + "asset": { + "hostname": "masked-agent-06.corp" + }, + "file": { + "fullPath": "/data/test/file.log" + }, + "hostname": "masked-agent-06.corp" + }, + "securityResult": [ + { + "detectionFields": [ + { + "key": "crjobid", + "value": "1002" + } + ] + } + ] + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..3dfe4ba3da --- /dev/null +++ b/content/parsers/third_party/community/DELL_CYBERSENSE_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,41 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "\u003c134\u003eOct 12 10:00:00 masked-host-01.corp cyber_sensor: app:0|Dell Inc.|CyberSense|8.6.0|ANOM_101|Ransomware Attack Detected|Critical|{\"crjobid\": \"1001\", \"engine_id\": \"eng_sec_01\", \"URL\": \"http://malicious.dummy.com/test\", \"host\": \"target-host-masked.corp\", \"path\": \"/data/shares/accounting.docx\", \"infection_classes\": [\"Ransomware.Locky\", \"Trojan.Agent\"]}" + }, + { + "data": "\u003c134\u003eOct 12 10:00:00 masked-host-02.corp cyber_sensor: app:0|Dell|CyberSense|8.6.0|ERR_01|Error Stimulator Event|High|{\"crjobid\": {\"invalid_sub_key\": \"invalid_val\"}, \"engine_id\": \"eng_err_01\"}" + }, + { + "data": "\u003c134\u003eOct 12 10:00:00 masked-host-03.corp cyber_sensor: app:0|Dell|CyberSense|8.6.0|ANOM_STANDALONE|Scan Summary|Low|{\"crjobid\": \"\", \"engine_id\": \"\", \"URL\": \"\", \"host\": \"\", \"path\": \"\", \"infection_classes\": []}" + }, + { + "data": "\u003c134\u003eCVDataDomain ddsh: EMERGENCY: MSG-DDSH-00001: (tty=pts/1, session=sess_audit_01, client_IP=masked-client-01.corp.internal, crjobids=cr_job_777, crpolicy=policy_hourly_snap, lanjobdefname=def_snap_hourly, lanjobinstid=inst_snap_001, dbname=db_users_vault, dbuuid=vault-db-uuid-8888, msg=Emergency admin intervention initiated) cradmin: command \"net config\"" + }, + { + "data": "\u003c134\u003eOct 12 10:00:00 masked-sensor-02.corp backup_agent: CEF:0|Dell EMC|CyberSense Appliance|8.4.2|CS_ALERT_01|Critical Ransomware Alert - Threat Detected|Alert|{'client_IP': 'masked-client-02.corp.internal', 'session': 'sess_cef_888', 'crjobids': [999], 'crpolicy': 'policy_tier1', 'lanjobdefname': 'def_tier1', 'lanjobinstid': 101, 'tty': 'pts/4', 'dbname': 'db_crm_prod', 'dbuuid': 'crm-uuid-9999-0000', 'msg': 'Ransomware encryption activity identified on backup storage'}" + }, + { + "data": "\u003c134\u003eCVDataDomain ddsh: ERROR: MSG-DDSH-00002: (tty=pts/2, session=sess_generic_01, client_IP=masked-client-03.corp.internal, dbname=db_generic, dbuuid=uuid-1234, msg=Routine task error logged) cradmin: command \"check db\"" + }, + { + "data": "\u003c134\u003eCVDataDomain ddsh: WARN: MSG-DDSH-00003: (tty=pts/3, client_IP=masked-client-04.corp.internal, dbname=db_warn, msg=Warning threshold reached) cradmin: command \"status\"" + }, + { + "data": "\u003c134\u003eCVDataDomain ddsh: NOTICE: MSG-DDSH-00004: (tty=pts/4, client_IP=masked-client-05.corp.internal, msg=Notice audit event generated) cradmin: command \"audit\"" + }, + { + "data": "\u003c134\u003eCVDataDomain ddsh: INFO: MSG-DDSH-00005: (tty=pts/5, client_IP=masked-client-06.corp.internal, msg=Informational message recorded) cradmin: command \"info\"" + }, + { + "data": "\u003c134\u003eOct 12 10:00:00 masked-sensor-03.corp backup_svc: CEF:0|Dell|CyberSense|8.0|EVT_01|Data Analysis Completed - Summary|Low|{'client_IP': 'masked-client-07.corp.internal', 'dbname': 'vault_prod', 'msg': 'Analysis finished'}" + }, + { + "data": "\u003c134\u003eOct 12 10:00:00 masked-agent-06.corp backup_svc: app:0|Dell|CyberSense|8.0|EVT_BATCH_NULL|Batched Null Test|Low|{\"crjobid\": \"1002\", \"path\": \"/data/test/file.log\"}" + } + ], + "type": "DELL_CYBERSENSE" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/OORT_GUS/cbn/metadata.json b/content/parsers/third_party/community/OORT_GUS/cbn/metadata.json index 150c0604be..42392c08b1 100644 --- a/content/parsers/third_party/community/OORT_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/OORT_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "OORT", "supported_format": "JSON", "category": "Identity and Access Management", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/OORT_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/OORT_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..6617c1d0af --- /dev/null +++ b/content/parsers/third_party/community/OORT_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,550 @@ +{ + "events": [ + { + "event": { + "timestamp": "2026-08-14T05:00:00.123456Z", + "idm": { + "readOnlyUdm": { + "additional": { + "detail description": [ + "User authenticated from multiple distinct locations simultaneously", + "Impossible travel detected between SF and Tokyo" + ], + "framework": [ + "MITRE ATT\u0026CK", + "NIST CSF", + "CIS Controls" + ], + "recommended action": [ + "Revoke active session", + "Enforce MFA re-authentication", + "Quarantine user account" + ] + }, + "metadata": { + "collectedTimestamp": "2026-08-14T05:00:00Z", + "eventTimestamp": "2026-08-14T05:00:00.123456Z", + "eventType": "STATUS_UPDATE", + "logType": "OORT", + "productLogId": "oort-evt-ks-001", + "productName": "Identity Intelligence", + "productVersion": "1.0.0", + "vendorName": "Cisco" + }, + "network": { + "asn": "AS15169" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.1", + "1.1.1.2", + "1.1.1.3", + "1.1.1.4" + ] + }, + "ip": [ + "1.1.1.1", + "1.1.1.2", + "1.1.1.3", + "1.1.1.4" + ], + "location": { + "countryOrRegion": "us-east-1" + }, + "user": { + "attribute": { + "labels": [ + { + "key": "user_trust_level", + "value": "HIGH_RISK" + } + ] + }, + "emailAddresses": [ + "dummy_user_01@corp.dummy.com" + ], + "userDisplayName": "dummy_admin_01@corp.dummy.com", + "userid": "dummy_admin_01@corp.dummy.com" + } + }, + "securityResult": [ + { + "categoryDetails": [ + "Identity Threat", + "Geo Velocity", + "Account Takeover" + ], + "detectionFields": [ + { + "key": "account", + "value": "123456789012" + }, + { + "key": "check_id", + "value": "chk-ip-geo-001" + }, + { + "key": "check_scope", + "value": "GLOBAL" + }, + { + "key": "explainabilityEventId_0", + "value": "evt-id-001" + }, + { + "key": "explainabilityEventId_1", + "value": "evt-id-002" + }, + { + "key": "explainabilityEventId_2", + "value": "evt-id-003" + }, + { + "key": "alertOrigin", + "value": "BehavioralEngine" + }, + { + "key": "loginDetails 0 details 0 login_event_summary", + "value": "Successful login with MFA" + }, + { + "key": "loginDetails 0 details 1 travel_analysis", + "value": "[{\"hitCount\": 3, \"num_score\": 95, \"distance\": 8500, \"velocity_m_s\": 550, \"ipAddress\": \"1.1.1.2\", \"ipInfo\": {\"city\": \"Tokyo\", \"country\": \"Japan\", \"latitude\": 35.6762, \"longitude\": 139.6503}, \"asn\": {\"number\": 13335, \"org\": \"Cloudflare\"}, \"coordinates\": {\"latitude\": 35.6762, \"longitude\": 139.6503}, \"first_event\": {\"ip_address\": \"1.1.1.3\", \"lat\": 37.7749, \"lng\": -122.4194, \"device_age\": 10, \"ip_prevalence\": 0.7, \"tenant_isp_prevalence\": 0.8, \"user_ip_age\": 5, \"user_isp_prevalence\": 0.6, \"location\": {\"city\": \"San Francisco\", \"country\": \"USA\"}}, \"second_event\": {\"ip_address\": \"1.1.1.4\", \"lat\": 35.6762, \"lng\": 139.6503, \"device_age\": 1, \"ip_prevalence\": 0.2, \"tenant_isp_prevalence\": 0.3, \"user_ip_age\": 1, \"user_isp_prevalence\": 0.1, \"location\": {\"city\": \"Tokyo\", \"country\": \"Japan\"}}, \"status\": \"FLAGGED\"}]" + }, + { + "key": "0 1 0 distance", + "value": "8500" + }, + { + "key": "0 1 0 hitCount", + "value": "3" + }, + { + "key": "0 1 0 num_score", + "value": "95" + }, + { + "key": "0 1 0 status", + "value": "FLAGGED" + }, + { + "key": "0 1 0 velocity_m_s", + "value": "550" + }, + { + "key": "0 1 0 ipInfo city", + "value": "Tokyo" + }, + { + "key": "0 1 0 ipInfo country", + "value": "Japan" + }, + { + "key": "0 1 0 ipInfo latitude", + "value": "35.6762" + }, + { + "key": "0 1 0 ipInfo longitude", + "value": "139.6503" + }, + { + "key": "0 1 0 asn org", + "value": "Cloudflare" + }, + { + "key": "0 1 0 coordinates latitude", + "value": "35.6762" + }, + { + "key": "0 1 0 coordinates longitude", + "value": "139.6503" + }, + { + "key": "0 1 0 first_event device_age", + "value": "10" + }, + { + "key": "0 1 0 first_event ip_prevalence", + "value": "0.7" + }, + { + "key": "0 1 0 first_event lat", + "value": "37.7749" + }, + { + "key": "0 1 0 first_event lng", + "value": "-122.4194" + }, + { + "key": "0 1 0 first_event tenant_isp_prevalence", + "value": "0.8" + }, + { + "key": "0 1 0 first_event user_ip_age", + "value": "5" + }, + { + "key": "0 1 0 first_event user_isp_prevalence", + "value": "0.6" + }, + { + "key": "0 1 0 first_event location city", + "value": "San Francisco" + }, + { + "key": "0 1 0 first_event location country", + "value": "USA" + }, + { + "key": "0 1 0 second_event device_age", + "value": "1" + }, + { + "key": "0 1 0 second_event ip_prevalence", + "value": "0.2" + }, + { + "key": "0 1 0 second_event lat", + "value": "35.6762" + }, + { + "key": "0 1 0 second_event lng", + "value": "139.6503" + }, + { + "key": "0 1 0 second_event tenant_isp_prevalence", + "value": "0.3" + }, + { + "key": "0 1 0 second_event user_ip_age", + "value": "1" + }, + { + "key": "0 1 0 second_event user_isp_prevalence", + "value": "0.1" + }, + { + "key": "0 1 0 second_event location city", + "value": "Tokyo" + }, + { + "key": "0 1 0 second_event location country", + "value": "Japan" + } + ], + "ruleId": "rule-sec-999", + "ruleName": "Impossible Travel Detected", + "severity": "HIGH", + "summary": "FAILED_CHECK" + } + ], + "src": { + "labels": [ + { + "key": "source", + "value": "oort.identity" + } + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "OORT", + "productLogId": "oort-err-stim-002", + "productName": "Identity Intelligence", + "productVersion": "1.0.0", + "vendorName": "Cisco" + }, + "principal": { + "location": { + "countryOrRegion": "us-east-1" + }, + "user": { + "emailAddresses": [ + "dummy_err_user_02@corp.dummy.com" + ] + } + }, + "securityResult": [ + { + "detectionFields": [ + { + "key": "account", + "value": "123456789012" + }, + { + "key": "loginDetails 0 details 0 test_unparseable", + "value": "{invalid_json_inner_content:" + } + ], + "ruleId": "rule-err-002", + "ruleName": "Error Stimulator Test", + "severity": "CRITICAL" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "OORT", + "productLogId": "oort-empty-branch-003", + "productName": "Identity Intelligence", + "vendorName": "Cisco" + }, + "network": {}, + "securityResult": [ + { + "detectionFields": [ + { + "key": "loginDetails 0 details 2 