Windows Sysmon Event ID 3 ASIM Parser #6888
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
oshezaf
requested changes
Dec 13, 2022
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
added 22 commits
December 13, 2022 13:11
oshezaf
requested changes
Jan 4, 2023
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
| let NetworkEvents = | ||
| Sysmon3_NetworkEvent | ||
| | where Source == "Microsoft-Windows-Sysmon" and EventID==3 // we want to ensure we only have the Event table and not the WindowsEvent table | ||
| | invoke EventParser () |
There was a problem hiding this comment.
No need to change, but there is no real reason for using a parser as a function in this case. You use it only once.
oshezaf
requested changes
Jan 4, 2023
Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
Parsers/ASimNetworkSession/Parsers/vimNetworkSessionMicrosoftSysmon.yaml
Outdated
Show resolved
Hide resolved
| SourcePort:int, | ||
| DestinationIsIpv6:bool, | ||
| DestinationPort:int, | ||
| DestinationHostname:string, |
There was a problem hiding this comment.
Still parsed twice. Not the only one.
| DstIpAddr = DestinationIp, | ||
| SrcHostname = SourceHostname, | ||
| DstHostname = DestinationHostname | ||
| | where |
There was a problem hiding this comment.
This condition is not needed. Prefiltering above, and post-filtering later on.
added 19 commits
January 4, 2023 13:37
|
Hi @goosvorbook, update your branch from master and push it again. Thanks |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Required items, please complete
Change(s):
Added Sysmon Event ID 3
Reason for Change(s):
Event ID 3 parser was not yet available