Skip to content

Commit 9c9706e

Browse files
sharonfi99sharonfi99
authored
CRTX-271521: re-open identity.* modeling rules (PR 2 of 7) (#45855)
Re-open PR #45418 after it was reverted by #45814. Re-adds the _2_11 (fromversion 8.15.0) modeling rule folders that map xdm.*.identity.* alongside xdm.*.user.*, and caps the previous rule with toversion 8.14.0. Packs: CyberArkPAS (1.2.8), ProofpointIsolation (1.0.13), TrendMicroInterScanWebSecurity (1.0.8).
1 parent add2443 commit 9c9706e

18 files changed

Lines changed: 587 additions & 3 deletions

File tree

‎Packs/CyberArkPAS/ModelingRules/CyberArkISP/CyberArkISP.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
fromversion: 8.4.0
2+
toversion: 8.14.0
23
id: CyberArk_ISP_ModelingRule
34
name: CyberArk ISP Modeling Rule
45
rules: ''

‎Packs/CyberArkPAS/ModelingRules/CyberArkISP_2_11/CyberArkISP_2_11.xif‎

Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
/* Auth Classification Rule */
2+
[RULE: CyberArk_Audit_Auth_Classification]
3+
alter
4+
is_auth = if(
5+
lowercase(message) in (
6+
"cloud.core.login.multifactorchallenge",
7+
"cloud.core.login",
8+
"cloud.core.oauthtoken.create",
9+
"cloud.core.mfasummary",
10+
"cloud.core.login.multifactorchallenge.multifactorresponse"
11+
) or auditCode in (
12+
"IDP2005", "IDP2008", "IDP2007", "IDP2009",
13+
"IDP2013", "IDP2014", "IDP6006"
14+
), true, false
15+
);
16+
17+
/* SaaS Classification Rule */
18+
[RULE: CyberArk_Audit_Saas_Classification]
19+
alter
20+
is_saas = if(
21+
auditCode in (
22+
"IDP2001", "IDP2002", "IDP2003", "IDP2701", "IDP2702", "IDP3001", "IDP3004", "IDP4001",
23+
"IDP4002", "IDP6001", "IDP6004", "IDP6010", "IDP6011", "IDP6016",
24+
"IDP1501", "IDP1502",
25+
"IDP4005", "IDP5001", "IDP5002", "IDP5003", "IDP5004", "IDP5005", "IDP5006",
26+
"IDP1201", "IDP1204", "IDP2401", "IDP2402", "IDP2023",
27+
"IDP1707", "IDP1706", "IDP1802", "IDP1803", "IDP2102"
28+
), true, false
29+
);
30+
31+
/* Auth 102 - CyberArk Audit Authentication Story Mapping */
32+
[RULE: CyberArk_Audit_Auth_Mapping]
33+
alter
34+
get_source_ip = coalesce(json_extract_scalar(customData, "$.client_ip_address"), source),
35+
get_success = json_extract_scalar(customData, "$.success"),
36+
get_failure_reason = json_extract_scalar(customData, "$.failure_reason"),
37+
get_denied_by_user = json_extract_scalar(customData, "$.denied_by_user"),
38+
get_mechanism = json_extract_scalar(customData, "$.mechanism"),
39+
get_auth_method = json_extract_scalar(customData, "$.authentication_method"),
40+
get_factors = json_extract_scalar(customData, "$.factors"),
41+
get_roles = json_extract_scalar(customData, "$.roles"),
42+
get_mobile_device = json_extract_scalar(customData, "$.mobile_device"),
43+
get_cookie_session = json_extract_scalar(customData, "$.cookie_session"),
44+
get_device_os = json_extract_scalar(customData, "$.device_os"),
45+
get_browser_name = json_extract_scalar(customData, "$.browser_name"),
46+
get_user_agent = json_extract_scalar(customData, "$.user_agent"),
47+
get_entity_name = json_extract_scalar(customData, "$.entity_name"),
48+
get_session_id = json_extract_scalar(customData, "$.internal_session_id"),
49+
get_session_guid = json_extract_scalar(customData, "$.session_guid"),
50+