other_detail", + "value": "[{\"hitCount\": \"10\", \"ipInfo\": {\"city\": \"-\", \"country\": \"-\"}, \"asn\": {\"number\": \"-\"}, \"coordinates\": {\"latitude\": \"-\"}, \"first_event\": {\"ipAddress\": \"ignored\", \"ip\": \"ignored\", \"ip_address\": \"\"}, \"second_event\": {\"ipAddress\": \"ignored\", \"ip\": \"ignored\", \"ip_address\": \"\"}, \"ipAddress\": \"\"}]" + }, + { + "key": "0 2 0 hitCount", + "value": "10" + } + ], + "severity": "MEDIUM" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2026-08-14T05:10:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2026-08-14T05:10:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "OORT", + "productLogId": "oort-users-failing-004", + "productName": "Identity Intelligence", + "productVersion": "1.0.0", + "vendorName": "Cisco" + }, + "principal": { + "location": { + "countryOrRegion": "us-west-2" + }, + "user": { + "emailAddresses": [ + "dummy_failing_user_01@dummy.com", + "dummy_failing_user_02@dummy.com" + ] + } + }, + "securityResult": [ + { + "detectionFields": [ + { + "key": "account", + "value": "987654321098" + } + ], + "ruleId": "rule-users-failing-004", + "ruleName": "Inactive Users with Failing MFA Policy", + "severity": "LOW", + "summary": "FAILED_CHECK" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2026-08-14T05:15:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2026-08-14T05:15:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "OORT", + "productLogId": "oort-user-login-005", + "productName": "Identity Intelligence", + "productVersion": "1.0.0", + "vendorName": "Cisco" + }, + "principal": { + "location": { + "countryOrRegion": "eu-west-1" + }, + "user": { + "attribute": { + "labels": [ + { + "key": "user_trust_level", + "value": "LOW_TRUST" + } + ] + }, + "userDisplayName": "dummy_target_user_05@enterprise.org", + "userid": "dummy_target_user_05@enterprise.org" + } + }, + "securityResult": [ + { + "detectionFields": [ + { + "key": "account", + "value": "112233445566" + }, + { + "key": "check_id", + "value": "chk-trust-005" + }, + { + "key": "check_scope", + "value": "TENANT" + }, + { + "key": "factorName", + "value": "FIDO2 Key Removed" + } + ], + "ruleId": "rule-user-005", + "ruleName": "User Trust Level Changed", + "severity": "CRITICAL", + "summary": "FAILED_CHECK" + } + ], + "src": { + "labels": [ + { + "key": "source", + "value": "oort.compliance" + } + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2026-08-14T05:20:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "detail description": [ + "System maintenance completed successfully" + ] + }, + "metadata": { + "eventTimestamp": "2026-08-14T05:20:00Z", + "eventType": "GENERIC_EVENT", + "logType": "OORT", + "productLogId": "oort-generic-006", + "productName": "Identity Intelligence", + "productVersion": "1.0.0", + "vendorName": "Cisco" + }, + "principal": { + "location": { + "countryOrRegion": "ap-southeast-1" + } + }, + "securityResult": [ + { + "categoryDetails": [ + "System", + "Health" + ], + "ruleId": "rule-sys-006", + "ruleName": "System Maintenance Notification", + "severity": "MEDIUM", + "summary": "FAILED_CHECK" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2026-08-14T05:25:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2026-08-14T05:25:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "OORT", + "productLogId": "oort-sev-error-007", + "productName": "Identity Intelligence", + "productVersion": "1.0.0", + "vendorName": "Cisco" + }, + "principal": { + "location": { + "countryOrRegion": "us-central-1" + }, + "user": { + "emailAddresses": [ + "dummy_service_account@domain.local" + ] + } + }, + "securityResult": [ + { + "ruleId": "rule-err-007", + "ruleName": "Connector Sync Error", + "severity": "ERROR" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2026-08-14T05:30:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2026-08-14T05:30:00Z", + "eventType": "GENERIC_EVENT", + "logType": "OORT", + "productLogId": "oort-missing-keys-008", + "productName": "Identity Intelligence", + "productVersion": "1.0.0", + "vendorName": "Cisco" + }, + "principal": { + "location": { + "countryOrRegion": "us-east-1" + } + }, + "securityResult": [ + { + "ruleId": "rule-min-008", + "ruleName": "Minimal Event", + "severity": "LOW" + } + ] + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/OORT_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/OORT_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..7d05347b1f --- /dev/null +++ b/content/parsers/third_party/community/OORT_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,32 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"version\": \"1.0.0\", \"id\": \"oort-evt-ks-001\", \"time\": \"2026-08-14T05:00:00.123456Z\", \"account\": \"123456789012\", \"source\": \"oort.identity\", \"region\": \"us-east-1\", \"detail-type\": \"FAILED_CHECK\", \"detail\": {\"id\": \"rule-sec-999\", \"title\": \"Impossible Travel Detected\", \"severity\": \"HIGH\", \"published\": \"2026-08-14T05:00:00Z\", \"login\": \"dummy_admin_01@corp.dummy.com\", \"checkId\": \"chk-ip-geo-001\", \"checkScope\": \"GLOBAL\", \"userTrustLevel\": \"HIGH_RISK\", \"checkTopics\": [\"Identity Threat\", \"Geo Velocity\", \"Account Takeover\"], \"frameworks\": [\"MITRE ATT\u0026CK\", \"NIST CSF\", \"CIS Controls\"], \"explainabilityEventIds\": [\"evt-id-001\", \"evt-id-002\", \"evt-id-003\"], \"recommendedActions\": [\"Revoke active session\", \"Enforce MFA re-authentication\", \"Quarantine user account\"], \"description\": [\"User authenticated from multiple distinct locations simultaneously\", \"Impossible travel detected between SF and Tokyo\"], \"explainabilityDetails\": [{\"key\": \"ips\", \"value\": \"{\\\"ipAddress\\\":\\\"1.1.1.1\\\"}\"}, {\"key\": \"asnDomains\", \"value\": \"AS15169\"}, {\"key\": \"alertOrigin\", \"value\": \"BehavioralEngine\"}], \"loginDetails\": [{\"login\": \"dummy_user_01@corp.dummy.com\", \"details\": [{\"key\": \"login_event_summary\", \"value\": \"Successful login with MFA\"}, {\"key\": \"travel_analysis\", \"value\": \"[{\\\"hitCount\\\": 3, \\\"num_score\\\": 95, \\\"distance\\\": 8500, \\\"velocity_m_s\\\": 550, \\\"ipAddress\\\": \\\"1.1.1.2\\\", \\\"ipInfo\\\": {\\\"city\\\": \\\"Tokyo\\\", \\\"country\\\": \\\"Japan\\\", \\\"latitude\\\": 35.6762, \\\"longitude\\\": 139.6503}, \\\"asn\\\": {\\\"number\\\": 13335, \\\"org\\\": \\\"Cloudflare\\\"}, \\\"coordinates\\\": {\\\"latitude\\\": 35.6762, \\\"longitude\\\": 139.6503}, \\\"first_event\\\": {\\\"ip_address\\\": \\\"1.1.1.3\\\", \\\"lat\\\": 37.7749, \\\"lng\\\": -122.4194, \\\"device_age\\\": 10, \\\"ip_prevalence\\\": 0.7, \\\"tenant_isp_prevalence\\\": 0.8, \\\"user_ip_age\\\": 5, \\\"user_isp_prevalence\\\": 0.6, \\\"location\\\": {\\\"city\\\": \\\"San Francisco\\\", \\\"country\\\": \\\"USA\\\"}}, \\\"second_event\\\": {\\\"ip_address\\\": \\\"1.1.1.4\\\", \\\"lat\\\": 35.6762, \\\"lng\\\": 139.6503, \\\"device_age\\\": 1, \\\"ip_prevalence\\\": 0.2, \\\"tenant_isp_prevalence\\\": 0.3, \\\"user_ip_age\\\": 1, \\\"user_isp_prevalence\\\": 0.1, \\\"location\\\": {\\\"city\\\": \\\"Tokyo\\\", \\\"country\\\": \\\"Japan\\\"}}, \\\"status\\\": \\\"FLAGGED\\\"}]\"}]}]}}" + }, + { + "data": "{\"version\": \"1.0.0\", \"id\": \"oort-err-stim-002\", \"time\": \"invalid-timestamp-format-stimulator\", \"account\": \"123456789012\", \"region\": \"us-east-1\", \"detail\": {\"id\": \"rule-err-002\", \"title\": \"Error Stimulator Test\", \"published\": \"invalid-iso8601-date-stimulator\", \"severity\": \"CRITICAL\", \"checkTopics\": [{}], \"frameworks\": [{}], \"recommendedActions\": [{}], \"description\": [{}], \"explainabilityDetails\": [{\"key\": \"ips\", \"value\": \"invalid_grok_ip_value\"}], \"loginDetails\": [{\"login\": \"dummy_err_user_02@corp.dummy.com\", \"details\": [{\"key\": \"test_unparseable\", \"value\": \"{invalid_json_inner_content:\"}]}]}}" + }, + { + "data": "{\"version\": \"\", \"id\": \"oort-empty-branch-003\", \"time\": \"\", \"account\": \"\", \"source\": \"\", \"region\": \"\", \"detail-type\": \"\", \"detail\": {\"id\": \"\", \"title\": \"\", \"login\": \"\", \"checkId\": \"\", \"checkScope\": \"\", \"userTrustLevel\": \"\", \"published\": \"\", \"severity\": \"moderate\", \"checkTopics\": [], \"frameworks\": [], \"explainabilityEventIds\": [], \"recommendedActions\": [], \"description\": [], \"explainabilityDetails\": [{\"key\": \"asnDomains\", \"value\": \"\"}, {\"key\": \"ips\", \"value\": \"\"}], \"loginDetails\": [{\"login\": \"not_an_email_username\", \"details\": [{\"key\": \"failedSigninDetails\", \"value\": \"skipped_merge_failedSigninDetails\"}, {\"key\": \"ips\", \"value\": \"skipped_merge_ips\"}, {\"key\": \"other_detail\", \"value\": \"[{\\\"hitCount\\\": \\\"10\\\", \\\"ipInfo\\\": {\\\"city\\\": \\\"-\\\", \\\"country\\\": \\\"-\\\"}, \\\"asn\\\": {\\\"number\\\": \\\"-\\\"}, \\\"coordinates\\\": {\\\"latitude\\\": \\\"-\\\"}, \\\"first_event\\\": {\\\"ipAddress\\\": \\\"ignored\\\", \\\"ip\\\": \\\"ignored\\\", \\\"ip_address\\\": \\\"\\\"}, \\\"second_event\\\": {\\\"ipAddress\\\": \\\"ignored\\\", \\\"ip\\\": \\\"ignored\\\", \\\"ip_address\\\": \\\"\\\"}, \\\"ipAddress\\\": \\\"\\\"}]\"}]}]}}" + }, + { + "data": "{\"version\": \"1.0.0\", \"id\": \"oort-users-failing-004\", \"time\": \"2026-08-14T05:10:00Z\", \"account\": \"987654321098\", \"region\": \"us-west-2\", \"detail-type\": \"FAILED_CHECK\", \"detail\": {\"id\": \"rule-users-failing-004\", \"title\": \"Inactive Users with Failing MFA Policy\", \"severity\": \"LOW\", \"usersFailing\": [\"dummy_failing_user_01@dummy.com\", \"dummy_failing_user_02@dummy.com\", \"non_email_user_identifier\"]}}" + }, + { + "data": "{\"version\": \"1.0.0\", \"id\": \"oort-user-login-005\", \"time\": \"2026-08-14T05:15:00+00:00\", \"account\": \"112233445566\", \"source\": \"oort.compliance\", \"region\": \"eu-west-1\", \"detail-type\": \"FAILED_CHECK\", \"detail\": {\"id\": \"rule-user-005\", \"title\": \"User Trust Level Changed\", \"severity\": \"CRITICAL\", \"login\": \"dummy_target_user_05@enterprise.org\", \"userTrustLevel\": \"LOW_TRUST\", \"checkId\": \"chk-trust-005\", \"checkScope\": \"TENANT\", \"explainabilityDetails\": [{\"key\": \"factorName\", \"value\": \"FIDO2 Key Removed\"}]}}" + }, + { + "data": "{\"version\": \"1.0.0\", \"id\": \"oort-generic-006\", \"time\": \"2026-08-14T05:20:00Z\", \"region\": \"ap-southeast-1\", \"detail-type\": \"FAILED_CHECK\", \"detail\": {\"id\": \"rule-sys-006\", \"title\": \"System Maintenance Notification\", \"severity\": \"moderate\", \"description\": [\"System maintenance completed successfully\"], \"checkTopics\": [\"System\", \"Health\"]}}" + }, + { + "data": "{\"version\": \"1.0.0\", \"id\": \"oort-sev-error-007\", \"time\": \"2026-08-14T05:25:00Z\", \"region\": \"us-central-1\", \"detail\": {\"id\": \"rule-err-007\", \"title\": \"Connector