ASIMAuthUpdate

[sparkmark]

Required items, please complete

Change(s):

• Updated Parser To Include Event ID 4768

Reason for Change(s):

• Update to parser

Version Updated:

• n/a

Testing Completed:

• Tested in our lab

Checked that the validations are passing and have addressed any issues that are present:

• Completed

[vakohl]

@sparkmark thankyou for your contribution. Every ASim parser has two files : ASim and vim (filter parser). Please update this parser's vim file with the same changes. https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftWindowsEvent.yaml

Also, please run ASIM tester function and attach the results in this PR for both ASim and vim parser. https://learn.microsoft.com/en-us/azure/sentinel/normalization-develop-parsers#test-parsers

[v-atulyadav]

Hi @sparkmark, please act on @vakohl's comments. Thanks

[sparkmark]

@sparkmark thankyou for your contribution. Every ASim parser has two files : ASim and vim (filter parser). Please update this parser's vim file with the same changes. https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftWindowsEvent.yaml

Also, please run ASIM tester function and attach the results in this PR for both ASim and vim parser. https://learn.microsoft.com/en-us/azure/sentinel/normalization-develop-parsers#test-parsers

Hey @vakohl @v-atulyadav ... so I'm running into some issues:

1. The existing parser (i.e. one created by MS) has errors and warnings itself.
2. If I run the existing ASimAuthenticationMicrosoftWindowsEvent parser I get an error "SecEventLogon"() argument add cscript summary hunting query #1 could not be parsed. However in the tester it's ok. But if I run mine using the tester I get the same error ?

So I'm a little bit stuck here.

[vakohl]

@sparkmark thankyou for your contribution. Every ASim parser has two files : ASim and vim (filter parser). Please update this parser's vim file with the same changes. https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftWindowsEvent.yaml
Also, please run ASIM tester function and attach the results in this PR for both ASim and vim parser. https://learn.microsoft.com/en-us/azure/sentinel/normalization-develop-parsers#test-parsers

Hey @vakohl @v-atulyadav ... so I'm running into some issues:

1. The existing parser (i.e. one created by MS) has errors and warnings itself.
2. If I run the existing ASimAuthenticationMicrosoftWindowsEvent parser I get an error "SecEventLogon"() argument add cscript summary hunting query #1 could not be parsed. However in the tester it's ok. But if I run mine using the tester I get the same error ?

So I'm a little bit stuck here.

@sparkmark for the error you are facing. when you are running parser code, please update the disabled paramter to false. see below screenshot.

Also, when running vim parser, please update last line as below:

[sparkmark]

@sparkmark thankyou for your contribution. Every ASim parser has two files : ASim and vim (filter parser). Please update this parser's vim file with the same changes. https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftWindowsEvent.yaml
Also, please run ASIM tester function and attach the results in this PR for both ASim and vim parser. https://learn.microsoft.com/en-us/azure/sentinel/normalization-develop-parsers#test-parsers

Hey @vakohl @v-atulyadav ... so I'm running into some issues:

1. The existing parser (i.e. one created by MS) has errors and warnings itself.
2. If I run the existing ASimAuthenticationMicrosoftWindowsEvent parser I get an error "SecEventLogon"() argument add cscript summary hunting query #1 could not be parsed. However in the tester it's ok. But if I run mine using the tester I get the same error ?

So I'm a little bit stuck here.

@sparkmark for the error you are facing. when you are running parser code, please update the disabled paramter to false. see below screenshot.

Also, when running vim parser, please update last line as below:

Thanks ... ran the tests .... these are the errors I get:

[sparkmark]

Hey guys ... going to close this PR ... have opened 8580 with both files required.