get_city = json_extract_scalar(customData, "$.geoip_city_name"),
51+
get_country = json_extract_scalar(customData, "$.geoip_country_name"),
52+
get_latitude = json_extract_scalar(customData, "$.geoip_latitude"),
53+
get_longitude = json_extract_scalar(customData, "$.geoip_longitude")
54+
| alter
55+
get_mfa_result = json_extract_scalar(customData, "$.mfa_result")
56+
| alter
57+
get_outcome = if(
58+
get_success = "True", XDM_CONST.OUTCOME_SUCCESS,
59+
auditCode = "IDP2005" and get_cookie_session != null, XDM_CONST.OUTCOME_SUCCESS,
60+
auditCode = "IDP2009", XDM_CONST.OUTCOME_SUCCESS,
61+
lowercase(message) = "cloud.core.mfasummary" and get_mfa_result = "Success", XDM_CONST.OUTCOME_SUCCESS,
62+
lowercase(message) = "cloud.core.login.multifactorchallenge", XDM_CONST.OUTCOME_PARTIAL,
63+
XDM_CONST.OUTCOME_FAILED
64+
)
65+
| alter
66+
xdm.event.type = "authentication",
67+
xdm.event.tags = arraycreate(XDM_CONST.EVENT_TAG_AUTHENTICATION),
68+
xdm.event.id = uuid,
69+
xdm.event.original_event_type = lowercase(message),
70+
xdm.event.description = action,
71+
xdm.event.operation = if(
72+
get_factors contains ",", XDM_CONST.OPERATION_TYPE_AUTH_MFA,
73+
auditCode in ("IDP2012", "IDP2013", "IDP2014"), XDM_CONST.OPERATION_TYPE_AUTH_MFA,
74+
XDM_CONST.OPERATION_TYPE_AUTH_LOGIN
75+
),
76+
xdm.event.operation_sub_type = if(
77+
get_mechanism = "Email", "email",
78+
get_mechanism = "SMS", "sms",
79+
get_auth_method = "Federation", "Generic SSO",
80+
"password"
81+
),
82+
xdm.event.outcome = get_outcome,
83+
xdm.event.outcome_reason = get_failure_reason,
84+
xdm.source.ipv4 = get_source_ip,
85+
xdm.source.port = to_integer(0),
86+
xdm.source.user_agent = get_user_agent,
87+
xdm.source.user.upn = username,
88+
xdm.source.identity.upn = username,
89+
xdm.source.user.identifier = userId,
90+
xdm.source.identity.identifier = userId,
91+
xdm.source.user.username = username,
92+
xdm.source.identity.username = username,
93+
xdm.source.user.user_type = if(identityType = "HUMAN", XDM_CONST.USER_TYPE_REGULAR, XDM_CONST.USER_TYPE_SERVICE_ACCOUNT),
94+
xdm.source.identity.user_type = if(identityType = "HUMAN", XDM_CONST.USER_TYPE_REGULAR, XDM_CONST.USER_TYPE_SERVICE_ACCOUNT),
95+
xdm.source.host.device_id = get_source_ip,
96+
xdm.source.host.device_category = if(get_mobile_device = "True", "Mobile", "Computer"),
97+
xdm.source.host.os_family = if(
98+
get_device_os contains "Windows", XDM_CONST.OS_FAMILY_WINDOWS,
99+
get_device_os contains "Mac", XDM_CONST.OS_FAMILY_MACOS,
100+
get_device_os contains "Linux", XDM_CONST.OS_FAMILY_LINUX,
101+
get_device_os contains "Android", XDM_CONST.OS_FAMILY_ANDROID,
102+
get_device_os contains "iOS", XDM_CONST.OS_FAMILY_IOS,
103+
get_device_os contains "Chrome", XDM_CONST.OS_FAMILY_CHROMEOS,
104+
get_device_os = null, null,
105+
to_string(get_device_os)
106+
),
107+
xdm.source.application.name = get_browser_name,
108+
xdm.source.location.city = get_city,
109+
xdm.source.location.country = get_country,
110+
xdm.source.location.latitude = to_float(get_latitude),
111+
xdm.source.location.longitude = to_float(get_longitude),
112+
xdm.target.ipv4 = "",
113+
xdm.target.port = to_integer(0),
114+
xdm.target.resource.name = get_entity_name,
115+
xdm.network.ip_protocol = XDM_CONST.IP_PROTOCOL_TCP,
116+