Sync Error\", \"severity\": \"ERROR\", \"loginDetails\": [{\"login\": \"dummy_service_account@domain.local\", \"details\": []}]}}" + }, + { + "data": "{\"version\": \"1.0.0\", \"id\": \"oort-missing-keys-008\", \"time\": \"2026-08-14T05:30:00Z\", \"region\": \"us-east-1\", \"detail\": {\"id\": \"rule-min-008\", \"title\": \"Minimal Event\", \"severity\": \"LOW\"}}" + } + ], + "type": "OORT" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/metadata.json b/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/metadata.json index 9b56ae7bba..bca1d7c64a 100644 --- a/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/metadata.json @@ -5,5 +5,5 @@ "supported_format": "JSON", "category": "SaaS Application", "references": "https://docs.servicenow.com/bundle/quebec-platform-administration/page/administer/security/concept/instance-sec-center-event-ribbon.html", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..72a9c1325e --- /dev/null +++ b/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,311 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "extensions": { + "auth": { + "type": "MACHINE" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "USER_LOGIN", + "logType": "SERVICENOW_SECURITY", + "productEventType": "Failed Login", + "productName": "SERVICENOW_SECURITY", + "vendorName": "SERVICENOW" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.1" + ] + }, + "ip": [ + "1.1.1.1" + ], + "user": { + "userid": "dummy_user_01" + } + }, + "target": { + "user": { + "userid": "dummy_target_01" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:05:00Z", + "idm": { + "readOnlyUdm": { + "extensions": { + "auth": { + "type": "MACHINE" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:05:00Z", + "eventType": "USER_LOGIN", + "logType": "SERVICENOW_SECURITY", + "productEventType": "Admin Login", + "productName": "SERVICENOW_SECURITY", + "vendorName": "SERVICENOW" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.2" + ] + }, + "ip": [ + "1.1.1.2" + ], + "user": { + "userid": "dummy_admin_02" + } + }, + "target": { + "user": { + "userid": "dummy_admin_02" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:10:00Z", + "idm": { + "readOnlyUdm": { + "extensions": { + "auth": { + "type": "MACHINE" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:10:00Z", + "eventType": "USER_LOGIN", + "logType": "SERVICENOW_SECURITY", + "productEventType": "SNC Login", + "productName": "SERVICENOW_SECURITY", + "vendorName": "SERVICENOW" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.3" + ] + }, + "ip": [ + "1.1.1.3" + ], + "user": { + "userid": "dummy_user_03" + } + }, + "target": { + "user": { + "userid": "dummy_snc_target_03" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:15:00Z", + "idm": { + "readOnlyUdm": { + "extensions": { + "auth": { + "type": "MACHINE" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:15:00Z", + "eventType": "USER_LOGIN", + "logType": "SERVICENOW_SECURITY", + "productEventType": "Impersonation", + "productName": "SERVICENOW_SECURITY", + "vendorName": "SERVICENOW" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.4" + ] + }, + "ip": [ + "1.1.1.4" + ], + "user": { + "userid": "dummy_secops_04" + } + }, + "target": { + "user": { + "userid": "dummy_impersonated_user_04" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:20:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:20:00Z", + "eventType": "USER_CHANGE_PERMISSIONS", + "logType": "SERVICENOW_SECURITY", + "productEventType": "Security Elevation", + "productName": "SERVICENOW_SECURITY", + "vendorName": "SERVICENOW" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.1" + ] + }, + "ip": [ + "1.1.1.1" + ], + "user": { + "userid": "dummy_secops_05" + } + }, + "target": { + "user": { + "userid": "dummy_elevated_target_05" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:30:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "source": "ServiceNow" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:30:00Z", + "description": "Synthetic authentication failure encountered during API request", + "eventTimestamp": "2024-10-12T10:30:00Z", + "eventType": "GENERIC_EVENT", + "logType": "SERVICENOW_SECURITY", + "productEventType": "system_log", + "productLogId": "sys-id-synth-00101", + "productName": "SERVICENOW_SECURITY", + "vendorName": "SERVICENOW" + }, + "principal": { + "namespace": "instance_dummy_alpha", + "resource": { + "name": "dummy_auth_script" + }, + "user": { + "userid": "dummy_service_account_06" + } + }, + "securityResult": [ + { + "severity": "ERROR" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:35:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "source": "ServiceNow" + }, + "metadata": { + "collectedTimestamp": "2024-10-12T10:35:00Z", + "eventTimestamp": "2024-10-12T10:35:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "SERVICENOW_SECURITY", + "productEventType": "role_assignment", + "productLogId": "sys-id-synth-00102", + "productName": "SERVICENOW_SECURITY", + "vendorName": "SERVICENOW" + }, + "principal": { + "namespace": "instance_dummy_alpha", + "user": { + "userid": "dummy_analyst_07" + } + }, + "securityResult": [ + { + "actionDetails": "active", + "severity": "INFORMATIONAL" + } + ], + "target": { + "resource": { + "attribute": { + "roles": [ + { + "name": "dummy_security_admin_role" + } + ] + } + }, + "user": { + "userid": "dummy_approver_07" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "SERVICENOW_SECURITY", + "productEventType": "status_check", + "productName": "SERVICENOW_SECURITY", + "vendorName": "SERVICENOW" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.1" + ] + }, + "ip": [ + "1.1.1.1" + ] + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..f75b26de11 --- /dev/null +++ b/content/parsers/third_party/community/SERVICENOW_SECURITY_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,32 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"event\": \"Failed Login\", \"event_created\": \"2024-10-12 10:00:00\", \"ip_address\": \"1.1.1.1\", \"user\": \"dummy_user_01\", \"table_name\": \"sys_user\", \"snc_user\": \"dummy_target_01\", \"created_by\": \"dummy_admin_system\", \"created_on\": \"2024-10-12 09:00:00\", \"updated_by\": \"dummy_admin_system\", \"updated_on\": \"2024-10-12 09:00:00\"}" + }, + { + "data": "{\"event\": \"Admin Login\", \"event_created\": \"2024-10-12 10:05:00\", \"ip_address\": \"1.1.1.2\", \"user\": \"dummy_admin_02\", \"table_name\": \"\", \"snc_user\": \"\", \"created_by\": \"dummy_admin_02\", \"created_on\": \"2024-10-12 09:00:00\", \"updated_by\": \"dummy_admin_system\", \"updated_on\": \"2024-10-12 09:00:00\"}" + }, + { + "data": "{\"event\": \"SNC Login\", \"event_created\": \"2024-10-12 10:10:00\", \"ip_address\": \"1.1.1.3\", \"user\": \"dummy_user_03\", \"table_name\": \"\", \"snc_user\": \"dummy_snc_target_03\", \"created_by\": \"dummy_admin_system\", \"created_on\": \"2024-10-12 09:00:00\", \"updated_by\": \"dummy_admin_system\", \"updated_on\": \"2024-10-12 09:00:00\"}" + }, + { + "data": "{\"event\": \"Impersonation\", \"event_created\": \"2024-10-12 10:15:00\", \"ip_address\": \"1.1.1.4\", \"user\": \"dummy_secops_04\", \"table_name\": \"\", \"snc_user\": \"dummy_impersonated_user_04\", \"created_by\": \"dummy_secops_04\", \"created_on\": \"2024-10-12 09:00:00\", \"updated_by\": \"dummy_admin_system\", \"updated_on\": \"2024-10-12 09:00:00\"}" + }, + { + "data": "{\"event\": \"Security Elevation\", \"event_created\": \"2024-10-12 10:20:00\", \"ip_address\": \"1.1.1.1\", \"user\": \"dummy_secops_05\", \"table_name\": \"\", \"snc_user\": \"dummy_elevated_target_05\", \"created_by\": \"dummy_secops_05\", \"created_on\": \"2024-10-12 09:00:00\", \"updated_by\": \"dummy_admin_system\", \"updated_on\": \"2024-10-12 09:00:00\"}" + }, + { + "data": "{\"event_type\": \"system_log\", \"timestamp\": \"12-Oct-2024 10:30:00\", \"data\": {\"sys_id\": \"sys-id-synth-00101\", \"level\": \"Error\", \"source\": \"dummy_auth_script\", \"message\": \"Synthetic authentication failure encountered during API request\", \"sys_created_on\": \"2024-10-12 10:30:00\", \"sys_created_by\": \"dummy_service_account_06\"}, \"source\": \"ServiceNow\", \"source_instance\": \"instance_dummy_alpha\"}" + }, + { + "data": "{\"event_type\": \"role_assignment\", \"timestamp\": \"12-Oct-2024 10:35:00\", \"data\": {\"sys_id\": \"sys-id-synth-00102\", \"level\": \"Info\", \"user\": \"dummy_analyst_07\", \"role\": \"dummy_security_admin_role\", \"granted_by\": \"dummy_approver_07\", \"state\": \"active\", \"sys_created_on\": \"2024-10-12 10:35:00\", \"sys_created_by\": \"dummy_approver_07\"}, \"source\": \"ServiceNow\", \"source_instance\": \"instance_dummy_alpha\"}" + }, + { + "data": "{\"event_type\": \"status_check\", \"ip_address\": \"1.1.1.1\", \"user\": \"null\"}" + } + ], + "type": "SERVICENOW_SECURITY" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/metadata.json b/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/metadata.json index 88f775e05a..12812c1b3d 100644 --- a/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "SHRUBBERY_TACACS", "supported_format": "SYSLOG + KV", "category": "NETWORK MANAGEMENT", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..4c596a8399 --- /dev/null +++ b/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,294 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "TASK_ID": "task_1001", + "service": "shell" + }, + "extensions": { + "auth": { + "type": "TACACS" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "NETWORK_CONNECTION", + "logType": "SHRUBBERY_TACACS", + "productName": "shrubbery_tacacs", + "vendorName": "shrubbery_tacacs" + }, + "network": { + "sessionId": "sess_9001" + }, + "principal": { + "asset": { + "hostname": "dummy_tacacs_01", + "ip": [ + "1.1.1.2" + ] + }, + "hostname": "dummy_tacacs_01", + "ip": [ + "1.1.1.2" + ], + "process": { + "commandLine": "show running-config", + "pid": "12345" + }, + "user": { + "userid": "dummy_user_01" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "actionDetails": "stop" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.1" + ] + }, + "ip": [ + "1.1.1.1" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:05:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "service": "exec" + }, + "extensions": { + "auth": { + "type": "TACACS" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:05:00Z", + "eventType": "USER_LOGIN", + "logType": "SHRUBBERY_TACACS", + "productName": "shrubbery_tacacs", + "vendorName": "shrubbery_tacacs" + }, + "principal": { + "asset": { + "hostname": "dummy_tacacs_02" + }, + "hostname": "dummy_tacacs_02", + "process": { + "commandLine": "login" + }, + "user": { + "userid": "dummy_user_02" + } + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ], + "actionDetails": "start" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.3" + ] + }, + "ip": [ + "1.1.1.3" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:10:00Z", + "idm": { + "readOnlyUdm": { + "extensions": { + "auth": { + "type": "TACACS" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:10:00Z", + "eventType": "NETWORK_CONNECTION", + "logType": "SHRUBBERY_TACACS", + "productName": "shrubbery_tacacs", + "vendorName": "shrubbery_tacacs" + }, + "principal": { + "asset": { + "hostname": "dummy_tacacs_03", + "ip": [ + "1.1.1.5" + ] + }, + "hostname": "dummy_tacacs_03", + "ip": [ + "1.1.1.5" + ], + "user": { + "userid": "dummy_user_03" + } + }, + "target": { + "asset": { + "ip": [ + "1.1.1.4" + ] + }, + "ip": [ + "1.1.1.4" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:15:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "service": "shell" + }, + "extensions": { + "auth": { + "type": "TACACS" + } + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:15:00Z", + "eventType": "USER_LOGOUT", + "logType": "SHRUBBERY_TACACS", + "productName": "shrubbery_tacacs", + "vendorName": "shrubbery_tacacs" + }, + "principal": { + "asset": { + "hostname": "dummy_tacacs_04", + "ip": [ + "1.1.1.7" + ] + }, + "hostname": "dummy_tacacs_04", + "ip": [ + "1.1.1.7" + ], + "process": { + "commandLine": "logout" + }, + "user": { + "userid": "dummy_user_04" + } + }, + "securityResult": [ + { + "action": [ + "BLOCK" + ], + "actionDetails": "stop" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.6" + ] + }, + "ip": [ + "1.1.1.6" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-08T14:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "TASK_ID": "task_5005", + "service": "slip" + }, + "extensions": { + "auth": { + "type": "TACACS" + } + }, + "metadata": { + "eventTimestamp": "2024-10-08T14:00:00Z", + "eventType": "USER_LOGIN", + "logType": "SHRUBBERY_TACACS", + "productName": "shrubbery_tacacs", + "vendorName": "shrubbery_tacacs" + }, + "network": { + "sessionId": "sess_5005" + }, + "principal": { + "asset": { + "hostname": "dummy_tacacs_05", + "ip": [ + "1.1.1.9" + ] + }, + "hostname": "dummy_tacacs_05", + "ip": [ + "1.1.1.9" + ], + "process": { + "commandLine": "login", + "pid": "67890" + }, + "user": { + "userid": "dummy_user_05" + } + }, + "securityResult": [ + { + "action": [ + "ALLOW" + ], + "actionDetails": "start" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.8" + ] + }, + "ip": [ + "1.1.1.8" + ] + } + } + } + } + } + ] +} diff --git a/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..ec2d00e411 --- /dev/null +++ b/content/parsers/third_party/community/SHRUBBERY_TACACS_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,23 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "<134>Oct 12 10:00:00 dummy_tacacs_01 Oct 12 10:00:001.1.1.1\tdummy_user_01\ttty1\t1.1.1.2\tstop\tservice=shell\ttask_id=task_1001\tcmd=show running-config\tprocess*[12345]\tsession_pid=sess_9001" + }, + { + "data": "<134>Oct 12 10:05:00 dummy_tacacs_02 Oct 12 10:05:001.1.1.3\tdummy_user_02\ttty2\tunknown_ip\tstart\tcmd=login\tservice=exec" + }, + { + "data": "<134>Oct 12 10:10:00 dummy_tacacs_03 Oct 12 10:10:001.1.1.4\tdummy_user_03\ttty3\t1.1.1.5\tupdate\tstatus=active" + }, + { + "data": "<134>Oct 12 10:15:00 dummy_tacacs_04 Oct 12 10:15:001.1.1.6\tdummy_user_04\ttty4\t1.1.1.7\tstop\tservice=shell\tcmd=logout" + }, + { + "data": "<134>Oct 8 14:00:00 dummy_tacacs_05 Oct 8 14:00:001.1.1.8\tdummy_user_05\ttty5\t1.1.1.9\tstart\tservice=slip\ttask_id=task_5005\tcmd=login\tprocess*[67890]\tsession_pid=sess_5005" + } + ], + "type": "SHRUBBERY_TACACS" + } +} diff --git a/content/parsers/third_party/community/SWIMLANE_GUS/cbn/metadata.json b/content/parsers/third_party/community/SWIMLANE_GUS/cbn/metadata.json index b54a40178f..0d76432a7c 100644 --- a/content/parsers/third_party/community/SWIMLANE_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/SWIMLANE_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "SWIMLANE", "supported_format": "JSON", "category": "SOAR Tools", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/SWIMLANE_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/SWIMLANE_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..7f63d5568d --- /dev/null +++ b/content/parsers/third_party/community/SWIMLANE_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,236 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T07:20:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "authenticationType": "Password", + "eventOutcome": "Success", + "id": "evt_swimlane_0001", + "isAdmin": "true", + "type": "UserAudit" + }, + "extensions": { + "auth": {} + }, + "metadata": { + "description": "User logged into Swimlane platform successfully", + "eventTimestamp": "2024-10-12T07:20:00Z", + "eventType": "USER_LOGIN", + "logType": "SWIMLANE", + "productLogId": "tenant_swimlane_prod_01", + "productName": "SWIMLANE", + "vendorName": "SWIMLANE" + }, + "network": { + "http": { + "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" + } + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.1", + "1.1.1.2" + ] + }, + "email": "dummy_admin_01@dummy.com", + "ip": [ + "1.1.1.1", + "1.1.1.2" + ], + "user": { + "userid": "acc_principal_1234" + } + }, + "securityResult": [ + { + "actionDetails": "Login", + "categoryDetails": [ + "Authentication" + ], + "severity": "INFORMATIONAL" + } + ], + "target": { + "resource": { + "attribute": { + "labels": [ + { + "key": "endpoint", + "value": "/api/v1/users/login" + } + ] + } + }, + "user": { + "userid": "usr_target_9876" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Error handler stimulator payload", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "SWIMLANE", + "productLogId": "tenant_err_0002", + "productName": "SWIMLANE", + "vendorName": "SWIMLANE" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "SWIMLANE", + "productLogId": "tenant_empty_0003", + "productName": "SWIMLANE", + "vendorName": "SWIMLANE" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T07:25:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "id": "evt_warn_0005", + "isAdmin": "false", + "type": "WarningAudit" + }, + "metadata": { + "description": "System warning threshold exceeded", + "eventTimestamp": "2024-10-12T07:25:00Z", + "eventType": "GENERIC_EVENT", + "logType": "SWIMLANE", + "productLogId": "tenant_warn_0005", + "productName": "SWIMLANE", + "vendorName": "SWIMLANE" + }, + "securityResult": [ + { + "actionDetails": "Alert", + "severity": "MEDIUM" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T07:30:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "eventOutcome": "Success", + "id": "evt_user_0006", + "isAdmin": "true", + "type": "AccountManagement" + }, + "metadata": { + "description": "Created new user account", + "eventTimestamp": "2024-10-12T07:30:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "SWIMLANE", + "productLogId": "tenant_user_uncat_0006", + "productName": "SWIMLANE", + "vendorName": "SWIMLANE" + }, + "principal": { + "email": "test_admin_user@dummy.com", + "user": { + "userid": "acc_admin_5678" + } + }, + "securityResult": [ + { + "actionDetails": "Create", + "categoryDetails": [ + "UserManagement" + ], + "severity": "ERROR" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T07:35:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "id": "evt_status_0007", + "type": "TaskStatus" + }, + "metadata": { + "description": "Swimlane task status updated to completed", + "eventTimestamp": "2024-10-12T07:35:00Z", + "eventType": "STATUS_UPDATE", + "logType": "SWIMLANE", + "productLogId": "tenant_status_0007", + "productName": "SWIMLANE", + "vendorName": "SWIMLANE" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.3" + ] + }, + "ip": [ + "1.1.1.3" + ] + }, + "securityResult": [ + { + "actionDetails": "StatusCheck", + "severity": "INFORMATIONAL" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T07:40:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "description": "Swimlane event with batched optional keys omitted", + "eventTimestamp": "2024-10-12T07:40:00Z", + "eventType": "GENERIC_EVENT", + "logType": "SWIMLANE", + "productLogId": "tenant_missing_keys_0008", + "productName": "SWIMLANE", + "vendorName": "SWIMLANE" + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/SWIMLANE_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/SWIMLANE_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..785bbc67e2 --- /dev/null +++ b/content/parsers/third_party/community/SWIMLANE_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,29 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"$type\":\"UserAudit\",\"isAdmin\":true,\"sourceIp\":[\"1.1.1.1\",\"1.1.1.2\"],\"eventTime\":\"2024-10-12T07:20:00Z\",\"user\":\"dummy_admin_01@dummy.com\",\"userId\":\"usr_target_9876\",\"category\":\"Authentication\",\"description\":\"User logged into Swimlane platform successfully\",\"actionType\":\"Login\",\"tenantId\":\"tenant_swimlane_prod_01\",\"accountId\":\"acc_principal_1234\",\"eventOutcome\":\"Success\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"endpoint\":\"/api/v1/users/login\",\"authenticationType\":\"Password\",\"logLevel\":\"Info\",\"id\":\"evt_swimlane_0001\"}" + }, + { + "data": "{\"tenantId\":\"tenant_err_0002\",\"isAdmin\":{},\"eventTime\":\"not-a-date\",\"type\":{\"invalid\":\"object\"},\"sourceIp\":{},\"user\":{},\"userId\":{},\"category\":{},\"description\":\"Error handler stimulator payload\",\"actionType\":{},\"accountId\":{},\"eventOutcome\":{},\"userAgent\":{},\"endpoint\":{},\"authenticationType\":{},\"id\":{},\"has_principal_user\":\"false\",\"has_target_user\":\"false\"}" + }, + { + "data": "{\"tenantId\":\"tenant_empty_0003\",\"type\":\"\",\"isAdmin\":\"\",\"sourceIp\":[\"\"],\"eventTime\":\"\",\"user\":\"dummy_non_email_user\",\"userId\":\"\",\"category\":\"\",\"description\":\"\",\"actionType\":\"\",\"accountId\":\"\",\"eventOutcome\":\"\",\"userAgent\":\"\",\"endpoint\":\"\",\"authenticationType\":\"\",\"logLevel\":\"Debug\",\"id\":\"\",\"has_principal_user\":\"false\",\"has_target_user\":\"false\"}" + }, + { + "data": "{\"type\":\"WarningAudit\",\"isAdmin\":false,\"eventTime\":\"2024-10-12T07:25:00Z\",\"description\":\"System warning threshold exceeded\",\"actionType\":\"Alert\",\"tenantId\":\"tenant_warn_0005\",\"logLevel\":\"Warn\",\"id\":\"evt_warn_0005\",\"has_principal_user\":\"false\",\"has_target_user\":\"false\"}" + }, + { + "data": "{\"type\":\"AccountManagement\",\"isAdmin\":\"true\",\"eventTime\":\"2024-10-12T07:30:00Z\",\"user\":\"test_admin_user@dummy.com\",\"category\":\"UserManagement\",\"description\":\"Created