Add ASIM Audit Event parser for Microsoft Entra ID AuditLogs

Parsers/ASimAuditEvent/ARM/ASimAuditEventMicrosoftEntraIDAuditLogs/ASimAuditEventMicrosoftEntraIDAuditLogs.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "Workspace": {
+      "type": "string",
+      "metadata": {
+        "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group."
+      }
+    },
+    "WorkspaceRegion": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "The region of the selected workspace. The default value will use the Region selection above."
+      }
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+      "apiVersion": "2020-08-01",
+      "name": "[concat(parameters('Workspace'), '/ASimAuditEventMicrosoftEntraIDAuditLogs')]",
+      "location": "[parameters('WorkspaceRegion')]",
+      "properties": {
+        "etag": "*",
+        "displayName": "Audit Event ASIM parser for Microsoft Entra ID audit logs",
+        "category": "ASIM",
+        "FunctionAlias": "ASimAuditEventMicrosoftEntraIDAuditLogs",
+        "query": "let parser=(disabled:bool=false){\n  let EntraIDOperationLookup = datatable (AADOperationType:string, EventType:string)\n  [\n    'Add', 'Create',\n    'Update', 'Set',\n    'Delete', 'Delete',\n    'Other', 'Other',\n    'Assign', 'Set',\n    'Unassign', 'Delete',\n    '', 'Other'\n  ];\n  AuditLogs\n  | where not(disabled)\n  // EventResult mapping\n  | extend EventResult = iff(Result == \"success\", \"Success\", iff(Result == \"failure\", \"Failure\", \"NA\"))\n  // EventType lookup\n  | lookup EntraIDOperationLookup on AADOperationType\n  | extend EventType = iff(isempty(EventType), \"Other\", EventType)\n  // Parse InitiatedBy to extract actor information\n  | extend\n      InitiatedByUser = tostring(InitiatedBy.user),\n      InitiatedByApp = tostring(InitiatedBy.app)\n  | extend\n      ActorUsername = coalesce(\n          tostring(InitiatedBy.user.userPrincipalName),\n          tostring(InitiatedBy.app.displayName)\n      ),\n      ActorUserId = coalesce(\n          tostring(InitiatedBy.user.id),\n          tostring(InitiatedBy.app.servicePrincipalId)\n      ),\n      ActorUserType = iff(isnotempty(tostring(InitiatedBy.user.userPrincipalName)), \"Member\", \n                      iff(isnotempty(tostring(InitiatedBy.app.displayName)), \"Application\", \"\"))\n  // SrcIpAddr extraction\n  | extend SrcIpAddr = tostring(InitiatedBy.user.ipAddress)\n  // Parse TargetResources for Object\n  | extend TargetResource = iff(array_length(TargetResources) > 0, TargetResources[0], dynamic(null))\n  | extend\n      Object = tostring(TargetResource.displayName),\n      ObjectId = tostring(TargetResource.id),\n      ObjectType = case(\n          tostring(TargetResource.type) == \"User\", \"Directory Service Object\",\n          tostring(TargetResource.type) == \"Group\", \"Directory Service Object\",\n          tostring(TargetResource.type) == \"Application\", \"Cloud Resource\",\n          tostring(TargetResource.type) == \"ServicePrincipal\", \"Cloud Resource\",\n          tostring(TargetResource.type) == \"Policy\", \"Policy