{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "location": { "type": "string", "minLength": 1, "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" } }, "workspace-location": { "type": "string", "defaultValue": "", "metadata": { "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" } }, "subscription": { "defaultValue": "[last(split(subscription().id, '/'))]", "type": "string", "metadata": { "description": "subscription id where Microsoft Sentinel is setup" } }, "resourceGroupName": { "defaultValue": "[resourceGroup().name]", "type": "string", "metadata": { "description": "resource group name where Microsoft Sentinel is setup" } }, "workspace": { "defaultValue": "", "type": "string", "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } } }, "variables": { "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_solutionName": "VMWare", "_solutionVersion": "1.0.0", "_solutionAuthor": "Microsoft", "_packageIcon": "icon icon icon icon", "_solutionId": "azuresentinel.azure-sentinel-solution-azuresentinel.azure-sentinel-Test-CarbonBlack", "dataConnectorVersionConnectorDefinition": "1.0.0", "dataConnectorVersionConnections": "1.0.0", "_solutionTier": "Community", "_dataConnectorContentIdConnectorDefinition": "CarbonBlackTemplateConnectorDefinition", "dataConnectorTemplateNameConnectorDefinition": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition')))]", "_dataConnectorContentIdConnections": "CarbonBlackTemplateConnections", "dataConnectorTemplateNameConnections": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections')))]", "_logAnalyticsTableId1": "CarbonBlack_Alerts_CL", "_logAnalyticsTableId2": "CarbonBlack_Watchlist_CL" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition'), variables('dataConnectorVersionConnectorDefinition'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnectorDefinition'))]", "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersionConnectorDefinition')]", "parameters": { }, "variables": { }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersionConnectorDefinition')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorVersionConnections')]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector" } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "carbonBlackAWSS3", "title": "VMware Carbon Black Cloud via AWS S3", "publisher": "Microsoft", "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", "graphQueriesTableName": "CarbonBlack_Alerts_CL", "graphQueries": [ { "metricName": "CarbonBlack_Alerts_CL", "legend": "Alerts", "baseQuery": "CarbonBlack_Alerts_CL" }, { "metricName": "CarbonBlack_Watchlist_CL", "legend": "Watchlist", "baseQuery": "CarbonBlack_Watchlist_CL" }, { "metricName": "ASimNetworkSessionLogs", "legend": "ASimNetworkSessionLogs", "baseQuery": "ASimNetworkSessionLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' " }, { "metricName": "ASimProcessEventLogs", "legend": "ASimProcessEventLogs", "baseQuery": "ASimProcessEventLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' " }, { "metricName": "ASimFileEventLogs", "legend": "ASimFileEventLogs", "baseQuery": "ASimFileEventLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' " }, { "metricName": "ASimRegistryEventLogs", "legend": "ASimRegistryEventLogs", "baseQuery": "ASimRegistryEventLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' " }, { "metricName": "ASimAuthenticationEventLogs", "legend": "Auth", "baseQuery": "ASimAuthenticationEventLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare'" } ], "sampleQueries": [ ], "dataTypes": [ { "name": "CarbonBlack_Alerts_CL", "lastDataReceivedQuery": "CarbonBlack_Alerts_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" }, { "name": "CarbonBlack_Watchlist_CL", "lastDataReceivedQuery": "CarbonBlack_Watchlist_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" }, { "name": "ASimNetworkSessionLogs", "lastDataReceivedQuery": "union ASimNetworkSessionLogs | where TimeGenerated > ago(12h) | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | summarize Time = max(TimeGenerated)| where isnotempty(Time)" }, { "name": "ASimProcessEventLogs", "lastDataReceivedQuery": "union ASimProcessEventLogs | where TimeGenerated > ago(12h) | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | summarize Time = max(TimeGenerated)| where isnotempty(Time)" }, { "name": "ASimFileEventLogs", "lastDataReceivedQuery": "union ASimFileEventLogs | where TimeGenerated > ago(12h) | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | summarize Time = max(TimeGenerated)| where isnotempty(Time)" }, { "name": "ASimAuthenticationEventLogs", "lastDataReceivedQuery": "ASimAuthenticationEventLogs\n | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" }, { "name": "ASimRegistryEventLogs", "lastDataReceivedQuery": "ASimRegistryEventLogs\n | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "write permission.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "delete": true } } ], "customs": [ { "name": "Environment", "description": "You must have the following AWS resources defined and configured: S3, Simple Queue Service (SQS), IAM roles and permissions policies" }, { "name": "Environment", "description": "You must have the a Carbon black account and required permissions to create a Data Forwarded to AWS S3 buckets. \nFor more details visit [Carbon Black Data Forwarder Docs](https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-E8D33F72-BABB-4157-A908-D8BBDB5AF349.html)" } ] }, "instructionSteps": [ { "instructions": [ { "type": "Markdown", "parameters": { "content": "#### 1. AWS CloudFormation Deployment \n To configure access on AWS, two templates has been generated to set up the AWS environment to send logs from S3 bucket to your Log Analytics Workspace.\n #### For each template, create Stack in AWS: \n 1. Go to [AWS CloudFormation Stacks](https://aka.ms/awsCloudFormationLink#/stacks/create) \n 2. In AWS, choose the 'Upload a template file' option and click on 'Choose file'. Select the downloaded template \n 3. Click 'Next' and 'Create stack'" } }, { "type": "CopyableLabel", "parameters": { "label": "Template 1: OpenID connect authentication deployment", "isMultiLine": true, "fillWith": [ "Oidc" ] } }, { "type": "CopyableLabel", "parameters": { "label": "Template 2: AWS Carbon Black resources deployment", "isMultiLine": true, "fillWith": [ "CarbonBlack" ] } }, { "type": "Markdown", "parameters": { "content": "When deploying 'Template 2: AWS Carbon Black resources deployment' template you'll need supply a few parameters \n * **Stack Name**: A stack name of your choosing (will appear in the list of stacks in AWS)\n * **Role Name**: Must begin with 'OIDC_' prefix, has a default value. \n * **Bucket Name**: Bucket name of your choosing, if you already have an existing bucket paste the name here \n * **CreateNewBucket**: If you already have an existing bucket that you would like to use for this connector select 'false' for this option, otherwise a bucket with the name you entered in 'Bucket Name' will be created from this stack. \n * **Region**: This is the region of the AWS resources based on Carbon Black's mapping - for more information please see [Carbon Black documentation](https://developer.carbonblack.com/reference/carbon-black-cloud/integrations/data-forwarder/quick-setup/#create-a-bucket).\n * **SQSQueuePrefix**: The stack create multiple queues, this prefix will be added to each one of them. \n * **WorkspaceID**: Use the Workspace ID provided below." } }, { "type": "CopyableLabel", "parameters": { "fillWith": [ "WorkspaceId" ], "label": "Workspace ID" } }, { "type": "Markdown", "parameters": { "content": "Once the deployment is complete - head to the 'Outputs' tab, you will see: Role ARN, S3 bucket and 4 SQS resources created. You will need those resources in the next step when configuring Carbon Black's data forwarders and the data connector." } }, { "type": "Markdown", "parameters": { "content": "#### 2. Carbon Black data forwarder configuration \n After all AWS resources has been created you'll need to configure Carbon Black to forward the events to the AWS buckets for Microsoft Sentinel to ingest them. Follow [Carbon Black's documentation on how to create a 'Data Forwarders'](https://developer.carbonblack.com/reference/carbon-black-cloud/integrations/data-forwarder/quick-setup/#2-create-a-forwarder) Use the first recommended option. When asked to input a bucket name use the bucket created in the previous step. \n You will be required to add 'S3 prefix' for each forwarder, please use this mapping:" } }, { "type": "Markdown", "parameters": { "content": " | Event type | S3 prefix | \n |-----------------|-----------|\n | Alert | carbon-black-cloud-forwarder/Alerts |\n | Auth Events | carbon-black-cloud-forwarder/Auth |\n | Endpoint Events | carbon-black-cloud-forwarder/Endpoint |\n | Watchlist Hit | carbon-black-cloud-forwarder/Watchlist |" } }, { "type": "Markdown", "parameters": { "content": "#### 2.1. Test your data forwarder (Optional) \n To validate the data forwarder is configured as expected, in Carbon Black's portal search for the data forwarder that you just created and click on 'Test Forwarder' button under the 