xdm.network.session_id = customData,
117+
xdm.session_context_id = coalesce(get_session_id, get_session_guid),
118+
xdm.logon.type = if(message = "Cloud.Core.O365WsTrustLogin", XDM_CONST.LOGON_TYPE_SERVICE, XDM_CONST.LOGON_TYPE_INTERACTIVE),
119+
xdm.auth.service = if(
120+
auditCode in ("IDP2013", "IDP2014", "IDP2012"), "IDP",
121+
get_auth_method = "Federation", "SP",
122+
"IDP"
123+
),
124+
xdm.auth.privilege_level = if(
125+
username = "SYSTEM$", XDM_CONST.PRIVILEGE_LEVEL_SYSTEM,
126+
get_roles contains "sysadmin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
127+
get_roles contains "Admin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
128+
XDM_CONST.PRIVILEGE_LEVEL_USER
129+
),
130+
xdm.observer.type = "Identity";
131+
132+
/* SaaS Audit - CyberArk Audit to XDM SaaS Story Mapping */
133+
[RULE: CyberArk_Audit_Saas_Mapping]
134+
alter
135+
get_source_ip = coalesce(json_extract_scalar(customData, "$.source_ip_address"), source),
136+
get_roles = json_extract_scalar(customData, "$.roles"),
137+
get_level = json_extract_scalar(customData, "$.level"),
138+
get_status = json_extract_scalar(customData, "$.status"),
139+
get_failure_reason = json_extract_scalar(customData, "$.failure_reason"),
140+
get_user_state = json_extract_scalar(customData, "$.user_state"),
141+
get_user_agent = json_extract_scalar(customData, "$.user_agent"),
142+
get_browser_name = json_extract_scalar(customData, "$.browser_name"),
143+
get_entity_uuid = json_extract_scalar(customData, "$.entity_uuid"),
144+
get_application_id = json_extract_scalar(customData, "$.application_id"),
145+
get_role_id = json_extract_scalar(customData, "$.role_id"),
146+
get_device_id = json_extract_scalar(customData, "$.device_id"),
147+
get_target_user_id = json_extract_scalar(customData, "$.target_user_id"),
148+
get_proxy_id = json_extract_scalar(customData, "$.proxy_id"),
149+
get_application_name = json_extract_scalar(customData, "$.application_name"),
150+
get_entity_name = json_extract_scalar(customData, "$.entity_name"),
151+
get_role_name = json_extract_scalar(customData, "$.role_name"),
152+
get_policy_name = json_extract_scalar(customData, "$.policy_name"),
153+
get_object_name = json_extract_scalar(customData, "$.object_name"),
154+
get_device_name = json_extract_scalar(customData, "$.device_name"),
155+
get_success = json_extract_scalar(customData, "$.success"),
156+
get_app_url = json_extract_scalar(customData, "$.app_url"),
157+
get_session_id = json_extract_scalar(customData, "$.internal_session_id"),
158+
get_session_guid = json_extract_scalar(customData, "$.session_guid"),
159+
get_action_type_lower = lowercase(actionType),
160+
get_message_lower = lowercase(message)
161+
| alter
162+
xdm.event.type = "saas audit",
163+
xdm.event.id = uuid,
164+
xdm.event.original_event_type = get_message_lower,
165+
xdm.event.operation = if(
166+
get_action_type_lower in ("create", "add"), XDM_CONST.OPERATION_TYPE_CREATE,
167+
get_action_type_lower = "delete" or get_message_lower contains "remove", XDM_CONST.OPERATION_TYPE_DELETE,
168+
get_action_type_lower in ("edit", "approve", "upgrade"), XDM_CONST.OPERATION_TYPE_UPDATE,
169+
null
170+
),
171+
xdm.event.outcome = if(
172+
get_level = "Error" or get_status = "NonExist" or get_success = "False" or get_message_lower ~= "fail$", XDM_CONST.OUTCOME_FAILED,