Rule\",\n          tostring(TargetResource.type) == \"Role\", \"Configuration Atom\",\n          tostring(TargetResource.type) == \"Device\", \"Directory Service Object\",\n          \"Other\"\n      ),\n      OriginalObjectType = tostring(TargetResource.type)\n  // Parse NewValue and OldValue from modified properties\n  | extend ModifiedProperties = iff(array_length(TargetResource.modifiedProperties) > 0, TargetResource.modifiedProperties, dynamic(null))\n  | extend\n      NewValue = tostring(ModifiedProperties[0].newValue),\n      OldValue = tostring(ModifiedProperties[0].oldValue)\n  // Standard field mappings\n  | extend\n      EventCount = int(1),\n      EventStartTime = ActivityDateTime,\n      EventEndTime = ActivityDateTime,\n      EventProduct = 'Microsoft Entra ID',\n      EventVendor = 'Microsoft',\n      EventSchemaVersion = '0.1.2',\n      EventSchema = 'AuditEvent',\n      EventSeverity = iff(EventResult == \"Failure\", \"Low\", \"Informational\")\n  | project-rename\n      Operation = ActivityDisplayName,\n      EventOriginalUid = Id,\n      ActorSessionId = CorrelationId,\n      EventOriginalType = OperationName,\n      EventOriginalResultDetails = ResultReason,\n      TargetAppName = LoggedByService\n  // Actor fields\n  | extend\n      ActorUsernameType = iff(ActorUsername has \"@\", \"UPN\", iff(isnotempty(ActorUsername), \"Simple\", \"\")),\n      ActorUserIdType = iff(isnotempty(ActorUserId), \"AADID\", \"\"),\n      ActorScopeId = AADTenantId,\n      ActorScope = \"Microsoft Entra ID\"\n  // Target App fields\n  | extend\n      TargetAppType = \"SaaS application\"\n  // AdditionalFields\n  | extend AdditionalFields = bag_pack(\"Category\", Category, \"AdditionalDetails\", AdditionalDetails)\n  // Aliases\n  | extend\n      IpAddr = SrcIpAddr,\n      User = ActorUsername,\n      Application = TargetAppName,\n      Dst = TargetAppName,\n      Src = SrcIpAddr,\n      ActorUserUpn = iff(ActorUsernameType == \"UPN\", ActorUsername, \"\"),\n      ActorUserAadId = ActorUserId,\n      Value = NewValue,\n      Dvc = EventProduct\n  | project\n      TimeGenerated,\n      Type,\n      Operation,\n      Object,\n      ObjectId,\n      ObjectType,\n      OriginalObjectType,\n      OldValue,\n      NewValue,\n      Value,\n      EventOriginalUid,\n      EventOriginalType,\n      EventOriginalResultDetails,\n      EventCount,\n      EventStartTime,\n      EventEndTime,\n      EventProduct,\n      EventVendor,\n      EventSchemaVersion,\n      EventSchema,\n      EventResult,\n      EventSeverity,\n      EventType,\n      ActorUsername,\n      ActorUsernameType,\n      ActorUserId,\n      ActorUserIdType,\n      ActorUserType,\n      ActorScopeId,\n      ActorScope,\n      ActorSessionId,\n      ActorUserUpn,\n      ActorUserAadId,\n      SrcIpAddr,\n      TargetAppName,\n      TargetAppType,\n      AdditionalFields,\n      IpAddr,\n      User,\n      Application,\n      Dst,\n      Src,\n      Dvc\n};\nparser (disabled=disabled)\n",
+        "version": 1,
+        "functionParameters": "disabled:bool=False"
+      }
+    }
+  ]
+}