new user account\",\"actionType\":\"Create\",\"tenantId\":\"tenant_user_uncat_0006\",\"accountId\":\"acc_admin_5678\",\"has_target_user\":\"false\",\"eventOutcome\":\"Success\",\"logLevel\":\"Error\",\"id\":\"evt_user_0006\"}" + }, + { + "data": "{\"type\":\"TaskStatus\",\"sourceIp\":[\"1.1.1.3\"],\"has_principal_user\":\"false\",\"has_target_user\":\"false\",\"eventTime\":\"2024-10-12T07:35:00Z\",\"description\":\"Swimlane task status updated to completed\",\"actionType\":\"StatusCheck\",\"tenantId\":\"tenant_status_0007\",\"logLevel\":\"Information\",\"id\":\"evt_status_0007\"}" + }, + { + "data": "{\"tenantId\":\"tenant_missing_keys_0008\",\"description\":\"Swimlane event with batched optional keys omitted\",\"eventTime\":\"2024-10-12T07:40:00Z\",\"has_principal_user\":\"false\",\"has_target_user\":\"false\"}" + } + ], + "type": "SWIMLANE" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/metadata.json b/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/metadata.json index c8a0aeec11..a9c432a9b5 100644 --- a/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "SYMANTEC_SA", "supported_format": "SYSLOG + KV", "category": "Vulnerability scanners", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..1c165e380a --- /dev/null +++ b/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,696 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "c": "2", + "m": "1" + }, + "intermediary": [ + { + "asset": { + "hostname": "sa-gateway-01.example.corp" + }, + "hostname": "sa-gateway-01.example.corp" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "Threat connection blocked", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "SYMANTEC_SA", + "productEventType": "threat_detected", + "productLogId": "seq-sink-001", + "productName": "Security Analytics Platform", + "vendorName": "Symantec Corporation" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.1" + ], + "mac": [ + "00:11:22:33:44:55" + ] + }, + "ip": [ + "1.1.1.1" + ], + "mac": [ + "00:11:22:33:44:55" + ], + "user": { + "userid": "dummy_user_01" + } + }, + "securityResult": [ + { + "actionDetails": "block", + "detectionFields": [ + { + "key": "elapsed_time", + "value": "45ms" + } + ] + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.2" + ] + }, + "file": { + "fullPath": "/etc/security/payload.exe" + }, + "ip": [ + "1.1.1.2" + ], + "resource": { + "attribute": { + "labels": [ + { + "key": "query_id", + "value": "qid-12345" + } + ] + }, + "id": "dev-res-100", + "name": "SA-Sensor-S500", + "type": "malware" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-05-20T10:05:30Z", + "idm": { + "readOnlyUdm": { + "additional": { + "start_time": "1716199500000" + }, + "intermediary": [ + { + "asset": { + "hostname": "sa-cef-01.example.corp" + }, + "hostname": "sa-cef-01.example.corp" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "Encrypted TLS session to malicious endpoint", + "eventTimestamp": "2024-05-20T10:05:30Z", + "eventType": "NETWORK_CONNECTION", + "logType": "SYMANTEC_SA", + "productEventType": "High Severity Trojan Alert", + "productLogId": "seq-cef-002", + "productName": "Security Analytics Platform", + "productVersion": "8.2.1", + "vendorName": "Symantec Corporation" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.4" + ], + "mac": [ + "11:22:33:44:55:66" + ] + }, + "ip": [ + "1.1.1.4" + ], + "mac": [ + "11:22:33:44:55:66" + ], + "port": 54321 + }, + "securityResult": [ + { + "description": "Suspicious C2 beaconing activity", + "ruleId": "RULE-8888", + "severity": "HIGH", + "severityDetails": "7", + "summary": "Trojan.Generic.C2" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.3" + ], + "mac": [ + "aa:bb:cc:dd:ee:ff" + ] + }, + "ip": [ + "1.1.1.3" + ], + "mac": [ + "aa:bb:cc:dd:ee:ff" + ], + "port": 443 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "intermediary": [ + { + "asset": { + "hostname": "host3.corp.internal" + }, + "hostname": "host3.corp.internal" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30.123456Z", + "description": "audit session started", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "NETWORK_CONNECTION", + "logType": "SYMANTEC_SA", + "productLogId": "seq-pat3-003", + "productName": "Security Analytics Platform", + "vendorName": "Symantec Corporation" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.5" + ], + "mac": [ + "00:11:22:33:44:aa" + ] + }, + "ip": [ + "1.1.1.5" + ], + "mac": [ + "00:11:22:33:44:aa" + ], + "user": { + "userid": "dummy_user_02" + } + }, + "securityResult": [ + { + "actionDetails": "allow", + "detectionFields": [ + { + "key": "elapsed_time", + "value": "15ms" + } + ] + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.6" + ] + }, + "file": { + "fullPath": "/var/log/audit.log" + }, + "ip": [ + "1.1.1.6" + ], + "resource": { + "attribute": { + "labels": [ + { + "key": "query_id", + "value": "qid-303" + } + ] + } + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "intermediary": [ + { + "asset": { + "hostname": "host-status.corp.internal" + }, + "hostname": "host-status.corp.internal" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "sensor heartbeat status online", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "SYMANTEC_SA", + "productLogId": "seq-status-004", + "productName": "Security Analytics Platform", + "vendorName": "Symantec Corporation" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.7" + ], + "mac": [ + "00:11:22:33:44:bb" + ] + }, + "ip": [ + "1.1.1.7" + ], + "mac": [ + "00:11:22:33:44:bb" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "intermediary": [ + { + "asset": { + "hostname": "host-user.corp.internal" + }, + "hostname": "host-user.corp.internal" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "administrative login successful", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "SYMANTEC_SA", + "productLogId": "seq-user-005", + "productName": "Security Analytics Platform", + "vendorName": "Symantec Corporation" + }, + "principal": { + "user": { + "userid": "dummy_user_admin" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "intermediary": [ + { + "asset": { + "hostname": "host-generic.corp.internal" + }, + "hostname": "host-generic.corp.internal" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "system service rebooted", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "SYMANTEC_SA", + "productLogId": "seq-generic-006", + "productName": "Security Analytics Platform", + "vendorName": "Symantec Corporation" + }, + "target": { + "resource": { + "type": "system_event" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-05-20T10:05:30Z", + "idm": { + "readOnlyUdm": { + "additional": { + "start_time": "1716199500000" + }, + "intermediary": [ + { + "asset": { + "hostname": "host-cef-low.corp.internal" + }, + "hostname": "host-cef-low.corp.internal" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "Routine network scan", + "eventTimestamp": "2024-05-20T10:05:30Z", + "eventType": "NETWORK_CONNECTION", + "logType": "SYMANTEC_SA", + "productEventType": "Informational Scan", + "productLogId": "seq-sev-low", + "productName": "Security Analytics Platform", + "productVersion": "8.2.1", + "vendorName": "Symantec Corporation" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.9" + ], + "mac": [ + "11:22:33:aa:bb:cc" + ] + }, + "ip": [ + "1.1.1.9" + ], + "mac": [ + "11:22:33:aa:bb:cc" + ], + "port": 12345 + }, + "securityResult": [ + { + "description": "Routine Port Scan", + "ruleId": "EVT-1002", + "severity": "LOW", + "severityDetails": "2", + "summary": "Port Scan Detected" + } + ], + "target": { + "asset": { + "ip": [ + "1.1.1.8" + ], + "mac": [ + "aa:bb:cc:11:22:33" + ] + }, + "ip": [ + "1.1.1.8" + ], + "mac": [ + "aa:bb:cc:11:22:33" + ], + "port": 80 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-05-20T10:05:30Z", + "idm": { + "readOnlyUdm": { + "additional": { + "start_time": "1716199500000" + }, + "intermediary": [ + { + "asset": { + "hostname": "host-cef-med.corp.internal" + }, + "hostname": "host-cef-med.corp.internal" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "Policy Violation", + "eventTimestamp": "2024-05-20T10:05:30Z", + "eventType": "NETWORK_CONNECTION", + "logType": "SYMANTEC_SA", + "productEventType": "Policy Violation", + "productLogId": "seq-sev-med", + "productName": "Security Analytics Platform", + "productVersion": "8.2.1", + "vendorName": "Symantec Corporation" + }, + "principal": { + "asset": { + "ip": [ + "2.2.2.2" + ], + "mac": [ + "11:22:33:aa:bb:dd" + ] + }, + "ip": [ + "2.2.2.2" + ], + "mac": [ + "11:22:33:aa:bb:dd" + ], + "port": 12346 + }, + "securityResult": [ + { + "description": "Policy Violation Detected", + "ruleId": "EVT-1003", + "severity": "MEDIUM", + "severityDetails": "5", + "summary": "Policy Warning" + } + ], + "target": { + "asset": { + "ip": [ + "2.2.2.1" + ], + "mac": [ + "aa:bb:cc:11:22:44" + ] + }, + "ip": [ + "2.2.2.1" + ], + "mac": [ + "aa:bb:cc:11:22:44" + ], + "port": 8080 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-05-20T10:05:30Z", + "idm": { + "readOnlyUdm": { + "additional": { + "start_time": "1716199500000" + }, + "intermediary": [ + { + "asset": { + "hostname": "host-cef-crit.corp.internal" + }, + "hostname": "host-cef-crit.corp.internal" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "Ransomware Activity", + "eventTimestamp": "2024-05-20T10:05:30Z", + "eventType": "NETWORK_CONNECTION", + "logType": "SYMANTEC_SA", + "productEventType": "Critical Ransomware Alert", + "productLogId": "seq-sev-crit", + "productName": "Security Analytics Platform", + "productVersion": "8.2.1", + "vendorName": "Symantec Corporation" + }, + "principal": { + "asset": { + "ip": [ + "2.2.2.4" + ], + "mac": [ + "11:22:33:aa:bb:ee" + ] + }, + "ip": [ + "2.2.2.4" + ], + "mac": [ + "11:22:33:aa:bb:ee" + ], + "port": 12347 + }, + "securityResult": [ + { + "description": "Ransomware Encryption Activity", + "ruleId": "EVT-1004", + "severity": "CRITICAL", + "severityDetails": "10", + "summary": "Ransomware Detected" + } + ], + "target": { + "asset": { + "ip": [ + "2.2.2.3" + ], + "mac": [ + "aa:bb:cc:11:22:55" + ] + }, + "ip": [ + "2.2.2.3" + ], + "mac": [ + "aa:bb:cc:11:22:55" + ], + "port": 445 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-05-20T10:05:30Z", + "idm": { + "readOnlyUdm": { + "additional": { + "start_time": "1716199500000" + }, + "intermediary": [ + { + "asset": { + "hostname": "host-cef-unk.corp.internal" + }, + "hostname": "host-cef-unk.corp.internal" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "Custom Event Logged", + "eventTimestamp": "2024-05-20T10:05:30Z", + "eventType": "NETWORK_CONNECTION", + "logType": "SYMANTEC_SA", + "productEventType": "Custom