'Actions' column, this will generate a 'HealthCheck' file in the S3 Bucket, you should see it appear immediately." } }, { "type": "Markdown", "parameters": { "content": "#### 3. Connect new collectors \n To enable AWS S3 for Microsoft Sentinel, click the 'Add new collector' button, fill the required information, the ARN role and the SQS URL are created in step 1, note that you will need to enter the correct SQS URL and select the appropriate event type from the dropdown, for example if you want to ingest Alert events you will need to copy the Alerts SQS URL and select the 'Alerts' event type in the dropdown" } } ] }, { "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnValue": "properties.roleArn", "columnName": "Role ARN" }, { "columnValue": "properties.sqsUrls[0]", "columnName": "Queue URL" }, { "columnValue": "properties.dcrConfig.streamName", "columnName": "Stream name" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "contextPaneType": "DataConnectorsContextPane", "title": "Add new controller", "subtitle": "AWS S3 connector", "label": "Add new collector", "instructionSteps": [ { "title": "Account details", "instructions": [ { "type": "Textbox", "parameters": { "label": "Role ARN", "type": "text", "name": "roleArn", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Queue URL", "type": "text", "name": "queueUrl", "validations": { "required": true } } }, { "type": "Dropdown", "parameters": { "label": "Data type", "type": "text", "name": "streamName", "required": true, "placeholder": "Select a data type", "options": [ { "key": "Custom-CarbonBlackAlertsStream", "text": "Alerts" }, { "key": "Custom-CarbonBlackAuthStream", "text": "Auth Events" }, { "key": "Custom-CarbonBlackEndpointStream", "text": "Endpoint Events" }, { "key": "Custom-CarbonBlackWatchlistStream", "text": "Watchlist" } ] } } ] } ] } } ] } ] } } }, { "name": "carbonBlackDcr", "apiVersion": "2021-09-01-preview", "type": "Microsoft.Insights/dataCollectionRules", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "streamDeclarations": { "Custom-CarbonBlackAlertsStream": { "columns": [ { "name": "version", "type": "string" }, { "name": "alert_url", "type": "string" }, { "name": "id", "type": "string" }, { "name": "type", "type": "string" }, { "name": "is_updated", "type": "string" }, { "name": "detection_timestamp", "type": "string" }, { "name": "backend_timestamp", "type": "string" }, { "name": "backend_update_timestamp", "type": "string" }, { "name": "first_event_timestamp", "type": "string" }, { "name": "last_event_timestamp", "type": "string" }, { "name": "severity", "type": "int" }, { "name": "reason", "type": "string" }, { "name": "threat_id", "type": "string" }, { "name": "primary_event_id", "type": "string" }, { "name": "workflow", "type": "string" }, { "name": "determination", "type": "string" }, { "name": "alert_notes_present", "type": "string" }, { "name": "policy_applied", "type": "string" }, { "name": "run_state", "type": "string" }, { "name": "reason_code", "type": "string" }, { "name": "sensor_action", "type": "string" }, { "name": "device_target_value", "type": "string" }, { "name": "device_policy_id", "type": "string" }, { "name": "device_policy", "type": "string" }, { "name": "device_id", "type": "string" }, { "name": "device_name", "type": "string" }, { "name": "device_os", "type": "string" }, { "name": "device_os_version", "type": "string" }, { "name": "device_username", "type": "string" }, { "name": "device_location", "type": "string" }, { "name": "device_external_ip", "type": "string" }, { "name": "device_internal_ip", "type": "string" }, { "name": "report_id", "type": "string" }, { "name": "report_name", "type": "string" }, { "name": "report_description", "type": "string" }, { "name": "report_tags", "type": "string" }, { "name": "report_link", "type": "string" }, { "name": "ioc_id", "type": "string" }, { "name": "ioc_hit", "type": "string" }, { "name": "watchlists", "type": "string" }, { "name": "process_guid", "type": "string" }, { "name": "process_pid", "type": "long" }, { "name": "process_name", "type": "string" }, { "name": "process_sha256", "type": "string" }, { "name": "process_md5", "type": "string" }, { "name": "process_reputation", "type": "string" }, { "name": "process_effective_reputation", "type": "string" }, { "name": "process_cmdline", "type": "string" }, { "name": "process_username", "type": "string" }, { "name": "process_issuer", "type": "string" }, { "name": "process_publisher", "type": "string" }, { "name": "parent_guid", "type": "string" }, { "name": "parent_pid", "type": "long" }, { "name": "parent_name", "type": "string" }, { "name": "parent_sha256", "type": "string" }, { "name": "parent_md5", "type": "string" }, { "name": "parent_reputation", "type": "string" }, { "name": "parent_effective_reputation", "type": "string" }, { "name": "parent_cmdline", "type": "string" }, { "name": "parent_username", "type": "string" }, { "name": "mdr_alert_notes_present", "type": "string" }, { "name": "mdr_alert", "type": "string" }, { "name": "ml_classification_final_verdict", "type": "string" }, { "name": "ml_classification_global_prevalence", "type": "string" }, { "name": "ml_classification_org_prevalence", "type": "string" } ] }, "Custom-CarbonBlackWatchlistStream": { "columns": [ { "name": "device_external_ip", "type": "string" }, { "name": "device_id", "type": "string" }, { "name": "device_internal_ip", "type": "string" }, { "name": "device_name", "type": "string" }, { "name": "ioc_hit", "type": "string" }, { "name": "ioc_id", "type": "string" }, { "name": "org_key", "type": "string" }, { "name": "parent_cmdline", "type": "string" }, { "name": "parent_path", "type": "string" }, { "name": "parent_pid", "type": "long" }, { "name": "process_cmdline", "type": "string" }, { "name": "process_path", "type": "string" }, { "name": "process_pid", "type": "long" }, { "name": "parent_username", "type": "string" }, { "name": "process_username", "type": "string" }, { "name": "report_id", "type": "string" }, { "name": "report_name", "type": "string" }, { "name": "severity", "type": "int" }, { "name": "report_tags", "type": "string" }, { "name": "schema", "type": "string" }, { "name": "create_time", "type": "string" }, { "name": "device_os", "type": "string" }, { "name": "parent_guid", "type": "string" }, { "name": "parent_hash", "type": "string" }, { "name": "parent_publisher", "type": "string" }, { "name": "parent_reputation", "type": "string" }, { "name": "process_guid", "type": "string" }, { "name": "process_hash", "type": "string" }, { "name": "process_publisher", "type": "string" }, { "name": "process_reputation", "type": "string" }, { "name": "type", "type": "string" }, { "name": "watchlists", "type": "string" } ] }, "Custom-CarbonBlackAuthStream": { "columns": [ { "name": "version", "type": "string" }, { "name": "type", "type": "string" }, { "name": "event_id", "type": "string" }, { "name": "process_guid", "type": "string" }, { "name": "parent_guid", "type": "string" }, { "name": "backend_timestamp", "type": "string" }, { "name": "org_key", "type": "string" }, { "name": "device_id", "type": "string" }, { "name": "device_name", "type": "string" }, { "name": "device_external_ip", "type": "string" }, { "name": "device_os", "type": "string" }, { "name": "device_os_version", "type": "string" }, { "name": "device_policy", "type": "string" }, { "name": "device_target_priority", "type": "string" }, { "name": "device_timestamp", "type": "string" }, { "name": "device_installed_by", "type": "string" }, { "name": "device_internal_ip", "type": "string" }, { "name": "parent_pid", "type": "string" }, { "name": "parent_reputation", "type": "string" }, { "name": "parent_effective_reputation", "type": "string" }, { "name": "parent_effective_reputation_source", "type": "string" }, { "name": "parent_publisher", "type": "string" }, { "name": "parent_name", "type": "string" }, { "name": "parent_username", "type": "string" }, { "name": "parent_hash", "type": "string" }, { "name": "parent_cmdline", "type": "string" }, { "name": "parent_cmdline_length", "type": "string" }, { "name": "parent_issuer", "type": "string" }, { "name": "parent_product_name", "type": "string" }, { "name": "process_reputation", "type": "string" }, { "name": "process_effective_reputation", "type": "string" }, { "name": "process_effective_reputation_source", "type": "string" }, { "name": "process_pid", "type": "string" }, { "name": "process_elevated", "type": "string" }, { "name": "process_integrity_level", "type": "string" }, { "name": "process_internal_name", "type": "string" }, { "name": "process_publisher", "type": "string" }, { "name": "process_issuer", "type": "string" }, { "name": "process_hash", "type": "string" }, { "name": "process_cmdline", "type": "string" }, { "name": "process_cmdline_length", "type": "string" }, { "name": "process_username", "type": "string" }, { "name": "process_name", "type": "string" }, { "name": "process_sha256", "type": "string" }, { "name": "process_company_name", "type": "string" }, { "name": "process_file_description", "type": "string" }, { "name": "process_original_filename", "type": "string" }, { "name": "process_privileges", "type": "string" }, { "name": "process_product_name", "type": "string" }, { "name": "process_product_version", "type": "string" }, { "name": "process_start_time", "type": "string" }, { "name": "process_end_time", "type": "string" }, { "name": "process_duration", "type": "string" }, { "name": "process_container_pid", "type": "string" }, { "name": "sensor_action", "type": "string" }, { "name": "sensor_version", "type": "string" }, { "name": "device_location", "type": "string" }, { "name": "device_policy_id", "type": "string" }, { "name": "filemod_count", "type": "string" }, { "name": "modload_count", "type": "string" }, { "name": "netconn_count", "type": "string" }, { "name": "regmod_count", "type": "string" }, { "name": "scriptload_count", "type": "string" }, { "name": "auth_user_id", "type": "string" }, { "name": "auth_username", "type": "string" }, { "name": "auth_server", "type": "string" }, { "name": "auth_domain_name", "type": "string" }, { "name": "auth_event_action", "type": "string" }, { "name": "auth_virtual_account_logon", "type": "string" }, { "name": "auth_restricted_admin_logon", "type": "string" }, { "name": "auth_remote_logon", "type": "string" }, { "name": "auth_remote_location", "type": "string" }, { "name": "auth_logon_type", "type": "string" }, { "name": "auth_interactive_logon", "type": "string" }, { "name": "auth_impersonation_level", "type": "string" }, { "name": "auth_cleartext_credentials_logon", "type": "string" }, { "name": "auth_package", "type": "string" }, { "name": "auth_elevated_token_logon", "type": "string" }, { "name": "auth_key_length", "type": "string" }, { "name": "auth_privileges", "type": "string" }, { "name": "windows_event_id", "type": "string" }, { "name": "auth_failure_status", "type": "string" }, { "name": "auth_failure_sub_status", "type": "string" }, { "name": "auth_logon_id", "type": "string" }, { "name": "auth_daemon_logon", "type": "string" }, { "name": "auth_remote_port", "type": "string" }, { "name": "auth_failed_logon_count", "type": "string" } ] }, "Custom-CarbonBlackEndpointStream": { "columns": [ { "name": "TimeGenerated", "type": "datetime" }, { "name": "org_key", "type": "string" }, { "name": "device_name", "type": "string" }, { "name": "device_external_ip", "type": "string" }, { "name": "process_path", "type": "string" }, { "name": "parent_path", "type": "string" }, { "name": "process_cmdline", "type": "string" }, { "name": "process_username", "type": "string" }, { "name": "type", "type": "string" }, { "name": "process_guid", "type": "string" }, { "name": "backend_timestamp", "type": "string" }, { "name": "device_id", "type": "string" }, { "name": "device_os", "type": "string" }, { "name": "action", "type": "string" }, { "name": "schema", "type": "string" }, { "name": "event_description", "type": "string" }, { "name": "event_origin", "type": "string" }, { "name": "event_id", "type": "string" }, { "name": "device_timestamp", "type": "string" }, { "name": "sensor_action", "type": "string" }, { "name": "parent_pid", "type": "string" }, { "name": "parent_reputation", "type": "string" }, { "name": "parent_guid", "type": "string" }, { "name": "parent_hash", "type": "string" }, { "name": "process_pid", "type": "string" }, { "name": "process_terminated", "type": "string" }, { "name": "process_publisher", "type": "string" }, { "name": "process_hash", "type": "string" }, { "name": "process_reputation", "type": "string" }, { "name": "remote_port", "type": "string" }, { "name": "remote_ip", "type": "string" }, { "name": "local_port", "type": "string" }, { "name": "local_ip", "type": "string" }, { "name": "netconn_inbound", "type": "string" }, { "name": "netconn_protocol", "type": "string" }, { "name": "version", "type": "string" }, { "name": "netconn_ja3_local_fingerprint", "type": "string" }, { "name": "netconn_ja3_local_fingerprint_fields", "type": "string" }, { "name": "netconn_ja3_remote_fingerprint", "type": "string" }, { "name": "netconn_ja3_remote_fingerprint_fields", "type": "string" }, { "name": "netconn_proxy_domain", "type": "string" }, { "name": "netconn_proxy_ip", "type": "string" }, { "name": "netconn_proxy_port", "type": "string" }, { "name": "netconn_remote_device_id", "type": "string" }, { "name": "netconn_remote_device_name", "type": "string" }, { "name": "netconn_request_headers", "type": "string" }, { "name": "netconn_request_method", "type": "string" }, { "name": "netconn_request_url", "type": "string" }, { "name": "netconn_response_headers", "type": "string" }, { "name": "netconn_response_status_code", "type": "string" }, { "name": "netconn_server_name_indication", "type": "string" }, { "name": "netconn_tls_certificate_issuer_name", "type": "string" }, { "name": "netconn_tls_certificate_subject_name", "type": "string" }, { "name": "netconn_tls_cipher", "type": "string" }, { "name": "netconn_tls_version", "type": "string" }, { "name": "netconn_application_protocol", "type": "string" }, { "name": "netconn_bytes_received", "type": "string" }, { "name": "netconn_bytes_sent", "type": "string" }, { "name": "netconn_community_id", "type": "string" }, { "name": "netconn_domain", "type": "string" }, { "name": "netconn_first_packet_timestamp", "type": "string" }, { "name": "netconn_last_packet_timestamp", "type": "string" }, { "name": "childproc_guid", "type": "string" }, { "name": "childproc_hash", "type": "string" }, { "name": "childproc_name", "type": "string" }, { "name": "childproc_cmdline", "type": "string" }, { "name": "childproc_pid", "type": "string" }, { "name": "childproc_publisher", "type": "string" }, { "name": "childproc_reputation", "type": "string" }, { "name": "childproc_username", "type": "string" }, { "name": "crossproc_api", "type": "string" }, { "name": "crossproc_action", "type": "string" }, { "name": "crossproc_guid", "type": "string" }, { "name": "crossproc_hash", "type": "string" }, { "name": "crossproc_name", "type": "string" }, { "name": "crossproc_publisher", "type": "string" }, { "name": "crossproc_reputation", "type": "string" }, { "name": "crossproc_target", "type": "string" }, { "name": "fileless_scriptload_cmdline", "type": "string" }, { "name": "fileless_scriptload_cmdline_length", "type": "string" }, { "name": "fileless_scriptload_hash", "type": "string" }, { "name": "filemod_hash", "type": "string" }, { "name": "filemod_name", "type": "string" }, { "name": "alert_id", "type": "string" }, { "name": "device_group", "type": "string" }, { "name": "parent_cmdline", "type": "string" }, { "name": "process_fork_pid", "type": "string" }, { "name": "target_cmdline", "type": "string" }, { "name": "process_duration", "type": "string" }, { "name": "action_s", "type": "string" }, { "name": "process_path_s", "type": "string" }, { "name": "process_username_s", "type": "string" }, { "name": "process_pid_d", "type": "string" } ] } }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[variables('workspaceResourceId')]", "name": "clv2ws1" } ] }, "dataFlows": [ { "streams": [ "Custom-CarbonBlackAlertsStream" ], "destinations": [ "clv2ws1" ], "transformKql": "source\n | project TimeGenerated = now(), Version = version, AlertUrl = alert_url, Id = id, AlertType = type, IsUpdated = is_updated, DetectionTimestamp = detection_timestamp, BackendTimestamp = backend_timestamp, BackendUpdateTimestamp = backend_update_timestamp, FirstEventTimestamp = first_event_timestamp, LastEventTimestamp = last_event_timestamp, Severity = tostring(severity), Reason = reason, ThreatId = threat_id, PrimaryEventId = primary_event_id, Workflow = workflow, Determination = determination, AlertNotesPresent = alert_notes_present, PolicyApplied = policy_applied, RunState = run_state, ReasonCode = reason_code, SensorAction = sensor_action, DeviceTargetValue = device_target_value, DevicePolicyId = device_policy_id, DevicePolicy = device_policy, DeviceId = device_id, DeviceName = device_name, DeviceOs = device_os, DeviceOsVersion = device_os_version, DeviceUsername = device_username, DeviceLocation = device_location, DeviceExternalIp = device_external_ip, DeviceInternalIp = device_internal_ip, ReportId = report_id, ReportName = report_name, ReportDescription = report_description, ReportTags = report_tags, ReportLink = report_link, IocId = ioc_id, IocHit = ioc_hit, Watchlists = watchlists, ProcessGuid = process_guid, ProcessPid = tostring(process_pid), ProcessName = process_name, ProcessSha256 = process_sha256, ProcessMd5 = process_md5, ProcessReputation = process_reputation, ProcessEffectiveReputation = process_effective_reputation, ProcessCmdline = process_cmdline, ProcessUsername = process_username, ProcessIssuer = process_issuer, ProcessPublisher = process_publisher, ParentGuid = parent_guid, ParentPid = tostring(parent_pid), ParentName = parent_name, ParentSha256 = parent_sha256, ParentMd5 = parent_md5, ParentReputation = parent_reputation, ParentEffectiveReputation = parent_effective_reputation, ParentCmdline = parent_cmdline, ParentUsername = parent_username, MdrAlertNotesPresent = mdr_alert_notes_present, MdrAlert = mdr_alert, MlClassificationFinalVerdict = ml_classification_final_verdict, MlClassificationGlobalPrevalence = ml_classification_global_prevalence, MlClassificationOrgPrevalence = ml_classification_org_prevalence", "outputStream": "Custom-CarbonBlack_Alerts_CL" }, { "streams": [ "Custom-CarbonBlackWatchlistStream" ], "destinations": [ "clv2ws1" ], "transformKql": "source \n| project TimeGenerated = now(), DeviceExternalIp = device_external_ip, DeviceId = device_id, DeviceInternalIp = device_internal_ip, DeviceName = device_name, IocHit = ioc_hit, IocId = ioc_id, OrgKey = org_key, ParentCmdline = parent_cmdline, ParentPath = parent_path, ParentPid = tostring(parent_pid), ProcessCmdline = process_cmdline, ProcessPath = process_path, ProcessPid = tostring(process_pid), ParentUsername = parent_username, ProcessUsername = process_username, ReportId = report_id, ReportName = report_name, Severity = tostring(severity), ReportTags = report_tags, Schema = schema, CreateTime = create_time, DeviceOs = device_os, ParentGuid = parent_guid, ParentHash = parent_hash, ParentPublisher = parent_publisher, ParentReputation = parent_reputation, ProcessGuid = process_guid, ProcessHash = process_hash, ProcessPublisher = process_publisher, ProcessReputation = process_reputation, WatchlistsType = type, Watchlists = watchlists", "outputStream": "Custom-CarbonBlack_Watchlist_CL" }, { "streams": [ "Custom-CarbonBlackAuthStream" ], "destinations": [ "clv2ws1" ], "transformKql": "source | extend splitBackendTime = split(backend_timestamp,' ') | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend DeviceTimestampAsDate = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z'))| extend LogonMethod = case(toint(auth_logon_type) == 2, 'Interactive',toint(auth_logon_type) == 3, 'Network',toint(auth_logon_type) == 4, 'Batch',toint(auth_logon_type) == 5, 'Service',toint(auth_logon_type) == 7, 'Unlock',toint(auth_logon_type) == 8, 'NetworkCleartext',toint(auth_logon_type) == 9, 'NewCredentials',toint(auth_logon_type) == 10, 'RemoteInteractive',toint(auth_logon_type) == 11, 'CachedInteractive','Non-Valid Logon Type') | extend DvcIpAddr = device_external_ip| extend LogonProtocol = case(auth_package == 'NLTM', 'NLTM', 'Kerberos')| extend SplittedGeo = split(auth_remote_location, ',')| extend AdditionalFields = bag_pack('AuthCleartextCredentialsLogon', auth_cleartext_credentials_logon, 'AuthDaemonLogon', auth_daemon_logon, 'AuthElevatedTokenLogon', auth_elevated_token_logon, 'AuthFailureStatus', auth_failure_status, 'AuthFailureSubStatus', auth_failure_sub_status, 'AuthImpersonationLevel', auth_impersonation_level, 'AuthInteractiveLogon', auth_interactive_logon, 'AuthKeyLength', auth_key_length, 'AuthLogonType', auth_logon_type, 'AuthPrivileges', auth_privileges, 'AuthRemoteLogon', auth_remote_logon, 'AuthRestrictedAdminLogon', auth_restricted_admin_logon, 'AuthVirtualAccountLogon', auth_virtual_account_logon, 'DeviceExternalIp', device_external_ip, 'DeviceInternalIp', device_internal_ip, 'DeviceInstalledBy', device_installed_by, 'DeviceLocation', device_location, 'DevicePolicy', device_policy, 'DevicePolicyId', device_policy_id, 'DeviceTargetPriority', device_target_priority, 'FilemodCount', filemod_count, 'ModloadCount', modload_count, 'NetconnCount', netconn_count, 'RegmodCount', regmod_count, 'ScriptloadCount', scriptload_count, 'OrgKey', org_key, 'ParentCmdline', parent_cmdline, 'ParentCmdlineLength', parent_cmdline_length, 'ParentEffectiveReputation', parent_effective_reputation, 'ParentEffectiveReputationSource', parent_effective_reputation_source, 'ParentGuid', parent_guid, 'ParentHash', parent_hash, 'ParentIssuer', parent_issuer, 'ParentPid', parent_pid, 'ParentName', parent_name, 'ParentProductName', parent_product_name, 'ParentPublisher', parent_publisher, 'ParentReputation', parent_reputation, 'ParentUsername', parent_username, 'ProcessCmdline', process_cmdline, 'ProcessCmdlineLength', process_cmdline_length, 'ProcessCompanyName', process_company_name, 'ProcessContainerPid', process_container_pid, 'ProcessDuration', process_duration, 'ProcessEffectiveReputation', process_effective_reputation, 'ProcessEffectiveReputationSource', process_effective_reputation_source, 'ProcessElevated', process_elevated, 'ProcessEndTime', process_end_time, 'ProcessFileDescription', process_file_description, 'ProcessGuid', process_guid, 'ProcessHash', process_hash, 'ProcessIntegrityLevel', process_integrity_level, 'ProcessInternalName', process_internal_name, 'ProcessIssuer', process_issuer, 'ProcessName', process_name, 'ProcessOriginalFilename', process_original_filename, 'ProcessPid', process_pid, 'ProcessPrivileges', process_privileges, 'ProcessPublisher', process_publisher, 'ProcessReputation', process_reputation, 'ProcessSha256', process_sha256, 'ProcessStartTime', process_start_time, 'ProcessUsername', process_username, 'ProcessProductName', process_product_name, 'ProcessProductVersion', process_product_version, 'WindowsEventId', windows_event_id) | project TimeGenerated = backendTimeAsDate,AdditionalFields = AdditionalFields,EventCount = toint(1),EventResult = iff(auth_event_action == 'ACTION_LOGON_FAILED', 'Failure', 'Success'),EventSchema = 'Authentication',EventSchemaVersion = '0.1.3',EventStartTime = backendTimeAsDate,EventEndTime = backendTimeAsDate,EventType = 'Logon',EventOriginalUid = event_id,EventOriginalType = 'auth.event.logonop',EventProductVersion = '2.3',ActorUserId = auth_user_id,ActorUserIdType = 'SID',ActorUsername = auth_username,ActorSessionId = auth_logon_id,ActingAppId = process_pid,ActingAppName = process_name,ActingAppType = 'Process',TargetUserId = auth_user_id,TargetUserIdType = 'SID',TargetUsername = auth_username,TargetSessionId = auth_logon_id,TargetAppId = process_pid,TargetAppName = process_name,TargetAppType = 'Process',TargetHostName = auth_server,TargetDomain = auth_domain_name,TargetDomainType = 'WINDOWS',SrcPortNumber = toint(auth_remote_port),SrcHostname = device_name,SrcDvcId = device_id,SrcDeviceType = 'Computer',SrcDvcOs = device_os,SrcIpAddr= DvcIpAddr,SrcGeoCountry = tostring(SplittedGeo[2]),SrcGeoRegion = tostring(SplittedGeo[1]),SrcGeoCity = tostring(SplittedGeo[0]),LogonMethod = LogonMethod,LogonProtocol = LogonProtocol,DvcOriginalAction = auth_event_action,DvcIpAddr = DvcIpAddr,DvcHostname = device_name,DVC = device_id,DvcId = device_id,DvcOs = device_os | extend ActorUsernameType = case (ActorUsername contains '@' , 'UPN', ActorUsername contains '\\', 'Windows', (ActorUsername has 'CN=' or ActorUsername has 'OU=' or ActorUsername has 'DC='), 'DN', isempty(ActorUsername), '', 'Simple') | extend TargetUsernameType = case (TargetUsername contains '@' , 'UPN', TargetUsername contains '\\', 'Windows', (TargetUsername has 'CN=' or TargetUsername has 'OU=' or TargetUsername has 'DC='), 'DN', isempty(TargetUsername), '', 'Simple') | extend EventProduct = 'Carbon Black Cloud', EventVendor = 'VMWare'", "outputStream": "Microsoft-ASimAuthenticationEventLogs" }, { "streams": [ "Custom-CarbonBlackEndpointStream" ], "destinations": [ "clv2ws1" ], "transformKql": "source | extend splitBackendTime = split(backend_timestamp,' ')| where type=='endpoint.event.netconn' | extend eventType = type | extend splitBackendTime = split(backend_timestamp,' ') | extend TimeGenerated = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend AdditionalFields = bag_pack('NetconnJa3LocalFingerprint', netconn_ja3_local_fingerprint, 'NetconnJa3LocalFingerprintFields', netconn_ja3_local_fingerprint_fields, 'NetconnJa3RemoteFingerprint', netconn_ja3_remote_fingerprint, 'NetconnJa3RemoteFingerprintFields', netconn_ja3_remote_fingerprint_fields, 'NetconnProxyDomain', netconn_proxy_domain, 'NetconnProxyIp', netconn_proxy_ip, 'NetconnProxyPort', netconn_proxy_port, 'NetconnRemoteDeviceId', netconn_remote_device_id, 'NetconnRemoteDeviceName', netconn_remote_device_name, 'NetconnRequestHeaders', netconn_request_headers, 'NetconnRequestMethod', netconn_request_method, 'NetconnRequestUrl', netconn_request_url, 'NetconnResponseHeaders', netconn_response_headers, 'NetconnResponseStatusCode', netconn_response_status_code, 'NetconnServerNameIndication', netconn_server_name_indication, 'NetconnTlsCertificateIssuerName', netconn_tls_certificate_issuer_name, 'NetconnTlsCertificateSubjectName', netconn_tls_certificate_subject_name, 'NetconnTlsCipher', netconn_tls_cipher, 'NetconnTlsVersion', netconn_tls_version) | project TimeGenerated,AdditionalFields = AdditionalFields, EventCount=toint(1), EventType='EndpointNetworkSession', EventSchema='NetworkSession', EventSchemaVersion = '0.2.6', EventResult = 'Success', LocalIpAddr = local_ip, LocalPortNumber = toint(local_port), NetworkApplicationProtocol = toupper(netconn_application_protocol), RemoteBytes = tolong(netconn_bytes_received), LocalBytes = tolong(netconn_bytes_sent), NetworkSessionId = netconn_community_id, RemoteDomain = netconn_domain, EventStartTime = todatetime(netconn_first_packet_timestamp), EventEndTime = todatetime(netconn_last_packet_timestamp), NetworkDirection = iff(iff(netconn_inbound!