Parsers/ASimAuditEvent/ARM/ASimAuditEventMicrosoftEntraIDAuditLogs/README.md

@@ -0,0 +1,21 @@
+# Microsoft Entra ID ASIM AuditEvent Normalization Parser
+
+ARM template for ASIM AuditEvent schema parser for Microsoft Entra ID.
+
+This ASIM parser supports normalizing Microsoft Entra ID audit logs in the AuditLogs table to the ASIM Audit Event schema.
+
+
+The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
+
+For more information, see:
+
+- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
+- [Deploy all of ASIM](https://aka.ms/DeployASIM)
+- [ASIM AuditEvent normalization schema reference](https://aka.ms/ASimAuditEventDoc)
+
+For the changelog, see:
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEventMicrosoftEntraIDAuditLogs.md)
+
+<br>
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuditEvent%2FARM%2FASimAuditEventMicrosoftEntraIDAuditLogs%2FASimAuditEventMicrosoftEntraIDAuditLogs.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuditEvent%2FARM%2FASimAuditEventMicrosoftEntraIDAuditLogs%2FASimAuditEventMicrosoftEntraIDAuditLogs.json)

Parsers/ASimAuditEvent/ARM/FullDeploymentAuditEvent.json

@@ -218,6 +218,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedASimAuditEventMicrosoftEntraIDAuditLogs",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuditEvent/ARM/ASimAuditEventMicrosoftEntraIDAuditLogs/ASimAuditEventMicrosoftEntraIDAuditLogs.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",
@@ -598,6 +618,26 @@
         }
       }
     },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "linkedvimAuditEventMicrosoftEntraIDAuditLogs",
+      "properties": {
+        "mode": "Incremental",
+        "templateLink": {
+          "uri": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Parsers/ASimAuditEvent/ARM/vimAuditEventMicrosoftEntraIDAuditLogs/vimAuditEventMicrosoftEntraIDAuditLogs.json",
+          "contentVersion": "1.0.0.0"
+        },
+        "parameters": {
+          "Workspace": {
+            "value": "[parameters('Workspace')]"
+          },
+          "WorkspaceRegion": {
+            "value": "[parameters('WorkspaceRegion')]"
+          }
+        }
+      }
+    },
     {
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2020-10-01",

Parsers/ASimAuditEvent/ARM/vimAuditEventMicrosoftEntraIDAuditLogs/README.md

@@ -0,0 +1,21 @@
+# Microsoft Entra ID ASIM AuditEvent Normalization Parser
+
+ARM template for ASIM AuditEvent schema parser for Microsoft Entra ID.
+
+This ASIM parser supports filtering and normalizing Microsoft Entra ID audit logs in the AuditLogs table to the ASIM Audit Event schema.
+
+
+The Advanced Security Information Model (ASIM) enables you to use and create source-agnostic content, simplifying your analysis of the data in your Microsoft Sentinel workspace.
+
+For more information, see:
+
+- [Normalization and the Advanced Security Information Model (ASIM)](https://aka.ms/AboutASIM)
+- [Deploy all of ASIM](https://aka.ms/DeployASIM)
+- [ASIM AuditEvent normalization schema reference](https://aka.ms/ASimAuditEventDoc)
+
+For the changelog, see:
+- [CHANGELOG](https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuditEvent/CHANGELOG/vimAuditEventMicrosoftEntraIDAuditLogs.md)
+
+<br>
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuditEvent%2FARM%2FvimAuditEventMicrosoftEntraIDAuditLogs%2FvimAuditEventMicrosoftEntraIDAuditLogs.json) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FParsers%2FASimAuditEvent%2FARM%2FvimAuditEventMicrosoftEntraIDAuditLogs%2FvimAuditEventMicrosoftEntraIDAuditLogs.json)