Event", + "productLogId": "seq-sev-unk", + "productName": "Security Analytics Platform", + "productVersion": "8.2.1", + "vendorName": "Symantec Corporation" + }, + "principal": { + "asset": { + "ip": [ + "2.2.2.6" + ], + "mac": [ + "11:22:33:aa:bb:ff" + ] + }, + "ip": [ + "2.2.2.6" + ], + "mac": [ + "11:22:33:aa:bb:ff" + ], + "port": 12348 + }, + "securityResult": [ + { + "description": "Custom Event Details", + "ruleId": "EVT-1005", + "severityDetails": "99", + "summary": "Custom Alert" + } + ], + "target": { + "asset": { + "ip": [ + "2.2.2.5" + ], + "mac": [ + "aa:bb:cc:11:22:66" + ] + }, + "ip": [ + "2.2.2.5" + ], + "mac": [ + "aa:bb:cc:11:22:66" + ], + "port": 22 + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "SYMANTEC_SA", + "productName": "Security Analytics Platform", + "vendorName": "Symantec Corporation" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "intermediary": [ + { + "asset": { + "hostname": "host-min.corp.internal" + }, + "hostname": "host-min.corp.internal" + } + ], + "metadata": { + "collectedTimestamp": "2024-05-20T10:15:30Z", + "description": "empty check minimal event", + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "GENERIC_EVENT", + "logType": "SYMANTEC_SA", + "productLogId": "seq-empty-012", + "productName": "Security Analytics Platform", + "vendorName": "Symantec Corporation" + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..535fb967f5 --- /dev/null +++ b/content/parsers/third_party/community/SYMANTEC_SA_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,44 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "245 \u003c134\u003e1 2024-05-20T10:15:30Z sa-gateway-01.example.corp analyzer 1001 - [meta sequenceId=seq-sink-001] snlog: sn=00:11:22:33:44:55 id=dev-res-100 m=1 c=2 event=threat_detected category=malware ip=1.1.1.1 model=SA-Sensor-S500 msg=logmsg=Threat connection blocked,query_id=qid-12345,action_name=block,path=/etc/security/payload.exe,elapsed_time=45ms,remote_ip=1.1.1.2,user=dummy_user_01" + }, + { + "data": "350 \u003c134\u003e1 2024-05-20T10:15:30+00:00 sa-cef-01.example.corp cef-agent 5678 - [meta sequenceId=seq-cef-002] CEF:0|Symantec|Security Analytics|8.2.1|RULE-8888|High Severity Trojan Alert|7|cs4=Suspicious C2 beaconing activity cs5=Trojan.Generic.C2 dmac=aa:bb:cc:dd:ee:ff dpt=443 dst=1.1.1.3 end=1716199530000 msg=Encrypted TLS session to malicious endpoint smac=11:22:33:44:55:66 spt=54321 src=1.1.1.4 start=1716199500000" + }, + { + "data": "\u003c134\u003e1 2024-05-20T10:15:30.123456Z syslog-rel 1234 - - - 2024-05-20T10:15:30Z host3.corp.internal worker 5678 - [meta sequenceId=seq-pat3-003] snlog: sn=00:11:22:33:44:aa ip=1.1.1.5 user=dummy_user_02 remote_ip=1.1.1.6 msg=logmsg=audit session started,query_id=qid-303,action_name=allow,path=/var/log/audit.log,elapsed_time=15ms" + }, + { + "data": "\u003c134\u003e1 2024-05-20T10:15:30Z host-status.corp.internal sensor 2001 - [meta sequenceId=seq-status-004] snlog: sn=00:11:22:33:44:bb ip=1.1.1.7 msg=logmsg=sensor heartbeat status online" + }, + { + "data": "\u003c134\u003e1 2024-05-20T10:15:30Z host-user.corp.internal auth-service 2002 - [meta sequenceId=seq-user-005] snlog: user=dummy_user_admin msg=logmsg=administrative login successful" + }, + { + "data": "\u003c134\u003e1 2024-05-20T10:15:30Z host-generic.corp.internal sysmgr 2003 - [meta sequenceId=seq-generic-006] snlog: category=system_event msg=logmsg=system service rebooted" + }, + { + "data": "100 \u003c134\u003e1 2024-05-20T10:15:30Z host-cef-low.corp.internal cef-agent 1001 - [meta sequenceId=seq-sev-low] CEF:0|Symantec|Security Analytics|8.2.1|EVT-1002|Informational Scan|2|cs4=Routine Port Scan cs5=Port Scan Detected dmac=aa:bb:cc:11:22:33 dpt=80 dst=1.1.1.8 end=1716199530000 msg=Routine network scan smac=11:22:33:aa:bb:cc spt=12345 src=1.1.1.9 start=1716199500000" + }, + { + "data": "100 \u003c134\u003e1 2024-05-20T10:15:30Z host-cef-med.corp.internal cef-agent 1002 - [meta sequenceId=seq-sev-med] CEF:0|Symantec|Security Analytics|8.2.1|EVT-1003|Policy Violation|5|cs4=Policy Violation Detected cs5=Policy Warning dmac=aa:bb:cc:11:22:44 dpt=8080 dst=2.2.2.1 end=1716199530000 msg=Policy Violation smac=11:22:33:aa:bb:dd spt=12346 src=2.2.2.2 start=1716199500000" + }, + { + "data": "100 \u003c134\u003e1 2024-05-20T10:15:30Z host-cef-crit.corp.internal cef-agent 1003 - [meta sequenceId=seq-sev-crit] CEF:0|Symantec|Security Analytics|8.2.1|EVT-1004|Critical Ransomware Alert|10|cs4=Ransomware Encryption Activity cs5=Ransomware Detected dmac=aa:bb:cc:11:22:55 dpt=445 dst=2.2.2.3 end=1716199530000 msg=Ransomware Activity smac=11:22:33:aa:bb:ee spt=12347 src=2.2.2.4 start=1716199500000" + }, + { + "data": "100 \u003c134\u003e1 2024-05-20T10:15:30Z host-cef-unk.corp.internal cef-agent 1004 - [meta sequenceId=seq-sev-unk] CEF:0|Symantec|Security Analytics|8.2.1|EVT-1005|Custom Event|99|cs4=Custom Event Details cs5=Custom Alert dmac=aa:bb:cc:11:22:66 dpt=22 dst=2.2.2.5 end=1716199530000 msg=Custom Event Logged smac=11:22:33:aa:bb:ff spt=12348 src=2.2.2.6 start=1716199500000" + }, + { + "data": "\u003c134\u003e1 2024-99-99T99:99:99Z host-err.corp.internal app 1234 - [meta sequenceId=seq-err-011] snlog: ip=invalid_ip_addr remote_ip=invalid_remote_ip msg=logmsg=invalid grok ip test" + }, + { + "data": "\u003c134\u003e1 2024-05-20T10:15:30Z host-min.corp.internal app 1234 - [meta sequenceId=seq-empty-012] snlog: msg=logmsg=empty check minimal event" + } + ], + "type": "SYMANTEC_SA" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/metadata.json b/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/metadata.json index d74610d89a..2b06346420 100644 --- a/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/metadata.json @@ -5,5 +5,5 @@ "supported_format": "JSON", "category": "Tanium Specific", "references": "https://www.tanium.com/products/tanium-integrity-monitor/", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..2c9b7bdcf0 --- /dev/null +++ b/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,332 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T04:20:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "Count": "3", + "Watchlists": "Critical_System_Files" + }, + "metadata": { + "eventTimestamp": "2024-10-12T04:20:00Z", + "eventType": "FILE_MODIFICATION", + "logType": "TANIUM_INTEGRITY_MONITOR", + "productName": "Tanium Integrity Monitor", + "vendorName": "Tanium Integrity Monitor" + }, + "principal": { + "asset": { + "hostname": "masked-win-srv01.corp.dummy.com" + }, + "hostname": "masked-win-srv01.corp.dummy.com" + }, + "securityResult": [ + { + "about": { + "labels": [ + { + "key": "ID", + "value": "1001" + }, + { + "key": "ID", + "value": "1002" + } + ] + }, + "categoryDetails": [ + "Write", + "Modify" + ] + } + ], + "target": { + "file": { + "fullPath": "C:\\Windows\\System32\\drivers\\etc\\hosts" + }, + "process": { + "file": { + "fullPath": "C:\\Windows\\System32\\notepad.exe" + } + }, + "resource": { + "attribute": { + "labels": [ + { + "key": "Sha256", + "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + { + "key": "Sha256", + "value": "ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb" + } + ] + } + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "additional": { + "Count": "1", + "Event_Time": "invalid-event-date", + "Hashed_At": "invalid-hashed-date", + "Watchlists": "Compliance_Watchlist" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "FILE_MODIFICATION", + "logType": "TANIUM_INTEGRITY_MONITOR", + "productName": "Tanium Integrity Monitor", + "vendorName": "Tanium Integrity Monitor" + }, + "principal": { + "asset": { + "hostname": "masked-workstation02.corp.dummy.com" + }, + "hostname": "masked-workstation02.corp.dummy.com" + }, + "securityResult": [ + { + "about": { + "labels": [ + { + "key": "ID", + "value": "5555" + } + ] + }, + "categoryDetails": [ + "Write" + ] + } + ], + "target": { + "file": { + "fullPath": "C:\\Program Files\\app\\config.ini", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + "process": { + "file": { + "fullPath": "C:\\Windows\\explorer.exe" + } + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "STATUS_UPDATE", + "logType": "TANIUM_INTEGRITY_MONITOR", + "productName": "Tanium Integrity Monitor", + "vendorName": "Tanium Integrity Monitor" + }, + "principal": { + "asset": { + "hostname": "masked-anchor-host.corp.dummy.com" + }, + "hostname": "masked-anchor-host.corp.dummy.com" + }, + "securityResult": [ + { + "categoryDetails": [ + "Audit_Read" + ] + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "Count": "10", + "Watchlists": "Linux_Binaries" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "GENERIC_EVENT", + "logType": "TANIUM_INTEGRITY_MONITOR", + "productName": "Tanium Integrity Monitor", + "vendorName": "Tanium Integrity Monitor" + }, + "securityResult": [ + { + "categoryDetails": [ + "Execute" + ] + } + ], + "target": { + "file": { + "fullPath": "/usr/local/bin/dummy_agent" + }, + "process": { + "file": { + "fullPath": "/usr/bin/python3" + } + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T12:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "Count": "2", + "Watchlists": "Network_Configs" + }, + "metadata": { + "eventTimestamp": "2024-10-12T12:00:00Z", + "eventType": "FILE_MODIFICATION", + "logType": "TANIUM_INTEGRITY_MONITOR", + "productName": "Tanium Integrity Monitor", + "vendorName": "Tanium Integrity Monitor" + }, + "principal": { + "asset": { + "hostname": "masked-sync-host01.corp.dummy.com" + }, + "hostname": "masked-sync-host01.corp.dummy.com" + }, + "securityResult": [ + { + "categoryDetails": [ + "Write" + ] + } + ], + "target": { + "file": { + "fullPath": "C:\\Windows\\System32\\drivers\\etc\\networks" + }, + "process": { + "file": { + "fullPath": "C:\\Windows\\System32\\cmd.exe" + } + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T14:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "Count": "1", + "Watchlists": "Database_Watchlist" + }, + "metadata": { + "eventTimestamp": "2024-10-12T14:00:00Z", + "eventType": "STATUS_UPDATE", + "logType": "TANIUM_INTEGRITY_MONITOR", + "productName": "Tanium Integrity Monitor", + "vendorName": "Tanium Integrity Monitor" + }, + "principal": { + "asset": { + "hostname": "masked-db-srv01.corp.dummy.com" + }, + "hostname": "masked-db-srv01.corp.dummy.com" + }, + "securityResult": [ + { + "about": { + "labels": [ + { + "key": "ID", + "value": "9001" + } + ] + }, + "categoryDetails": [ + "Create" + ] + } + ], + "target": { + "file": { + "fullPath": "D:\\data\\dummy_db_backup.bak" + }, + "process": { + "file": { + "fullPath": "D:\\db\\engine.exe" + } + }, + "resource": { + "attribute": { + "labels": [ + { + "key": "Sha256", + "value": "b4c679b392b4fa264168715491f044439c2f068e285a6a241416e7f9f740a1ef" + } + ] + } + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T15:30:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T15:30:00Z", + "eventType": "FILE_MODIFICATION", + "logType": "TANIUM_INTEGRITY_MONITOR", + "productName": "Tanium Integrity Monitor", + "vendorName": "Tanium Integrity Monitor" + }, + "principal": { + "asset": { + "hostname": "masked-hashed-host.corp.dummy.com" + }, + "hostname": "masked-hashed-host.corp.dummy.com" + }, + "securityResult": [ + { + "categoryDetails": [ + "Write" + ] + } + ], + "target": { + "file": { + "fullPath": "C:\\Windows\\temp\\dummy_cache.tmp" + } + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..a2f2738dae --- /dev/null +++ b/content/parsers/third_party/community/TANIUM_INTEGRITY_MONITOR_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,29 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"Computer Name\": \"masked-win-srv01.corp.dummy.com\", \"Process Path\": \"C:\\\\Windows\\\\System32\\\\notepad.exe\", \"File Path\": \"C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\hosts\", \"Change Type\": [\"Write\", \"Modify\"], \"User\": \"dummy_user_01\", \"Detail\": \"File write operation detected by integrity monitor\", \"Hash\": [\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\", \"ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb\"], \"Count\": \"3\", \"Hashed At\": \"2024-10-12 04:15:00\", \"Event_Time\": \"2024-10-12 04:20:00\", \"Watchlists\": \"Critical_System_Files\", \"ID\": [\"1001\", \"1002\"]}" + }, + { + "data": "{\"Computer_Name\": \"masked-workstation02.corp.dummy.com\", \"Process_Path\": \"C:\\\\Windows\\\\explorer.exe\", \"File_Path\": \"C:\\\\Program Files\\\\app\\\\config.ini\", \"Change_Type\": \"Write\", \"User\": \"dummy_service_acc\", \"Detail\": \"Write configuration settings\", \"Hash\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\", \"Count\": \"1\", \"Hashed_At\": \"invalid-hashed-date\", \"Event_Time\": \"invalid-event-date\", \"Watchlists\": \"Compliance_Watchlist\", \"ID\": \"5555\"}" + }, + { + "data": "{\"Computer_Name\": \"masked-anchor-host.corp.dummy.com\", \"File_Path\": \"\", \"Process_Path\": \"\", \"Change_Type\": \"Audit_Read\", \"User\": \"\", \"Detail\": \"\", \"Hash\": \"\", \"Count\": \"\", \"Hashed_At\": \"\", \"Event_Time\": \"\", \"Watchlists\": \"\", \"ID\": \"\"}" + }, + { + "data": "{\"File_Path\": \"/usr/local/bin/dummy_agent\", \"Process_Path\": \"/usr/bin/python3\", \"Change_Type\": \"Execute\", \"Count\": \"10\", \"Event_Time\": \"2024-10-12 10:00:00\", \"Watchlists\": \"Linux_Binaries\"}" + }, + { + "data": "{\"Computer_Name\": \"masked-sync-host01.corp.dummy.com\", \"File_Path\": \"C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\networks\", \"Process_Path\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\", \"Change_Type\": \"Write\", \"Hashed_At\": \"2024-10-12 12:00:00\", \"Event_Time\": \"2024-10-12 12:00:00\", \"Watchlists\": \"Network_Configs\", \"Count\": \"2\"}" + }, + { + "data": "{\"Computer_Name\": \"masked-db-srv01.corp.dummy.com\", \"File_Path\": \"D:\\\\data\\\\dummy_db_backup.bak\", \"Process_Path\": \"D:\\\\db\\\\engine.exe\", \"Change_Type\": \"Create\", \"Detail\": \"Database backup file creation\", \"Hash\": [\"b4c679b392b4fa264168715491f044439c2f068e285a6a241416e7f9f740a1ef\"], \"ID\": [\"9001\"], \"Event_Time\": \"2024-10-12 14:00:00\", \"Watchlists\": \"Database_Watchlist\", \"Count\": \"1\"}" + }, + { + "data": "{\"Computer_Name\": \"masked-hashed-host.corp.dummy.com\", \"File_Path\": \"C:\\\\Windows\\\\temp\\\\dummy_cache.tmp\", \"Change_Type\": \"Write\", \"Hashed_At\": \"2024-10-12 15:30:00\", \"Event_Time\": \"\"}" + } + ], + "type": "TANIUM_INTEGRITY_MONITOR" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/metadata.json b/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/metadata.json index abeb465303..213aeb7506 100644 --- a/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/metadata.json @@ -5,5 +5,5 @@ "supported_format": "JSON", "category": "Tanium Specific", "references": "https://docs.tanium.com/integration/integration/Tanium_Chronicle_Integration_Guide.pdf", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..88fb0222dc --- /dev/null +++ b/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,230 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "SCAN_HOST", + "logType": "TANIUM_PATCH", + "productName": "Patch", + "vendorName": "Tanium" + }, + "principal": { + "asset": { + "hostname": "dummy_host_01.corp.internal", + "platformSoftware": { + "platform": "WINDOWS" + }, + "vulnerabilities": [ + { + "cveId": "CVE-2021-44228", + "name": "Vulnerability Patch KB5001234", + "severity": "HIGH", + "severityDetails": "Critical", + "vendor": "Tanium", + "vendorKnowledgeBaseArticleId": "KB5001234", + "vendorVulnerabilityId": "MS21-001" + }, + { + "cveId": "CVE-2021-34527", + "name": "Security Update KB5005678", + "severity": "MEDIUM", + "severityDetails": "Important", + "vendor": "Tanium", + "vendorKnowledgeBaseArticleId": "KB5005678", + "vendorVulnerabilityId": "MS21-002" + } + ] + }, + "hostname": "dummy_host_01.corp.internal" + }, + "securityResult": [ + { + "category": [ + "DATA_AT_REST" + ], + "description": "Vulnerability Patch KB5001234", + "summary": "KB5001234" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "SCAN_HOST", + "logType": "TANIUM_PATCH", + "productName": "Patch", + "vendorName": "Tanium" + }, + "principal": { + "asset": { + "hostname": "dummy_host_error_02.corp.internal" + }, + "hostname": "dummy_host_error_02.corp.internal" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "SCAN_HOST", + "logType": "TANIUM_PATCH", + "productName": "Patch", + "vendorName": "Tanium" + }, + "principal": { + "asset": { + "hostname": "dummy_host_03.corp.internal", + "vulnerabilities": [ + { + "name": "Patch With None And Empty Fields", + "vendor": "Tanium" + }, + { + "name": "Patch With Unknown Severity", + "vendor": "Tanium" + } + ] + }, + "hostname": "dummy_host_03.corp.internal" + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "SCAN_HOST", + "logType": "TANIUM_PATCH", + "productName": "Patch", + "vendorName": "Tanium" + }, + "principal": { + "asset": { + "hostname": "dummy_linux_srv01.corp.internal", + "platformSoftware": { + "platform": "LINUX" + }, + "vulnerabilities": [ + { + "cveId": "CVE-2021-20224", + "name": "RHSA-2021:1234 Red Hat Security Advisory", + "severity": "MEDIUM", + "severityDetails": "Important", + "vendor": "Tanium", + "vendorKnowledgeBaseArticleId": "RHBA-2021-1234", + "vendorVulnerabilityId": "RHSA-2021:1234" + } + ] + }, + "hostname": "dummy_linux_srv01.corp.internal" + }, + "securityResult": [ + { + "category": [ + "DATA_AT_REST" + ], + "description": "RHSA-2021:1234 Red Hat Security Advisory", + "summary": "RHBA-2021-1234" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "SCAN_HOST", + "logType": "TANIUM_PATCH", + "productName": "Patch", + "vendorName": "Tanium" + }, + "principal": { + "asset": { + "hostname": "dummy_mac_client01.corp.internal", + "platformSoftware": { + "platform": "MAC" + }, + "vulnerabilities": [ + { + "cveId": "CVE-2021-30657", + "name": "macOS Security Update 2021-002", + "severity": "HIGH", + "severityDetails": "Critical", + "vendor": "Tanium", + "vendorKnowledgeBaseArticleId": "HT212548", + "vendorVulnerabilityId": "APPLE-SA-2021-04-26-1" + } + ] + }, + "hostname": "dummy_mac_client01.corp.internal" + }, + "securityResult": [ + { + "category": [ + "DATA_AT_REST" + ], + "description": "macOS Security Update 2021-002", + "summary": "HT212548" + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00.123456789Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00.123456789Z", + "eventType": "SCAN_HOST", + "logType": "TANIUM_PATCH", + "productName": "Patch", + "vendorName": "Tanium" + }, + "principal": { + "asset": { + "hostname": "dummy_anchor_host.corp.internal", + "vulnerabilities": [ + { + "name": "Generic Vulnerability Definition", + "vendor": "Tanium" + } + ] + }, + "hostname": "dummy_anchor_host.corp.internal" + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..6d1f3e367a --- /dev/null +++ b/content/parsers/third_party/community/TANIUM_PATCH_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,26 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"Computer Name\": \"dummy_host_01.corp.internal\", \"OS Type\": \"0: Windows Server 2022\", \"Title\": [\"Vulnerability Patch KB5001234\", \"Security Update KB5005678\"], \"Install Status\": [\"Not Installed\", \"Installed\"], \"KB Articles\": [\"KB5001234\", \"KB5005678\"], \"Bulletins\": [\"MS21-001\", \"MS21-002\"], \"CVE IDs\": [\"CVE-2021-44228\", \"CVE-2021-34527\"], \"Severity\": [\"Critical\", \"Important\"]}" + }, + { + "data": "{\"Computer Name\": \"dummy_host_error_02.corp.internal\", \"OS Type\": {\"uncastable_obj\": \"test\"}, \"Title\": {\"uncastable\": 123}}" + }, + { + "data": "{\"Computer Name\": \"dummy_host_03.corp.internal\", \"OS Type\": \"0: BSD Unix\", \"Title\": [\"Patch With None And Empty Fields\", \"Patch With Unknown Severity\"], \"Install Status\": [\"Installed\", \"Installed\"], \"KB Articles\": [\"\", \"\"], \"Bulletins\": [\"None\", \"None\"], \"CVE IDs\": [\"None\", \"None\"], \"Severity\": [\"Low\", \"Moderate\"]}" + }, + { + "data": "{\"Computer Name\": \"dummy_linux_srv01.corp.internal\", \"OS Type\": \"0: Linux Enterprise 8\", \"Title\": [\"RHSA-2021:1234 Red Hat Security Advisory\"], \"Install Status\": [\"Needed\"], \"KB Articles\": [\"RHBA-2021-1234\"], \"Bulletins\": [\"RHSA-2021:1234\"], \"CVE IDs\": [\"CVE-2021-20224\"], \"Severity\": [\"Important\"]}" + }, + { + "data": "{\"Computer Name\": \"dummy_mac_client01.corp.internal\", \"OS Type\": \"0: Mac OS X 12.0\", \"Title\": [\"macOS Security Update 2021-002\"], \"Install Status\": [\"Missing\"], \"KB Articles\": [\"HT212548\"], \"Bulletins\": [\"APPLE-SA-2021-04-26-1\"], \"CVE IDs\": [\"CVE-2021-30657\"], \"Severity\": [\"Critical\"]}" + }, + { + "data": "{\"Computer Name\": \"dummy_anchor_host.corp.internal\", \"Title\": [\"Generic Vulnerability Definition\"]}" + } + ], + "type": "TANIUM_PATCH" + } +} \ No newline at end of file diff --git a/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/metadata.json b/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/metadata.json index 45e4603f29..b4a0ef56c0 100644 --- a/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/metadata.json +++ b/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/metadata.json @@ -4,5 +4,5 @@ "vendor": "VIRTRU", "supported_format": "JSON", "category": "EMAIL SERVER", - "run_internal_tests": true + "run_internal_tests": false } diff --git a/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/testdata/expected_events/default_events.json b/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/testdata/expected_events/default_events.json new file mode 100644 index 0000000000..439d35b27a --- /dev/null +++ b/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/testdata/expected_events/default_events.json @@ -0,0 +1,344 @@ +{ + "events": [ + { + "event": { + "timestamp": "2024-10-12T07:20:50.52Z", + "idm": { + "readOnlyUdm": { + "additional": { + "auditRecordId": "rec_audit_001", + "auditRecordType": "OUTBOUND_ENCRYPT", + "clientInfo_platform": "Windows 11", + "object_id": "dummy_obj_001", + "object_type": "encrypted_email", + "owner_orgId": "org_998877" + }, + "metadata": { + "description": "Executive Data Policy", + "eventTimestamp": "2024-10-12T07:20:50.520Z", + "eventType": "EMAIL_TRANSACTION", + "logType": "VIRTRU_EMAIL_ENCRYPTION", + "productEventType": "EMAIL_AUDIT", + "productLogId": "dummy_evt_id_001", + "productName": "virtru encrytion", + "vendorName": "virtru" + }, + "network": { + "email": { + "subject": [ + "Confidential Financial Report" + ], + "to": [ + "dummy_recipient_01@dummy.com", + "dummy_recipient_02@dummy.com" + ] + }, + "http": { + "parsedUserAgent": { + "annotation": [ + { + "key": "Chrome", + "value": "Chrome/1.1.1.3" + }, + { + "key": "SafariType", + "value": "Safari/537.36" + }, + { + "key": "OS_NAME", + "value": "Windows NT" + }, + { + "key": "OS_VERSION", + "value": "10.0" + }, + { + "key": "misc", + "value": "x64" + } + ], + "browser": "Chrome", + "browserEngineVersion": "537.36", + "browserType": "BROWSER_TYPE_CHROME", + "browserVariantType": "BROWSER_VARIANT_TYPE_UNKNOWN", + "browserVersion": "1.1.1.3", + "device": "x64", + "family": "APPLEWEBKIT", + "os": "Windows NT 10.0", + "osType": "OS_TYPE_WINDOWS", + "osVariant": "Win64", + "osVariantType": "OS_VARIANT_TYPE_UNKNOWN", + "platform": "Windows", + "subFamily": "AppleWebKit" + }, + "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.1.1.3 Safari/537.36" + } + }, + "principal": { + "asset": { + "hostname": "host01", + "ip": [ + "1.1.1.2" + ] + }, + "group": { + "emailAddresses": [ + "dummy_sender_group@dummy.com" + ] + }, + "hostname": "host01", + "ip": [ + "1.1.1.2" + ], + "process": { + "pid": "1234" + }, + "resource": { + "attribute": { + "labels": [ + { + "key": "department", + "value": "Finance" + } + ] + } + }, + "user": { + "emailAddresses": [ + "dummy_sender_01@dummy.com" + ], + "userDisplayName": "dummy_sender_01@dummy.com" + } + }, + "securityResult": [ + { + "detectionFields": [ + { + "key": "action_type", + "value": "ENCRYPT" + }, + { + "key": "action_result", + "value": "SUCCESS" + } + ] + } + ], + "src": { + "user": { + "userDisplayName": "dummy_owner_01" + } + }, + "target": { + "group": { + "emailAddresses": [ + "dummy_exec_group@dummy.com" + ] + }, + "resource": { + "attribute": { + "labels": [ + { + "key": "classification", + "value": "restricted" + } + ] + } + }, + "user": { + "emailAddresses": [ + "dummy_recipient_01@dummy.com", + "dummy_recipient_02@dummy.com" + ] + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T07:20:50.52Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T07:20:50.520Z", + "eventType": "STATUS_UPDATE", + "logType": "VIRTRU_EMAIL_ENCRYPTION", + "productLogId": "dummy_evt_id_003", + "productName": "virtru encrytion", + "vendorName": "virtru" + }, + "principal": { + "asset": { + "hostname": "mailserver02" + }, + "hostname": "mailserver02", + "user": { + "userDisplayName": "dummy_actor_non_email_003" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T08:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "auditRecordId": "rec_file_005", + "object_id": "dummy_file_obj_005", + "object_type": "encrypted_file" + }, + "metadata": { + "eventTimestamp": "2024-10-12T08:00:00Z", + "eventType": "FILE_UNCATEGORIZED", + "logType": "VIRTRU_EMAIL_ENCRYPTION", + "productEventType": "FILE_ENCRYPTION_EVENT", + "productLogId": "dummy_evt_id_file_005", + "productName": "virtru encrytion", + "vendorName": "virtru" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.4" + ] + }, + "ip": [ + "1.1.1.4" + ] + }, + "target": { + "file": { + "fullPath": "/corporate/confidential/q3_earnings_report.pdf" + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T09:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "auditRecordId": "rec_user_006", + "object_id": "dummy_user_obj_006", + "object_type": "user_identity" + }, + "metadata": { + "eventTimestamp": "2024-10-12T09:00:00Z", + "eventType": "USER_UNCATEGORIZED", + "logType": "VIRTRU_EMAIL_ENCRYPTION", + "productEventType": "USER_PROVISIONING_EVENT", + "productLogId": "dummy_evt_id_user_006", + "productName": "virtru encrytion", + "vendorName": "virtru" + }, + "principal": { + "user": { + "emailAddresses": [ + "dummy_target_user@dummy.com" + ] + } + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T10:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "object_id": "dummy_policy_007", + "object_type": "policy_config" + }, + "metadata": { + "eventTimestamp": "2024-10-12T10:00:00Z", + "eventType": "STATUS_UPDATE", + "logType": "VIRTRU_EMAIL_ENCRYPTION", + "productEventType": "SYSTEM_POLICY_AUDIT", + "productLogId": "dummy_evt_id_status_007", + "productName": "virtru encrytion", + "vendorName": "virtru" + }, + "principal": { + "asset": { + "ip": [ + "1.1.1.5" + ] + }, + "ip": [ + "1.1.1.5" + ] + } + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T11:00:00Z", + "idm": { + "readOnlyUdm": { + "additional": { + "owner_orgId": "org_generic_888" + }, + "metadata": { + "eventTimestamp": "2024-10-12T11:00:00Z", + "eventType": "GENERIC_EVENT", + "logType": "VIRTRU_EMAIL_ENCRYPTION", + "productEventType": "OTHER_MISC_EVENT", + "productLogId": "dummy_evt_id_generic_008", + "productName": "virtru encrytion", + "vendorName": "virtru" + }, + "principal": { + "user": { + "userDisplayName": "dummy_actor_uid_888" + } + }, + "securityResult": [ + { + "detectionFields": [ + { + "key": "action_type", + "value": "REVOKE_ACCESS" + }, + { + "key": "action_result", + "value": "DENIED" + } + ] + } + ] + } + } + } + }, + { + "event": { + "timestamp": "2024-10-12T12:00:00Z", + "idm": { + "readOnlyUdm": { + "metadata": { + "eventTimestamp": "2024-10-12T12:00:00Z", + "eventType": "GENERIC_EVENT", + "logType": "VIRTRU_EMAIL_ENCRYPTION", + "productEventType": "CUSTOM_METRICS_AUDIT", + "productLogId": "dummy_evt_id_batch_009", + "productName": "virtru encrytion", + "vendorName": "virtru" + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/testdata/raw_logs/default_log.json b/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/testdata/raw_logs/default_log.json new file mode 100644 index 0000000000..97cc535570 --- /dev/null +++ b/content/parsers/third_party/community/VIRTRU_EMAIL_ENCRYPTION_GUS/cbn/testdata/raw_logs/default_log.json @@ -0,0 +1,29 @@ +{ + "create_time": "2024-10-12T10:00:00.123456789Z", + "raw_logs": { + "entries": [ + { + "data": "{\"id\":\"dummy_evt_id_001\",\"timestamp\":\"2024-10-12T07:20:50.520Z\",\"log\":\"Oct 12 07:20:50 host01 virtru_app[1234]: Virtru encryption event prin_ip 1.1.1.1 processed successfully\",\"object\":{\"type\":\"encrypted_email\",\"id\":\"dummy_obj_001\",\"name\":\"Confidential Financial Report\",\"attributes\":{\"dissem\":[\"dummy_recipient_01@dummy.com\",\"dummy_recipient_02@dummy.com\"],\"attrs\":[{\"key\":\"virtru:data:policy:type\",\"value\":\"Executive Data Policy\"},{\"key\":\"virtru:data:owner\",\"value\":\"dummy_owner_01\"},{\"key\":\"virtru:data:org:1e148cd2-139d-4d27-9891-98f7275550a2:group\",\"value\":\"dummy_exec_group@dummy.com\"},{\"key\":\"classification\",\"value\":\"restricted\"}]}},\"action\":{\"type\":\"ENCRYPT\",\"result\":\"SUCCESS\"},\"owner\":{\"id\":\"dummy_owner_id_001\",\"orgId\":\"org_998877\"},\"actor\":{\"id\":\"dummy_sender_01@dummy.com\",\"attributes\":{\"attributes\":[{\"key\":\"virtru:user:access:org:1e148cd2-139d-4d27-9891-98f7275550a2:group\",\"value\":\"dummy_sender_group@dummy.com\"},{\"key\":\"department\",\"value\":\"Finance\"}]}},\"clientInfo\":{\"requestIp\":\"1.1.1.2\",\"platform\":\"Windows 11\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.1.1.3 Safari/537.36\"},\"eventMetaData\":{\"auditDataType\":\"EMAIL_AUDIT\",\"auditRecordId\":\"rec_audit_001\",\"auditRecordType\":\"OUTBOUND_ENCRYPT\"}}" + }, + { + "data": "{\"id\":\"dummy_evt_id_003\",\"timestamp\":\"2024-10-12T07:20:50.52Z\",\"log\":\"2024-10-12T07:20:00Z tag_service: mailserver02 Message-ID:\u003cdummy_msg_id_101@test.com\u003e\",\"object\":{\"type\":\"\",\"id\":\"\",\"name\":\"\",\"attributes\":{\"dissem\":[\"not_an_email_address\",\"another_non_email\"],\"attrs\":[]}},\"action\":{\"type\":\"\",\"result\":\"\"},\"owner\":{\"id\":\"\",\"orgId\":\"\"},\"actor\":{\"id\":\"dummy_actor_non_email_003\",\"attributes\":{\"attributes\":[]}},\"clientInfo\":{\"requestIp\":\"\",\"platform\":\"\",\"userAgent\":\"\"},\"eventMetaData\":{\"auditDataType\":\"\",\"auditRecordId\":\"\",\"auditRecordType\":\"\"}}" + }, + { + "data": "{\"id\":\"dummy_evt_id_file_005\",\"timestamp\":\"2024-10-12T08:00:00.000Z\",\"clientInfo\":{\"requestIp\":\"1.1.1.4\"},\"object\":{\"type\":\"encrypted_file\",\"id\":\"dummy_file_obj_005\",\"name\":\"/corporate/confidential/q3_earnings_report.pdf\"},\"eventMetaData\":{\"auditDataType\":\"FILE_ENCRYPTION_EVENT\",\"auditRecordId\":\"rec_file_005\"}}" + }, + { + "data": "{\"id\":\"dummy_evt_id_user_006\",\"timestamp\":\"2024-10-12T09:00:00.000Z\",\"object\":{\"type\":\"user_identity\",\"id\":\"dummy_user_obj_006\",\"name\":\"dummy_target_user@dummy.com\"},\"eventMetaData\":{\"auditDataType\":\"USER_PROVISIONING_EVENT\",\"auditRecordId\":\"rec_user_006\"}}" + }, + { + "data": "{\"id\":\"dummy_evt_id_status_007\",\"timestamp\":\"2024-10-12T10:00:00.000Z\",\"clientInfo\":{\"requestIp\":\"1.1.1.5\"},\"object\":{\"type\":\"policy_config\",\"id\":\"dummy_policy_007\",\"name\":\"Policy Rule 42\"},\"eventMetaData\":{\"auditDataType\":\"SYSTEM_POLICY_AUDIT\"}}" + }, + { + "data": "{\"id\":\"dummy_evt_id_generic_008\",\"timestamp\":\"2024-10-12T11:00:00.000Z\",\"action\":{\"type\":\"REVOKE_ACCESS\",\"result\":\"DENIED\"},\"owner\":{\"id\":\"dummy_owner_008\",\"orgId\":\"org_generic_888\"},\"actor\":{\"id\":\"dummy_actor_uid_888\"},\"eventMetaData\":{\"auditDataType\":\"OTHER_MISC_EVENT\"}}" + }, + { + "data": "{\"id\":\"dummy_evt_id_batch_009\",\"timestamp\":\"2024-10-12T12:00:00.000Z\",\"object\":{\"name\":\"unmatched_datatype_resource_name\"},\"eventMetaData\":{\"auditDataType\":\"CUSTOM_METRICS_AUDIT\"}}" + } + ], + "type": "VIRTRU_EMAIL_ENCRYPTION" + } +} \ No newline at end of file