173+
get_status in ("Deleted", "Created", "Updated", "Success", "Normal"), XDM_CONST.OUTCOME_SUCCESS,
174+
XDM_CONST.OUTCOME_SUCCESS
175+
),
176+
xdm.event.outcome_reason = coalesce(get_failure_reason, get_status, get_user_state),
177+
xdm.source.ipv4 = coalesce(get_source_ip, ""),
178+
xdm.source.user_agent = get_user_agent,
179+
xdm.source.user.upn = username,
180+
xdm.source.identity.upn = username,
181+
xdm.source.user.identifier = userId,
182+
xdm.source.identity.identifier = userId,
183+
xdm.source.user.identity_type = if(
184+
username contains "SYSTEM$" or username contains "RA-SYSTEM-USER$", "SERVICE_ACCOUNT",
185+
identityType = "HUMAN", "USER",
186+
"USER"
187+
),
188+
xdm.source.identity.identity_type = if(
189+
username contains "SYSTEM$" or username contains "RA-SYSTEM-USER$", "SERVICE_ACCOUNT",
190+
identityType = "HUMAN", "USER",
191+
"USER"
192+
),
193+
xdm.source.user.user_type = if(
194+
username contains "SYSTEM$" or username contains "RA-SYSTEM-USER$", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT,
195+
XDM_CONST.USER_TYPE_REGULAR
196+
),
197+
xdm.source.identity.user_type = if(
198+
username contains "SYSTEM$" or username contains "RA-SYSTEM-USER$", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT,
199+
XDM_CONST.USER_TYPE_REGULAR
200+
),
201+
xdm.source.application.name = get_browser_name,
202+
xdm.source.cloud.project_id = tenantId,
203+
xdm.session_context_id = coalesce(get_session_id, get_session_guid),
204+
xdm.auth.privilege_level = if(
205+
get_roles contains "sysadmin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
206+
get_roles contains "Admin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
207+
XDM_CONST.PRIVILEGE_LEVEL_USER
208+
),
209+
xdm.intermediate.user.identifier = coalesce(get_application_id, get_application_name, ""),
210+
xdm.intermediate.identity.identifier = coalesce(get_application_id, get_application_name, ""),
211+
xdm.target.resource.type = if(
212+
auditCode ~= "^IDP4", "Policy",
213+
auditCode ~= "^IDP15", "Access Right",
214+
auditCode ~= "^IDP60" or auditCode ~= "^IDP21", "Application",
215+
auditCode in ("IDP2001", "IDP2002", "IDP2003", "IDP2701"), "User",
216+
auditCode in ("IDP1201", "IDP1204"), "Collection",
217+
auditCode in ("IDP1803", "IDP1802"), "CONFIGURATION",
218+
auditCode in ("IDP1707", "IDP1706"), "Device",
219+
"Other"
220+
),
221+
xdm.target.resource.id = coalesce(get_entity_uuid, get_application_id, get_role_id, get_device_id, get_target_user_id, get_proxy_id),
222+
xdm.target.resource.name = coalesce(get_application_name, get_entity_name, get_role_name, get_policy_name, get_object_name, get_device_name),
223+
xdm.target.url = coalesce(get_app_url, ""),
224+
xdm.database.statement = coalesce(get_message_lower, action, ""),
225+
xdm.observer.type = "Identity";
226+
227+
[MODEL: dataset="cyberark_isp_raw"]
228+
/* Auth 102 - CyberArk Audit Authentication Story */
229+
call CyberArk_Audit_Auth_Classification
230+
| filter is_auth = true
231+
| call CyberArk_Audit_Auth_Mapping;
232+
233+
/* SaaS Audit - CyberArk Audit to XDM SaaS Story */
234+
call CyberArk_Audit_Saas_Classification
235+
| filter is_saas = true
236+
| call CyberArk_Audit_Saas_Mapping;