Parsers/ASimAuditEvent/ARM/vimAuditEventMicrosoftEntraIDAuditLogs/vimAuditEventMicrosoftEntraIDAuditLogs.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "Workspace": {
+      "type": "string",
+      "metadata": {
+        "description": "The Microsoft Sentinel workspace into which the function will be deployed. Has to be in the selected Resource Group."
+      }
+    },
+    "WorkspaceRegion": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "The region of the selected workspace. The default value will use the Region selection above."
+      }
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+      "apiVersion": "2020-08-01",
+      "name": "[concat(parameters('Workspace'), '/vimAuditEventMicrosoftEntraIDAuditLogs')]",
+      "location": "[parameters('WorkspaceRegion')]",
+      "properties": {
+        "etag": "*",
+        "displayName": "Audit Event ASIM filtering parser for Microsoft Entra ID audit logs",
+        "category": "ASIM",
+        "FunctionAlias": "vimAuditEventMicrosoftEntraIDAuditLogs",
+        "query": "let parser=(\n  starttime:datetime=datetime(null), \n  endtime:datetime=datetime(null),\n  srcipaddr_has_any_prefix:dynamic=dynamic([]), \n  eventresult:string='*',\n  actorusername_has_any:dynamic=dynamic([]),\n  eventtype_in:dynamic=dynamic([]),\n  operation_has_any:dynamic=dynamic([]),\n  object_has_any:dynamic=dynamic([]),\n  newvalue_has_any:dynamic=dynamic([]),\n  disabled:bool = false\n){\n  let EntraIDOperationLookup = datatable (AADOperationType:string, EventType:string)\n  [\n    'Add', 'Create',\n    'Update', 'Set',\n    'Delete', 'Delete',\n    'Other', 'Other',\n    'Assign', 'Set',\n    'Unassign', 'Delete',\n    '', 'Other'\n  ];\n  AuditLogs\n  | where not(disabled)\n  | where\n      (isnull(starttime) or TimeGenerated >= starttime) \n      and (isnull(endtime) or TimeGenerated <= endtime)\n  // Pre-filtering on native columns\n  | where\n      (array_length(actorusername_has_any) == 0 or Identity has_any (actorusername_has_any))\n      and (array_length(operation_has_any) == 0 or ActivityDisplayName has_any (operation_has_any))\n      and (array_length(object_has_any) == 0 or TargetResources has_any (object_has_any))\n  // EventResult filtering\n  | extend EventResult = iff(Result == \"success\", \"Success\", iff(Result == \"failure\", \"Failure\", \"NA\"))\n  | where eventresult == \"*\" or (EventResult == eventresult)\n  // EventType lookup\n  | lookup EntraIDOperationLookup on AADOperationType\n  | extend EventType = iff(isempty(EventType), \"Other\", EventType)\n  | where array_length(eventtype_in) == 0 or EventType in (eventtype_in)\n  // Parse InitiatedBy to extract actor information\n  | extend\n      InitiatedByUser = tostring(InitiatedBy.user),\n      InitiatedByApp = tostring(InitiatedBy.app)\n  | extend\n      ActorUsername = coalesce(\n          tostring(InitiatedBy.user.userPrincipalName),\n          tostring(InitiatedBy.app.displayName)\n      ),\n      ActorUserId = coalesce(\n          tostring(InitiatedBy.user.id),\n          tostring(InitiatedBy.app.servicePrincipalId)\n      ),\n      ActorUserType = iff(isnotempty(tostring(InitiatedBy.user.userPrincipalName)), \"Member\", \n                      iff(isnotempty(tostring(InitiatedBy.app.displayName)), \"Application\", \"\"))\n  | where array_length(actorusername_has_any) == 0 or ActorUsername has_any (actorusername_has_any)\n  // SrcIpAddr extraction and filtering\n  | extend SrcIpAddr = tostring(InitiatedBy.user.ipAddress)\n  | where\n      (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SrcIpAddr, srcipaddr_has_any_prefix))\n  // Parse TargetResources for Object\n  | extend TargetResource = iff(array_length(TargetResources) > 0, TargetResources[0], dynamic(null))\n  | extend\n      Object = tostring(TargetResource.displayName),\n      ObjectId = tostring(TargetResource.id),\n      ObjectType = case(\n          tostring(TargetResource.type) == \"User\", \"Directory Service Object\",\n          tostring(TargetResource.type) == \"Group\", \"Directory Service Object\",\n          tostring(TargetResource.type) == \"Application\", \"Cloud Resource\",\n          tostring(TargetResource.type) == \"ServicePrincipal\", \"Cloud Resource\",\n          tostring(TargetResource.type) == \"Policy\", \"Policy Rule\",\n          