[ASIM] CrowdStrike Falcon AlertEvent Parser#14488
Conversation
SpeedyFireCyclone
force-pushed
the
bluevoyant/ASIM/AlertEventCrowdStrikeFalcon
branch
3 times, most recently
from
9fd9942 to
43bb94a
Compare
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds ASIM AlertEvent normalization support for CrowdStrike Falcon (via Codeless Connector Framework) and wires it into the existing ASIM AlertEvent “wrapper” parsers and deployment artifacts.
Changes:
- Added new CrowdStrike Falcon AlertEvent parsers (
vim*andASim*) and their ARM templates/README/changelogs. - Registered the new parsers in the
imAlertEventandASimAlertEventaggregation parsers (and ARM equivalents). - Updated full deployment ARM template to include linked deployments for the new functions.
Reviewed changes
Copilot reviewed 15 out of 16 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| Parsers/ASimAlertEvent/Parsers/vimAlertEventCrowdStrikeFalcon.yaml | New parameterized vim AlertEvent parser for CrowdStrike Falcon with filtering and packing support. |
| Parsers/ASimAlertEvent/Parsers/ASimAlertEventCrowdStrikeFalcon.yaml | New ASim AlertEvent parser for CrowdStrike Falcon (non-filtering wrapper variant). |
| Parsers/ASimAlertEvent/Parsers/imAlertEvent.yaml | Registers the new vimAlertEventCrowdStrikeFalcon in the filtering union parser and bumps version. |
| Parsers/ASimAlertEvent/Parsers/ASimAlertEvent.yaml | Registers the new ASimAlertEventCrowdStrikeFalcon in the union parser and bumps version. |
| Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventCrowdStrikeFalcon.md | New changelog entry for the vim parser. |
| Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventCrowdStrikeFalcon.md | New changelog entry for the ASim parser. |
| Parsers/ASimAlertEvent/CHANGELOG/imAlertEvent.md | Changelog entry for adding CrowdStrike to the wrapper parser. |
| Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEvent.md | Changelog entry for adding CrowdStrike to the wrapper parser. |
| Parsers/ASimAlertEvent/ARM/vimAlertEventCrowdStrikeFalcon/vimAlertEventCrowdStrikeFalcon.json | ARM deployment for the new vim function. |
| Parsers/ASimAlertEvent/ARM/vimAlertEventCrowdStrikeFalcon/README.md | Deployment README for the new vim function. |
| Parsers/ASimAlertEvent/ARM/ASimAlertEventCrowdStrikeFalcon/ASimAlertEventCrowdStrikeFalcon.json | ARM deployment for the new ASim function. |
| Parsers/ASimAlertEvent/ARM/ASimAlertEventCrowdStrikeFalcon/README.md | Deployment README for the new ASim function. |
| Parsers/ASimAlertEvent/ARM/imAlertEvent/imAlertEvent.json | Updates wrapper ARM function query to include CrowdStrike. |
| Parsers/ASimAlertEvent/ARM/ASimAlertEvent/ASimAlertEvent.json | Updates wrapper ARM function query to include CrowdStrike. |
| Parsers/ASimAlertEvent/ARM/FullDeploymentAlertEvent.json | Adds linked deployments for the new CrowdStrike functions. |
| AttackTactics = iif(TacticId startswith_cs "TA", Tactic, ""), | ||
| AttackTechniques = iif(TechniqueId startswith_cs "T", strcat(Technique, " (", TechniqueId, ")"), ""), |
There was a problem hiding this comment.
This is the current preferred format for the AttackTactics column: https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-alert#:~:text=Targeted-,AttackTactics
| | where ((array_length(username_has_any) == 0) or Username has_any (username_has_any)) | ||
| | where ((array_length(attacktactics_has_any) == 0) or AttackTactics has_any (attacktactics_has_any)) | ||
| | where ((array_length(attacktechniques_has_any) == 0) or AttackTechniques has_any (attacktechniques_has_any)) |
There was a problem hiding this comment.
This is the current preferred format for the AttackTactics column: https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-alert#:~:text=Targeted-,AttackTactics
SpeedyFireCyclone
force-pushed
the
bluevoyant/ASIM/AlertEventCrowdStrikeFalcon
branch
2 times, most recently
from
acaf981 to
81554e2
Compare
SpeedyFireCyclone
force-pushed
the
bluevoyant/ASIM/AlertEventCrowdStrikeFalcon
branch
from
81554e2 to
634e1db
Compare
|
It looks like Copilot is nagging a lot. |
yummyblabla
added
the
SafeToRun
|
Missing Dvc field, can be alias from DvcIpAddr |
| FilePath = Filepath, | ||
| FileSHA1 = Sha1, | ||
| FileSHA256 = Sha256 | ||
| | where ((array_length(username_has_any) == 0) or Username has_any (username_has_any)) |
There was a problem hiding this comment.
Something to consider:
| where (array_length(username_has_any) == 0) or UserPrincipal has_any (username_has_any) or UserName has_any (username_has_any)
at the beginning of the parser where the filters are
Change(s):