‎Packs/CyberArkPAS/ModelingRules/CyberArkISP_2_11/CyberArkISP_2_11.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
fromversion: 8.15.0
2+
id: CyberArk_ISP_ModelingRule
3+
name: CyberArk ISP Modeling Rule
4+
rules: ''
5+
schema: ''
6+
tags: ''
7+
supportedModules:
8+
- xsiam

‎Packs/CyberArkPAS/ModelingRules/CyberArkISP_2_11/CyberArkISP_2_11_schema.json‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
{
2+
"cyberark_isp_raw": {
3+
"uuid": {
4+
"type": "string",
5+
"is_array": false
6+
},
7+
"tenantId": {
8+
"type": "string",
9+
"is_array": false
10+
},
11+
"timestamp": {
12+
"type": "string",
13+
"is_array": false
14+
},
15+
"username": {
16+
"type": "string",
17+
"is_array": false
18+
},
19+
"applicationCode": {
20+
"type": "string",
21+
"is_array": false
22+
},
23+
"auditCode": {
24+
"type": "string",
25+
"is_array": false
26+
},
27+
"auditType": {
28+
"type": "string",
29+
"is_array": false
30+
},
31+
"action": {
32+
"type": "string",
33+
"is_array": false
34+
},
35+
"userId": {
36+
"type": "string",
37+
"is_array": false
38+
},
39+
"source": {
40+
"type": "string",
41+
"is_array": false
42+
},
43+
"actionType": {
44+
"type": "string",
45+
"is_array": false
46+
},
47+
"component": {
48+
"type": "string",
49+
"is_array": false
50+
},
51+
"serviceName": {
52+
"type": "string",
53+
"is_array": false
54+
},
55+
"accessMethod": {
56+
"type": "string",
57+
"is_array": false
58+
},
59+
"accountId": {
60+
"type": "string",
61+
"is_array": false
62+
},
63+
"target": {
64+
"type": "string",
65+
"is_array": false
66+
},
67+
"command": {
68+
"type": "string",
69+
"is_array": false
70+
},
71+
"sessionId": {
72+
"type": "string",
73+
"is_array": false
74+
},
75+
"message": {
76+
"type": "string",
77+
"is_array": false
78+
},
79+
"customData": {
80+
"type": "string",
81+
"is_array": false
82+
},
83+
"cloudProvider": {
84+
"type": "string",
85+
"is_array": false
86+
},
87+
"cloudWorkspacesAndRoles": {
88+
"type": "string",
89+
"is_array": false
90+
},
91+
"cloudIdentities": {
92+
"type": "string",
93+
"is_array": false
94+
},
95+
"cloudAssets": {
96+
"type": "string",
97+
"is_array": false
98+
},
99+
"safe": {
100+
"type": "string",
101+
"is_array": false
102+
},
103+
"accountName": {
104+
"type": "string",
105+
"is_array": false
106+
},
107+
"targetPlatform": {
108+
"type": "string",
109+
"is_array": false
110+
},
111+
"targetAccount": {
112+
"type": "string",
113+
"is_array": false
114+
},
115+
"identityType": {
116+
"type": "string",
117+
"is_array": false
118+
},
119+
"correlationId": {
120+
"type": "string",
121+
"is_array": false
122+
},
123+
"isDr": {
124+
"type": "boolean",
125+
"is_array": false
126+
},
127+
"originRegion": {
128+
"type": "string",
129+
"is_array": false
130+
}
131+
}
132+
}

‎Packs/CyberArkPAS/ReleaseNotes/1_2_8.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
2+
#### Modeling Rules
3+
4+
##### New: CyberArk ISP Modeling Rule
5+
6+
- New: Added a new modeling rule version that maps the `xdm.*.identity.*` fields alongside the existing `xdm.*.user.*` fields.

0 commit comments

Comments
 (0)