='',tobool(netconn_inbound),false),'Inbound','Outbound'), NetworkProtocol = toupper(netconn_protocol), RemoteIpAddr = remote_ip, RemotePortNumber = toint(remote_port), Dvc = device_id, EventProduct = 'Carbon Black Cloud', EventVendor = 'VMware'| union kind=outer (source | where type == 'endpoint.event.netconn' or type == 'endpoint.event.netconnproxy' | extend eventType = type | extend netconn_inbound = case(isempty(netconn_inbound), true, tobool(netconn_inbound)) | extend DvcOriginalAction = action,DvcIpAddr = device_external_ip,DvcId = device_id,DvcHostname = device_name,DvcOs = device_os,EventOriginalUid = event_id,DvcScopeId = org_key,NetworkDuration = process_duration,DStProcessGuid = iff(netconn_inbound, process_guid, ''),SrcProcessGuid = iff(netconn_inbound, '', process_guid),DstProcessId = iff(netconn_inbound, process_pid, ''),SrcProcessId = iff(netconn_inbound, '', process_pid) | extend splitBackendTime = split(device_timestamp,' ') | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend TimeGenerated = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z')) | extend AdditionalFields = bag_pack('NetconnJa3LocalFingerprint', netconn_ja3_local_fingerprint,'NetconnJa3LocalFingerprintFields', netconn_ja3_local_fingerprint_fields,'NetconnJa3RemoteFingerprint', netconn_ja3_remote_fingerprint, 'NetconnJa3RemoteFingerprintFields', netconn_ja3_remote_fingerprint_fields, 'NetconnProxyDomain', netconn_proxy_domain,'NetconnProxyIp', netconn_proxy_ip, 'NetconnProxyPort', netconn_proxy_port,'NetconnRemoteDeviceId', netconn_remote_device_id, 'NetconnRemoteDeviceName', netconn_remote_device_name,'NetconnRequestHeaders', netconn_request_headers, 'NetconnRequestMethod', netconn_request_method, 'NetconnRequestUrl', netconn_request_url, 'NetconnResponseHeaders', netconn_response_headers, 'NetconnResponseStatusCode', netconn_response_status_code, 'NetconnServerNameIndication', netconn_server_name_indication, 'NetconnTlsCertificateIssuerName', netconn_tls_certificate_issuer_name, 'NetconnTlsCertificateSubjectName', netconn_tls_certificate_subject_name, 'NetconnTlsCipher', netconn_tls_cipher,'NetconnTlsVersion', netconn_tls_version,'AlertId', alert_id,'BackendTimestamp', backend_timestamp,'DeviceGroup', device_group,'EventOrigin', event_origin,'ParentCmdline', parent_cmdline,'ParentGuid', parent_guid,'ParentHash', parent_hash,'ParentPath', parent_path,'ParentPid', parent_pid,'ParentReputation', parent_reputation,'ProcessCmdline', process_cmdline,'ProcessForkPid', process_fork_pid,'ProcessHash', process_hash,'ProcessPath', process_path,'ProcessPublisher', process_publisher,'ProcessReputation', process_reputation,'ProcessTerminated', process_terminated,'ProcessUsername', process_username,'Version', version,'SensorAction', sensor_action,'TargetCmdline', target_cmdline) | extend netconn_protocol = toupper(netconn_protocol),netconn_inbound = case(isempty(netconn_inbound), true, tobool(netconn_inbound)) | extend splitBackendTime = split(netconn_last_packet_timestamp,' ') | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend EventEndTime = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z')) | extend splitBackendTime = split(netconn_first_packet_timestamp,' ') | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend EventStartTime = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z'))| project AdditionalFields,DvcOriginalAction,DvcIpAddr,DvcId,DvcHostname,DvcOs,EventOriginalUid,DvcScopeId,tostring(NetworkDuration),DStProcessGuid,SrcProcessGuid,DstProcessId,SrcProcessId,TimeGenerated,EventCount=toint(1),EventType='EndpointNetworkSession',EventSchema='NetworkSession',EventSchemaVersion = '0.2.6',EventResult = 'Success', NetworkApplicationProtocol = toupper(netconn_application_protocol), NetworkSessionId = netconn_community_id,EventStartTime,EventEndTime,NetworkDirection = iff(netconn_inbound,'Inbound','Outbound'),NetworkProtocol = case (netconn_protocol has 'TCP', 'TCP',netconn_protocol has 'UDP', 'TCP',''),Dvc = device_id,EventProduct = 'Carbon Black Cloud',EventVendor = 'VMware',DstIpAddr = iff(netconn_inbound, local_ip, remote_ip),SrcIpAddr = iff(netconn_inbound, remote_ip, local_ip), DstPortNumber = iff(netconn_inbound, toint(local_port), toint(remote_port)),DstBytes = iff(netconn_inbound, tolong(netconn_bytes_sent), tolong(netconn_bytes_received)),SrcBytes = iff(netconn_inbound, tolong(netconn_bytes_received), tolong(netconn_bytes_sent)),DstDomain = iff(netconn_inbound, '', netconn_domain),SrcDomain = iff(netconn_inbound, netconn_domain, '') ) | extend EventProduct = 'Carbon Black Cloud', EventVendor = 'VMWare'", "outputStream": "Microsoft-ASimNetworkSessionLogs" }, { "streams": [ "Custom-CarbonBlackEndpointStream" ], "destinations": [ "clv2ws1" ], "transformKql": "source| where type == 'endpoint.event.filemod'| extend eventType = type | extend CommonAdditionalFields = bag_pack('AlertId', alert_id,'BackendTimestamp', backend_timestamp,'DeviceGroup', device_group,'EventOrigin', event_origin,'ParentCmdline', parent_cmdline,'ParentGuid', parent_guid,'ParentHash', parent_hash,'ParentPath', parent_path,'ParentPid', parent_pid,'ParentReputation', parent_reputation,'ProcessCmdline', process_cmdline,'ProcessForkPid', process_fork_pid,'ProcessHash', process_hash,'ProcessPath', process_path,'ProcessPublisher', process_publisher,'ProcessReputation', process_reputation,'ProcessTerminated', process_terminated,'ProcessUsername', process_username,'Version', version,'SensorAction', sensor_action,'TargetCmdline', target_cmdline),DvcOriginalAction = action,DvcIpAddr = device_external_ip,DvcId = device_id,DvcHostname = device_name,DvcOs = device_os,EventOriginalUid = event_id,DvcScopeId = org_key,NetworkDuration = process_duration,DStProcessGuid = iff(tobool(netconn_inbound), process_guid, ''),SrcProcessGuid = iff(tobool(netconn_inbound), '', process_guid),DstProcessId = iff(tobool(netconn_inbound), process_pid, ''),SrcProcessId = iff(tobool(netconn_inbound), '', process_pid)| extend splitBackendTime = split(device_timestamp,' ') | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend TimeGenerated = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z'))| parse filemod_hash with * '[\"' filemod_hash_MD5: string '\",\"' filemod_hash_SHA256: string '\"]'| extend AdditionalFields = bag_pack('Name',filemod_name,'FilemodSHA256',filemod_hash_SHA256,'FilemodMD5',filemod_hash_MD5,'AlertId', alert_id,'BackendTimestamp', backend_timestamp,'DeviceGroup', device_group,'EventOrigin', event_origin,'ParentCmdline', parent_cmdline,'ParentGuid', parent_guid,'ParentHash', parent_hash,'ParentPath', parent_path,'ParentPid', parent_pid,'ParentReputation', parent_reputation,'ProcessCmdline', process_cmdline,'ProcessForkPid', process_fork_pid,'ProcessHash', process_hash,'ProcessPath', process_path,'ProcessPublisher', process_publisher,'ProcessReputation', process_reputation,'ProcessTerminated', process_terminated,'ProcessUsername', process_username,'Version', version,'SensorAction', sensor_action,'TargetCmdline', target_cmdline)| project TimeGenerated,DvcOriginalAction,DvcIpAddr,DvcId,DvcHostname,DvcOs,EventOriginalUid,DvcScopeId,NetworkDuration,DStProcessGuid,SrcProcessGuid,DstProcessId,SrcProcessId,AdditionalFields | extend EventProduct = 'Carbon Black Cloud', EventVendor = 'VMWare'", "outputStream": "Microsoft-ASimFileEventLogs" }, { "streams": [ "Custom-CarbonBlackEndpointStream" ], "destinations": [ "clv2ws1" ], "transformKql": "source | where type == 'endpoint.event.procstart'| where action == 'ACTION_CREATE_PROCESS'| parse parent_hash with * '[\"' ParentProcessMD5: string '\",\"' ParentProcessSHA256: string '\"]'| parse process_hash with * '[\"' ActingProcessMD5: string '\",\"' ActingProcessSHA256: string '\"]'| parse childproc_hash with * '[\"' TargetProcessMD5: string '\",\"' TargetProcessSHA256: string '\"]'| extend DvcAction = iff(sensor_action == 'ACTION_ALLOW','Allow', iff(sensor_action == 'ACTION_BLOCK','Block',iff(sensor_action == 'ACTION_TERMINATE','Terminate', iff(sensor_action == 'ACTION_BREAK','Break',iff(sensor_action == 'ACTION_SUSPEND', 'Suspend', '')))))| extend EventResult = iff(sensor_action == 'ACTION_ALLOW','Success', iff(sensor_action == 'ACTION_BLOCK','Failure',iff(sensor_action == 'ACTION_TERMINATE','Failure', iff(sensor_action == 'ACTION_BREAK','Failure',iff(sensor_action == 'ACTION_SUSPEND', 'Failure', 'Success')))))| project EventCount=toint(1),EventStartTime = todatetime(netconn_first_packet_timestamp),EventEndTime = todatetime(netconn_last_packet_timestamp),EventType='EndpointNetworkSession',EventProduct = 'Carbon Black Cloud',EventVendor = 'VMware',EventSchema='NetworkSession',EventSchemaVersion = '0.2.6',Dvc = device_id,EventResult,DvcAction,ParentProcessGuid = parent_guid,ParentProcessId = parent_pid,ParentProcessName = parent_path,ParentProcessMD5,ParentProcessSHA256,ActingProcessGuid = parent_guid,ActingProcessId = parent_pid,ActingProcessName = parent_path,ActingProcessMD5,ActingProcessSHA256,ActingProcessCommandLine = process_cmdline,TargetProcessGuid = childproc_guid,TargetProcessId = childproc_pid,TargetProcessName = childproc_name,TargetProcessMD5,TargetProcessSHA256,TargetProcessCommandLine = target_cmdline,AdditionalFields = bag_pack('process_reputation',process_reputation, 'childproc_reputation',childproc_reputation, 'parent_reputation',parent_reputation, 'parent_cmdline',parent_cmdline)| union kind=outer (source | where type == 