tostring(TargetResource.type) == \"Role\", \"Configuration Atom\",\n          tostring(TargetResource.type) == \"Device\", \"Directory Service Object\",\n          \"Other\"\n      ),\n      OriginalObjectType = tostring(TargetResource.type)\n  | where array_length(object_has_any) == 0 or Object has_any (object_has_any)\n  // Parse NewValue and OldValue from modified properties\n  | extend ModifiedProperties = iff(array_length(TargetResource.modifiedProperties) > 0, TargetResource.modifiedProperties, dynamic(null))\n  | extend\n      NewValue = tostring(ModifiedProperties[0].newValue),\n      OldValue = tostring(ModifiedProperties[0].oldValue)\n  | where array_length(newvalue_has_any) == 0 or NewValue has_any (newvalue_has_any)\n  // Standard field mappings\n  | extend\n      EventCount = int(1),\n      EventStartTime = ActivityDateTime,\n      EventEndTime = ActivityDateTime,\n      EventProduct = 'Microsoft Entra ID',\n      EventVendor = 'Microsoft',\n      EventSchemaVersion = '0.1.2',\n      EventSchema = 'AuditEvent',\n      EventSeverity = iff(EventResult == \"Failure\", \"Low\", \"Informational\")\n  | project-rename\n      Operation = ActivityDisplayName,\n      EventOriginalUid = Id,\n      ActorSessionId = CorrelationId,\n      EventOriginalType = OperationName,\n      EventOriginalResultDetails = ResultReason,\n      TargetAppName = LoggedByService\n  // Actor fields\n  | extend\n      ActorUsernameType = iff(ActorUsername has \"@\", \"UPN\", iff(isnotempty(ActorUsername), \"Simple\", \"\")),\n      ActorUserIdType = iff(isnotempty(ActorUserId), \"AADID\", \"\"),\n      ActorScopeId = AADTenantId,\n      ActorScope = \"Microsoft Entra ID\"\n  // Target App fields\n  | extend\n      TargetAppType = \"SaaS application\"\n  // AdditionalFields\n  | extend AdditionalFields = bag_pack(\"Category\", Category, \"AdditionalDetails\", AdditionalDetails)\n  // Aliases\n  | extend\n      IpAddr = SrcIpAddr,\n      User = ActorUsername,\n      Application = TargetAppName,\n      Dst = TargetAppName,\n      Src = SrcIpAddr,\n      ActorUserUpn = iff(ActorUsernameType == \"UPN\", ActorUsername, \"\"),\n      ActorUserAadId = ActorUserId,\n      Value = NewValue,\n      Dvc = EventProduct\n  | project\n      TimeGenerated,\n      Type,\n      Operation,\n      Object,\n      ObjectId,\n      ObjectType,\n      OriginalObjectType,\n      OldValue,\n      NewValue,\n      Value,\n      EventOriginalUid,\n      EventOriginalType,\n      EventOriginalResultDetails,\n      EventCount,\n      EventStartTime,\n      EventEndTime,\n      EventProduct,\n      EventVendor,\n      EventSchemaVersion,\n      EventSchema,\n      EventResult,\n      EventSeverity,\n      EventType,\n      ActorUsername,\n      ActorUsernameType,\n      ActorUserId,\n      ActorUserIdType,\n      ActorUserType,\n      ActorScopeId,\n      ActorScope,\n      ActorSessionId,\n      ActorUserUpn,\n      ActorUserAadId,\n      SrcIpAddr,\n      TargetAppName,\n      TargetAppType,\n      AdditionalFields,\n      IpAddr,\n      User,\n      Application,\n      Dst,\n      Src,\n      Dvc\n};\nparser\n(\n  starttime = starttime,\n  endtime = endtime,\n  srcipaddr_has_any_prefix = srcipaddr_has_any_prefix,\n  actorusername_has_any = actorusername_has_any,\n  eventtype_in = eventtype_in,\n  eventresult = eventresult,\n  operation_has_any = operation_has_any,\n  object_has_any=object_has_any,\n  newvalue_has_any=newvalue_has_any,\n  disabled=disabled\n)\n",
+        "version": 1,
+        "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),actorusername_has_any:dynamic=dynamic([]),operation_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',object_has_any:dynamic=dynamic([]),newvalue_has_any:dynamic=dynamic([]),disabled:bool=False"
+      }
+    }
+  ]
+}

Parsers/ASimAuditEvent/CHANGELOG/ASimAuditEventMicrosoftEntraIDAuditLogs.md

@@ -0,0 +1,6 @@
+# Changelog for ASimAuditEventMicrosoftEntraIDAuditLogs.yaml
+
+## Version 0.1.0
+
+- (2026-02-11) Initial version - Microsoft Entra ID AuditLogs ASIM Audit Event parser
+

Parsers/ASimAuditEvent/CHANGELOG/vimAuditEventMicrosoftEntraIDAuditLogs.md

@@ -0,0 +1,6 @@
+# Changelog for vimAuditEventMicrosoftEntraIDAuditLogs.yaml
+
+## Version 0.1.0
+
+- (2026-02-11) Initial version - Microsoft Entra ID AuditLogs ASIM Audit Event filtering parser
+