'endpoint.event.procstart'| where action == 'ACTION_PROCESS_DISCOVERED'| extend DvcAction = iff(sensor_action == 'ACTION_ALLOW','Allow', iff(sensor_action == 'ACTION_BLOCK','Block',iff(sensor_action == 'ACTION_TERMINATE','Terminate', iff(sensor_action == 'ACTION_BREAK','Break',iff(sensor_action == 'ACTION_SUSPEND', 'Suspend', '')))))| extend EventResult = iff(sensor_action == 'ACTION_ALLOW','Success', iff(sensor_action == 'ACTION_BLOCK','Failure',iff(sensor_action == 'ACTION_TERMINATE','Failure', iff(sensor_action == 'ACTION_BREAK','Failure',iff(sensor_action == 'ACTION_SUSPEND', 'Failure', 'Success')))))| parse parent_hash with * '[\"' ParentProcessMD5: string '\",\"' ParentProcessSHA256: string '\"]'| parse process_hash with * '[\"' ActingProcessMD5: string '\",\"' ActingProcessSHA256: string '\"]'| parse childproc_hash with * '[\"' TargetProcessMD5: string '\",\"' TargetProcessSHA256: string '\"]'| project EventCount=1,EventStartTime = todatetime(netconn_first_packet_timestamp),EventEndTime = todatetime(netconn_last_packet_timestamp),EventType='EndpointNetworkSession',EventProduct = 'Carbon Black Cloud',EventVendor = 'VMware',EventSchema='NetworkSession',EventSchemaVersion = '0.2.6',Dvc = device_id,EventResult,DvcAction,ActingProcessGuid = parent_guid,ActingProcessId = parent_pid,ActingProcessName = parent_path,ActingProcessMD5,ActingProcessSHA256,ActingProcessCommandLine = process_cmdline,TargetProcessGuid = childproc_guid,TargetProcessId = childproc_pid,TargetProcessName = childproc_name,TargetProcessMD5,TargetProcessSHA256,TargetProcessCommandLine = childproc_cmdline,AdditionalFields = bag_pack('process_reputation',process_reputation, 'childproc_reputation',childproc_reputation)) | extend TimeGenerated = EventStartTime | union kind=outer (source| where type == 'endpoint.event.crossproc'| extend eventType = type | extend DvcOriginalAction = action,DvcIpAddr = device_external_ip,DvcId = device_id,DvcHostname = device_name,DvcOs = device_os,EventOriginalUid = event_id,DvcScopeId = org_key,NetworkDuration = process_duration,DStProcessGuid = iff(tobool(netconn_inbound), process_guid, ''),SrcProcessGuid = iff(tobool(netconn_inbound), '', process_guid),DstProcessId = iff(tobool(netconn_inbound), process_pid, ''),SrcProcessId = iff(tobool(netconn_inbound), '', process_pid)| extend splitBackendTime = split(device_timestamp,' ') | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend TimeGenerated = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z')) | parse crossproc_hash with * '[\"' crossproc_hash_MD5: string '\",\"' crossproc_hash_SHA256: string '\"]'| extend AdditionalFields = bag_pack('Name',crossproc_name,'Publisher',crossproc_publisher,'Reputation',crossproc_reputation,'GUID',crossproc_guid,'Target',crossproc_target,'API',crossproc_api,'Action',crossproc_action,'ProcessMD5',crossproc_hash_MD5,'ProcessSHA256',crossproc_hash_SHA256,'AlertId', alert_id,'BackendTimestamp', backend_timestamp,'DeviceGroup', device_group,'EventOrigin', event_origin,'ParentCmdline', parent_cmdline,'ParentGuid', parent_guid,'ParentHash', parent_hash,'ParentPath', parent_path,'ParentPid', parent_pid,'ParentReputation', parent_reputation,'ProcessCmdline', process_cmdline,'ProcessForkPid', process_fork_pid,'ProcessHash', process_hash,'ProcessPath', process_path,'ProcessPublisher', process_publisher,'ProcessReputation', process_reputation,'ProcessTerminated', process_terminated,'ProcessUsername', process_username,'Version', version,'SensorAction', sensor_action,'TargetCmdline', target_cmdline)| project TimeGenerated,DvcOriginalAction,DvcIpAddr,DvcId,DvcHostname,DvcOs,EventOriginalUid,DvcScopeId,NetworkDuration,DStProcessGuid,SrcProcessGuid,DstProcessId,SrcProcessId,AdditionalFields) | union kind=outer (source| where type == 'endpoint.event.fileless_scriptload'| extend eventType = type | extend DvcOriginalAction = action,DvcIpAddr = device_external_ip,DvcId = device_id,DvcHostname = device_name,DvcOs = device_os,EventOriginalUid = event_id,DvcScopeId = org_key,NetworkDuration = process_duration,DStProcessGuid = iff(tobool(netconn_inbound), process_guid, ''),SrcProcessGuid = iff(tobool(netconn_inbound), '', process_guid),DstProcessId = iff(tobool(netconn_inbound), process_pid, ''),SrcProcessId = iff(tobool(netconn_inbound), '', process_pid)| extend splitBackendTime = split(device_timestamp,' ') | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend TimeGenerated = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z'))| parse fileless_scriptload_hash with * '[\"' fileless_hash_MD5: string '\",\"' fileless_hash_SHA256: string '\"]'| extend AdditionalFields = bag_pack('Cmdline',fileless_scriptload_cmdline,'cmdline_length',fileless_scriptload_cmdline_length,'FilelessSHA256',fileless_hash_SHA256,'FilelessMD5',fileless_hash_MD5,'AlertId', alert_id,'BackendTimestamp', backend_timestamp,'DeviceGroup', device_group,'EventOrigin', event_origin,'ParentCmdline', parent_cmdline,'ParentGuid', parent_guid,'ParentHash', parent_hash,'ParentPath', parent_path,'ParentPid', parent_pid,'ParentReputation', parent_reputation,'ProcessCmdline', process_cmdline,'ProcessForkPid', process_fork_pid,'ProcessHash', process_hash,'ProcessPath', process_path,'ProcessPublisher', process_publisher,'ProcessReputation', process_reputation,'ProcessTerminated', process_terminated,'ProcessUsername', process_username,'Version', version,'SensorAction', sensor_action,'TargetCmdline', target_cmdline)| project TimeGenerated,DvcOriginalAction,DvcIpAddr,DvcId,DvcHostname,DvcOs,EventOriginalUid,DvcScopeId,NetworkDuration,DStProcessGuid,SrcProcessGuid,DstProcessId,SrcProcessId,AdditionalFields) | extend EventProduct = 'Carbon Black Cloud', EventVendor = 'VMWare'", "outputStream": "Microsoft-ASimProcessEventLogs" }, { "streams": [ "Custom-CarbonBlackEndpointStream" ], "destinations": [ "clv2ws1" ], "transformKql": "source | where type == 'endpoint.event.regmod' | extend splitBackendTime = split(backend_timestamp,' ') | extend AdditionalFields = bag_pack('AlertId', alert_id, 'BackendTimestamp', backend_timestamp, 'DeviceGroup', device_group, 'EventOrigin', event_origin, 'ParentCmdline', parent_cmdline, 'ParentGuid', parent_guid, 'ParentHash', parent_hash, 'ParentPath', parent_path, 'ParentPid', parent_pid, 'ParentReputation', parent_reputation, 'ProcessCmdline', process_cmdline, 'ProcessForkPid', process_fork_pid, 'ProcessHash', process_hash, 'ProcessPath', process_path, 'ProcessPublisher', process_publisher, 'ProcessReputation', process_reputation, 'ProcessTerminated', process_terminated, 'ProcessUsername', process_username, 'Version', version, 'SensorAction', sensor_action, 'TargetCmdline', target_cmdline), DvcOriginalAction = action, DvcIpAddr = device_external_ip, DvcId = device_id, DvcHostname = device_name, DvcOs = device_os, EventOriginalUid = event_id, DvcScopeId = org_key, NetworkDuration = process_duration, DStProcessGuid = iff(tobool(netconn_inbound), process_guid, ' '), SrcProcessGuid = iff(tobool(netconn_inbound), ' ', process_guid), DstProcessId = iff(tobool(netconn_inbound), process_pid, ' '), SrcProcessId = iff(tobool(netconn_inbound), ' ', process_pid) | extend splitBackendTime = split(device_timestamp,' ') | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend TimeGenerated = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z')) | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend EventEndTime = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z')) | extend splitBackendTime = split(netconn_first_packet_timestamp,' ') | extend backendTimeAsDate = todatetime(strcat(splitBackendTime[0],'T',splitBackendTime[1],'Z')) | extend splitDeviceTimestamp = split(device_timestamp,' ') | extend EventStartTime = todatetime(strcat(splitDeviceTimestamp[0],'T',splitDeviceTimestamp[1],'Z')) | extend temp_action = case(action_s has '| ' and action_s has 'delete ','ACTION_DELETE_KEY',action_s has '| ' and action_s !has 'delete','ACTION_CREATE_KEY',action_s) | extend EventType = case (temp_action == 'ACTION_WRITE_VALUE', 'RegistryValueSet', temp_action == 'ACTION_CREATE_KEY','RegistryKeyCreated', temp_action == 'ACTION_DELETE_KEY','RegistryKeyDeleted', temp_action == 'ACTION_DELETE_VALUE','RegistryValueDeleted',temp_action == 'ACTION_RENAME_KEY','RegistryKeyRenamed',temp_action) | project AdditionalFields, DvcOriginalAction, DvcIpAddr, DvcId, DvcIdType = iff(isnotempty(DvcId), 'Other', ' ') ,DvcHostname, Process = process_path_s, User = process_username_s, ActorUserType = process_username_s, DvcOs, EventOriginalUid, DvcScopeId, NetworkDuration, DStProcessGuid, SrcProcessGuid, DstProcessId, SrcProcessId, TimeGenerated, EventCount=toint(1), EventType, EventSchema = 'RegistryEvent', EventSchemaVersion = '0.1.2', EventResult = 'Success', EventStartTime, EventEndTime, Dvc = device_id, DvcAction = 'Allowed', EventProduct = 'Carbon Black Cloud', EventVendor = 'VMware', DstIpAddr = iff(tobool(netconn_inbound), local_ip, remote_ip), SrcIpAddr = iff(tobool(netconn_inbound), remote_ip, local_ip), DstPortNumber = iff(tobool(netconn_inbound), toint(local_port), toint(remote_port)), DstBytes = iff(tobool(netconn_inbound), tolong(netconn_bytes_sent), tolong(netconn_bytes_received)), SrcBytes = iff(tobool(netconn_inbound), tolong(netconn_bytes_received), tolong(netconn_bytes_sent)), DstDomain = iff(tobool(netconn_inbound), ' ', netconn_domain), SrcDomain = iff(tobool(netconn_inbound), netconn_domain,' ')", "outputStream": "Microsoft-ASimRegistryEventLogs" } ], "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]" } }, { "name": "[variables('_logAnalyticsTableId1')]", "apiVersion": "2021-03-01-privatepreview", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { "name": "[variables('_logAnalyticsTableId1')]", "columns": [ { "name": "TimeGenerated", "type": "datetime" }, { "name": "Version", "type": "string" }, { "name": "AlertUrl", "type": "string" }, { "name": "Id", "type": "string" }, { "name": "AlertType", "type": "string" }, { "name": "IsUpdated", "type": "string" }, { "name": "DetectionTimestamp", "type": "string" }, { "name": "BackendTimestamp", "type": "string" }, { "name": "BackendUpdateTimestamp", "type": "string" }, { "name": "FirstEventTimestamp", "type": "string" }, { "name": "LastEventTimestamp", "type": "string" }, { "name": "Severity", "type": "string" }, { "name": "Reason", "type": "string" }, { "name": "ThreatId", "type": "string" }, { "name": "PrimaryEventId", "type": "string" }, { "name": "Workflow", "type": "string" }, { "name": "Determination", "type": "string" }, { "name": "AlertNotesPresent", "type": "string" }, { "name": "PolicyApplied", "type": "string" }, { "name": "RunState", "type": "string" }, { "name": "ReasonCode", "type": "string" }, { "name": "SensorAction", "type": "string" }, { "name": "DeviceTargetValue", "type": "string" }, { "name": "DevicePolicyId", "type": "string" }, { "name": "DevicePolicy", "type": "string" }, { "name": "DeviceId", "type": "string" }, { "name": "DeviceName", "type": "string" }, { "name": "DeviceOs", "type": "string" }, { "name": "DeviceOsVersion", "type": "string" }, { "name": "DeviceUsername", "type": "string" }, { "name": "DeviceLocation", "type": "string" }, { "name": "DeviceExternalIp", "type": "string" }, { "name": "DeviceInternalIp", "type": "string" }, { "name": "ReportId", "type": "string" }, { "name": "ReportName", "type": "string" }, { "name": "ReportDescription", "type": "string" }, { "name": "ReportTags", "type": "string" }, { "name": "ReportLink", "type": "string" }, { "name": "IocId", "type": "string" }, { "name": "IocHit", "type": "string" }, { "name": "Watchlists", "type": "string" }, { "name": "ProcessGuid", "type": "string" }, { "name": "ProcessPid", "type": "string" }, { "name": "ProcessName", "type": "string" }, { "name": "ProcessSha256", "type": "string" }, { "name": "ProcessMd5", "type": "string" }, { "name": "ProcessReputation", "type": "string" }, { "name": "ProcessEffectiveReputation", "type": "string" }, { "name": "ProcessCmdline", "type": "string" }, { "name": "ProcessUsername", "type": "string" }, { "name": "ProcessIssuer", "type": "string" }, { "name": "ProcessPublisher", "type": "string" }, { "name": "ParentGuid", "type": "string" }, { "name": "ParentPid", "type": "string" }, { "name": "ParentName", "type": "string" }, { "name": "ParentSha256", "type": "string" }, { "name": "ParentMd5", "type": "string" }, { "name": "ParentReputation", "type": "string" }, { "name": "ParentEffectiveReputation", "type": "string" }, { "name": "ParentCmdline", "type": "string" }, { "name": "ParentUsername", "type": "string" }, { "name": "MdrAlertNotesPresent", "type": "string" }, { "name": "MdrAlert", "type": "string" }, { "name": "MlClassificationFinalVerdict", "type": "string" }, { "name": "MlClassificationGlobalPrevalence", "type": "string" }, { "name": "MlClassificationOrgPrevalence", "type": "string" }, { "name": "ml_classification_org_prevalence", "type": "string" } ] } } }, { "name": "[variables('_logAnalyticsTableId2')]", "apiVersion": "2021-03-01-privatepreview", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { "name": "[variables('_logAnalyticsTableId2')]", "columns": [ { "name": "TimeGenerated", "type": "datetime" }, { "name": "DeviceExternalIp", "type": "string" }, { "name": "DeviceId", "type": "string" }, { "name": "DeviceInternalIp", "type": "string" }, { "name": "DeviceName", "type": "string" }, { "name": "IocHit", "type": "string" }, { "name": "IocId", "type": "string" }, { "name": "OrgKey", "type": "string" }, { "name": "ParentCmdline", "type": "string" }, { "name": "ParentPath", "type": "string" }, { "name": "ParentPid", "type": "string" }, { "name": "ProcessCmdline", "type": "string" }, { "name": "ProcessPath", "type": "string" }, { "name": "ProcessPid", "type": "string" }, { "name": "ParentUsername", "type": "string" }, { "name": "ProcessUsername", "type": "string" }, { "name": "ReportId", "type": "string" }, { "name": "ReportName", "type": "string" }, { "name": "Severity", "type": "string" }, { "name": "ReportTags", "type": "string" }, { "name": "Schema", "type": "string" }, { "name": "CreateTime", "type": "string" }, { "name": "DeviceOs", "type": "string" }, { "name": "ParentGuid", "type": "string" }, { "name": "ParentHash", "type": "string" }, { "name": "ParentPublisher", "type": "string" }, { "name": "ParentReputation", "type": "string" }, { "name": "ProcessGuid", "type": "string" }, { "name": "ProcessHash", "type": "string" }, { "name": "ProcessPublisher", "type": "string" }, { "name": "ProcessReputation", "type": "string" }, { "name": "WatchlistsType", "type": "string" }, { "name": "Watchlists", "type": "string" } ] } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition'),'-', variables('dataConnectorVersionConnectorDefinition'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "carbonBlackAWSS3", "title": "VMware Carbon Black Cloud via AWS S3", "publisher": "Microsoft", "descriptionMarkdown": "The [VMware Carbon Black Cloud](https://www.broadcom.com/products/carbon-black/threat-prevention/carbon-black-cloud) via AWS S3 data connector provides the capability to ingest watchlist, alerts, auth and endpoints events via AWS S3 and stream them to ASIM normalized tables. The connector provides ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more.", "graphQueriesTableName": "CarbonBlack_Alerts_CL", "graphQueries": [ { "metricName": "CarbonBlack_Alerts_CL", "legend": "Alerts", "baseQuery": "CarbonBlack_Alerts_CL" }, { "metricName": "CarbonBlack_Watchlist_CL", "legend": "Watchlist", "baseQuery": "CarbonBlack_Watchlist_CL" }, { "metricName": "ASimNetworkSessionLogs", "legend": "ASimNetworkSessionLogs", "baseQuery": "ASimNetworkSessionLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' " }, { "metricName": "ASimProcessEventLogs", "legend": "ASimProcessEventLogs", "baseQuery": "ASimProcessEventLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' " }, { "metricName": "ASimFileEventLogs", "legend": "ASimFileEventLogs", "baseQuery": "ASimFileEventLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' " }, { "metricName": "ASimRegistryEventLogs", "legend": "ASimRegistryEventLogs", "baseQuery": "ASimRegistryEventLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' " }, { "metricName": "ASimAuthenticationEventLogs", "legend": "Auth", "baseQuery": "ASimAuthenticationEventLogs | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare'" } ], "sampleQueries": [ ], "dataTypes": [ { "name": "CarbonBlack_Alerts_CL", "lastDataReceivedQuery": "CarbonBlack_Alerts_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" }, { "name": "CarbonBlack_Watchlist_CL", "lastDataReceivedQuery": "CarbonBlack_Watchlist_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" }, { "name": "ASimNetworkSessionLogs", "lastDataReceivedQuery": "union ASimNetworkSessionLogs | where TimeGenerated > ago(12h) | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | summarize Time = max(TimeGenerated)| where isnotempty(Time)" }, { "name": "ASimProcessEventLogs", "lastDataReceivedQuery": "union ASimProcessEventLogs | where TimeGenerated > ago(12h) | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | summarize Time = max(TimeGenerated)| where isnotempty(Time)" }, { "name": "ASimFileEventLogs", "lastDataReceivedQuery": "union ASimFileEventLogs | where TimeGenerated > ago(12h) | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | summarize Time = max(TimeGenerated)| where isnotempty(Time)" }, { "name": "ASimAuthenticationEventLogs", "lastDataReceivedQuery": "ASimAuthenticationEventLogs\n | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" }, { "name": "ASimRegistryEventLogs", "lastDataReceivedQuery": "ASimRegistryEventLogs\n | where EventProduct == 'Carbon Black Cloud' and EventVendor == 'VMWare' | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "write permission.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "delete": true } } ], "customs": [ { "name": "Environment", "description": "You must have the following AWS resources defined and configured: S3, Simple Queue Service (SQS), IAM roles and permissions policies" }, { "name": "Environment", "description": "You must have the a Carbon black account and required permissions to create a Data Forwarded to AWS S3 buckets. \nFor more details visit [Carbon Black Data Forwarder Docs](https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/carbon-black-cloud-user-guide/GUID-E8D33F72-BABB-4157-A908-D8BBDB5AF349.html)" } ] }, "instructionSteps": [ { "instructions": [ { "type": "Markdown", "parameters": { "content": "#### 1. AWS CloudFormation Deployment \n To configure access on AWS, two templates has been generated to set up the AWS environment to send logs from S3 bucket to your Log Analytics Workspace.\n #### For each template, create Stack in AWS: \n 1. Go to [AWS CloudFormation Stacks](https://aka.ms/awsCloudFormationLink#/stacks/create) \n 2. In AWS, choose the 'Upload a template file' option and click on 'Choose file'. Select the downloaded template \n 3. Click 'Next' and 'Create stack'" } }, { "type": "CopyableLabel", "parameters": { "label": "Template 1: OpenID connect authentication deployment", "isMultiLine": true, "fillWith": [ "Oidc" ] } }, { "type": "CopyableLabel", "parameters": { "label": "Template 2: AWS Carbon Black resources deployment", "isMultiLine": true, "fillWith": [ "CarbonBlack" ] } }, { "type": "Markdown", "parameters": { "content": "When deploying 'Template 2: AWS Carbon Black resources deployment' template you'll need supply a few parameters \n * **Stack Name**: A stack name of your choosing (will appear in the list of stacks in AWS)\n * **Role Name**: Must begin with 'OIDC_' prefix, has a default value. \n * **Bucket Name**: Bucket name of your choosing, if you already have an existing bucket paste the name here \n * **CreateNewBucket**: If you already have an existing bucket that you would like to use for this connector select 'false' for this option, otherwise a bucket with the name you entered in 'Bucket Name' will be created from this stack. \n * **Region**: This is the region of the AWS resources based on Carbon Black's mapping - for more information please see [Carbon Black documentation](https://developer.carbonblack.com/reference/carbon-black-cloud/integrations/data-forwarder/quick-setup/#create-a-bucket).\n * **SQSQueuePrefix**: The stack create multiple queues, this prefix will be added to each one of them. \n * **WorkspaceID**: Use the Workspace ID provided below." } }, { "type": "CopyableLabel", "parameters": { "fillWith": [ "WorkspaceId" ], "label": "Workspace ID" } }, { "type": "Markdown", "parameters": { "content": "Once the deployment is complete - head to the 'Outputs' tab, you will see: Role ARN, S3 bucket and 4 SQS resources created. You will need those resources in the next step when configuring Carbon Black's data forwarders and the data connector." } }, { "type": "Markdown", "parameters": { "content": "#### 2. Carbon Black data forwarder configuration \n After all AWS resources has been created you'll need to configure Carbon Black to forward the events to the AWS buckets for Microsoft Sentinel to ingest them. Follow [Carbon Black's documentation on how to create a 'Data Forwarders'](https://developer.carbonblack.com/reference/carbon-black-cloud/integrations/data-forwarder/quick-setup/#2-create-a-forwarder) Use the first recommended option. When asked to input a bucket name use the bucket created in the previous step. \n You will be required to add 'S3 prefix' for each forwarder, please use this mapping:" } }, { "type": "Markdown", "parameters": { "content": " | Event type | S3 prefix | \n |-----------------|-----------|\n | Alert | carbon-black-cloud-forwarder/Alerts |\n | Auth Events | carbon-black-cloud-forwarder/Auth |\n | Endpoint Events | carbon-black-cloud-forwarder/Endpoint |\n | Watchlist Hit | carbon-black-cloud-forwarder/Watchlist |" } }, { "type": "Markdown", "parameters": { "content": "#### 2.1. Test your data forwarder (Optional) \n To validate the data forwarder is configured as expected, in Carbon Black's portal search for the data forwarder that you just created and click on 'Test Forwarder' button under the 'Actions' column, this will generate a 'HealthCheck' file in the S3 Bucket, you should see it appear immediately." } }, { "type": "Markdown", "parameters": { "content": "#### 3. Connect new collectors \n To enable AWS S3 for Microsoft Sentinel, click the 'Add new collector' button, fill the required information, the ARN role and the SQS URL are created in step 1, note that you will need to enter the correct SQS URL and select the appropriate event type from the dropdown, for example if you want to ingest Alert events you will need to copy the Alerts SQS URL and select the 'Alerts' event type in the dropdown" } } ] }, { "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnValue": "properties.roleArn", "columnName": "Role ARN" }, { "columnValue": "properties.sqsUrls[0]", "columnName": "Queue URL" }, { "columnValue": "properties.dcrConfig.streamName", "columnName": "Stream name" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "contextPaneType": "DataConnectorsContextPane", "title": "Add new controller", "subtitle": "AWS S3 connector", "label": "Add new collector", "instructionSteps": [ { "title": "Account details", "instructions": [ { "type": "Textbox", "parameters": { "label": "Role ARN", "type": "text", "name": "roleArn", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Queue URL", "type": "text", "name": "queueUrl", "validations": { "required": true } } }, { "type": "Dropdown", "parameters": { "label": "Data type", "type": "text", "name": "streamName", "required": true, "placeholder": "Select a data type", "options": [ { "key": "Custom-CarbonBlackAlertsStream", "text": "Alerts" }, { "key": "Custom-CarbonBlackAuthStream", "text": "Auth Events" }, { "key": "Custom-CarbonBlackEndpointStream", "text": "Endpoint Events" }, { "key": "Custom-CarbonBlackWatchlistStream", "text": "Watchlist" } ] } } ] } ] } } ] } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersionConnectorDefinition')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorVersionConnections')]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections'), variables('dataConnectorVersionConnections'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections')]", "displayName": "[concat(variables('_solutionName'), variables('dataConnectorTemplateNameConnections'))]", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersionConnections')]", "parameters": { "connectorDefinitionName": { "defaultValue": "connectorDefinitionName", "type": "string", "minLength": 1 }, "workspace": { "defaultValue": "[parameters('workspace')]", "type": "string" }, "dcrConfig": { "defaultValue": { "dataCollectionEndpoint": "data collection Endpoint", "dataCollectionRuleImmutableId": "data collection rule immutableId" }, "type": "object" }, "roleArn": { "defaultValue": "roleArn", "type": "string", "minLength": 1 }, "queueUrl": { "defaultValue": "queueUrl", "type": "string", "minLength": 1 }, "streamName": { "defaultValue": "streamName", "type": "array", "minLength": 1 } }, "variables": { "_dataConnectorContentIdConnections": "[variables('_dataConnectorContentIdConnections')]" }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections'))]", "contentId": "[variables('_dataConnectorContentIdConnections')]", "kind": "ResourcesDataConnector", "version": "[variables('dataConnectorVersionConnections')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]", "tier": "[variables('_solutionTier')]" } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'carbonBlackViaAWSS3')]", "apiVersion": "2022-12-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "AmazonWebServicesS3", "properties": { "connectorDefinitionName": "[[parameters('connectorDefinitionName')]", "dataTypes": { "logs": { "state": "enabled" } }, "dcrConfig": { "streamName": "[[parameters('streamName')[0]]", "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" }, "roleArn": "[[parameters('roleArn')]", "sqsUrls": [ "[[parameters('queueUrl')]" ], "destinationTable": "[[concat(parameters('streamName')[0],'_CL')]", "dataFormat": { "Format": "JsonLine", "IsCompressed": true, "compressType": "Gzip" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections'),'-', variables('dataConnectorVersionConnections'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]", "location": "[parameters('workspace-location')]", "apiVersion": "2023-04-01-preview", "properties": { "version": "[variables('_solutionVersion')]", "kind": "Solution", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_solutionId')]", "source": { "kind": "Solution", "name": "[variables('_solutionName')]", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "[variables('_solutionAuthor')]" }, "support": { "name": "[variables('_solutionAuthor')]" }, "dependencies": { "operator": "AND", "criteria": [ { "kind": "DataConnector", "contentId": "[variables('dataConnectorVersionConnectorDefinition')]", "version": "[variables('_dataConnectorContentIdConnectorDefinition')]" } ] }, "firstPublishDate": "2022-06-24", "providers": [ "[variables('_solutionAuthor')]" ], "contentKind": "Solution", "packageId": "[variables('_solutionId')]", "contentProductId": "[concat(substring(variables('_solutionId'), 0, 50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", "displayName": "[variables('_solutionName')]", "publisherDisplayName": "[variables('_solutionId')]", "descriptionHtml": "test", "icon": "[variables('_packageIcon')]" } } ] }