Skip to content

Commit 56042e9

Browse files
akshotiamit-paakshotiamit-pa
committed
template xif
1 parent 4e29f2c commit 56042e9

1 file changed

Lines changed: 206 additions & 1 deletion

File tree

‎Packs/CyberArkIdentity/ModelingRules/CyberArkIdentityEventCollector_1_3/CyberArkIdentityEventCollector_1_3.xif‎

Lines changed: 206 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,198 @@
1+
/* Classification Rule - determines if event is Auth 102 or SaaS Audit */
2+
[RULE: CyberArk_Auth_OR_Saas_classification]
3+
alter
4+
is_auth = if(
5+
EventType in (
6+
"Cloud.Core.Login.MultifactorChallenge",
7+
"Cloud.Core.Login",
8+
"Cloud.Core.O365WsTrustLogin",
9+
"Cloud.Core.SamlResponseGenerate",
10+
"Cloud.Core.SamlResponseValidate",
11+
"Cloud.Core.OAuthToken.Create",
12+
"Cloud.Core.StartImpersonate",
13+
"Cloud.Core.MfaSummary",
14+
"Cloud.Core.Login.MultifactorChallenge.MultifactorResponse"
15+
) or AuditCode in (
16+
"IDP2005", "IDP2008", "IDP2007", "IDP2009",
17+
"IDP2013", "IDP2014", "IDP2020", "IDP2101", "IDP6006"
18+
)
19+
),
20+
is_saas = if(
21+
AuditCode in (
22+
"IDP2001", "IDP2002", "IDP2003", "IDP2005", "IDP2007", "IDP2008", "IDP2009",
23+
"IDP2013", "IDP2014", "IDP2701", "IDP2702", "IDP3001", "IDP3004", "IDP4001",
24+
"IDP4002", "IDP6001", "IDP6004", "IDP6006", "IDP6010", "IDP6011", "IDP6016",
25+
"IDP1501", "IDP1502"
26+
)
27+
);
28+
29+
/* Auth 102 - CyberArk IdP Authentication Story Mapping */
30+
[RULE: CyberArk_Auth_Mapping]
31+
alter
32+
source_ip = coalesce(json_extract_scalar(CustomData, "$.source_ip_address"), FromIPAddress),
33+
success_val = json_extract_scalar(CustomData, "$.success"),
34+
failure_reason = json_extract_scalar(CustomData, "$.failure_reason"),
35+
denied_by_user = json_extract_scalar(CustomData, "$.denied_by_user"),
36+
mechanism = json_extract_scalar(CustomData, "$.mechanism"),
37+
auth_method_val = json_extract_scalar(CustomData, "$.authentication_method"),
38+
factors_val = json_extract_scalar(CustomData, "$.factors"),
39+
roles_val = json_extract_scalar(CustomData, "$.roles"),
40+
mobile_device_val = json_extract_scalar(CustomData, "$.mobile_device"),
41+
cookie_session_val = json_extract_scalar(CustomData, "$.cookie_session"),
42+
device_os_val = json_extract_scalar(CustomData, "$.device_os"),
43+
browser_name_val = json_extract_scalar(CustomData, "$.browser_name"),
44+
user_agent_val = json_extract_scalar(CustomData, "$.user_agent"),
45+
entity_name_val = json_extract_scalar(CustomData, "$.entity_name"),
46+
session_id_val = json_extract_scalar(CustomData, "$.internal_session_id"),
47+
city_val = json_extract_scalar(CustomData, "$.geoip_city_name"),
48+
country_val = json_extract_scalar(CustomData, "$.geoip_country_name")
49+
| alter
50+
xdm.event.type = "authentication",
51+
xdm.event.tags = arraycreate(XDM_CONST.EVENT_TAG_AUTHENTICATION),
52+
xdm.source.ipv4 = source_ip,
53+
xdm.target.ipv4 = coalesce(DstHost, ""),
54+
xdm.source.port = to_integer(0),
55+
xdm.target.port = to_integer(0),
56+
xdm.network.ip_protocol = coalesce(Protocol, ""),
57+
xdm.source.user.upn = UserName,
58+
xdm.source.user.identifier = UserGuid,
59+
xdm.source.user.username = UserName,
60+
xdm.event.original_event_type = EventType,
61+
xdm.event.description = Action,
62+
xdm.event.id = _id,
63+
xdm.source.host.device_id = coalesce(json_extract_scalar(CustomData, "$.source_ip_address"), FromIPAddress),
64+
xdm.event.operation = if(
65+
factors_val contains ",", "MFA",
66+
AuditCode in ("IDP2012", "IDP2013", "IDP2014"), "MFA",
67+
"Login"
68+
),
69+
xdm.logon.type = if(EventType = "Cloud.Core.O365WsTrustLogin", XDM_CONST.LOGON_TYPE_SERVICE, XDM_CONST.LOGON_TYPE_INTERACTIVE),
70+
xdm.auth.service = if(
71+
AuditCode in ("IDP2013", "IDP2014", "IDP2012"), "IDP",
72+
auth_method_val = "Federation", "SP",
73+
"IDP"
74+
),
75+
xdm.event.operation_sub_type = if(
76+
mechanism = "Email", "email",
77+
mechanism = "SMS", "sms",
78+
auth_method_val = "Federation", "Generic SSO",
79+
"password"
80+
),
81+
xdm.event.outcome = if(
82+
success_val = "True", XDM_CONST.OUTCOME_SUCCESS,
83+
AuditCode = "IDP2005" and cookie_session_val != "null", XDM_CONST.OUTCOME_SUCCESS,
84+
AuditCode = "IDP2009", XDM_CONST.OUTCOME_SUCCESS,
85+
XDM_CONST.OUTCOME_FAILED
86+
),
87+
xdm.event.outcome_reason = if(
88+
failure_reason contains "abandoned", "mfa_expired",
89+
failure_reason contains "Internal error", "OTHER",
90+
denied_by_user = "True", "user_reject",
91+
"failed_login"
92+
),
93+
xdm.source.user.user_type = if(IdentityType = "HUMAN", XDM_CONST.USER_TYPE_REGULAR, XDM_CONST.USER_TYPE_SERVICE_ACCOUNT),
94+
xdm.auth.privilege_level = if(
95+
roles_val contains "sysadmin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
96+
roles_val contains "Admin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
97+
XDM_CONST.PRIVILEGE_LEVEL_USER
98+
),
99+
xdm.target.resource.name = entity_name_val,
100+
xdm.source.user_agent = user_agent_val,
101+
xdm.source.application.name = browser_name_val,
102+
xdm.source.host.os_family = if(
103+
device_os_val contains "Windows", XDM_CONST.OS_FAMILY_WINDOWS,
104+
device_os_val contains "Mac", XDM_CONST.OS_FAMILY_MACOS,
105+
device_os_val contains "Linux", XDM_CONST.OS_FAMILY_LINUX,
106+
device_os_val contains "Android", XDM_CONST.OS_FAMILY_ANDROID,
107+
device_os_val contains "iOS", XDM_CONST.OS_FAMILY_IOS,
108+
device_os_val contains "Chrome", XDM_CONST.OS_FAMILY_CHROMEOS,
109+
device_os_val = null, null,
110+
to_string(device_os_val)
111+
),
112+
xdm.source.host.device_category = if(mobile_device_val = "True", "Mobile", "Computer"),
113+
xdm.network.session_id = session_id_val,
114+
xdm.source.location.city = city_val,
115+
xdm.source.location.country = country_val;
116+
117+
/* SaaS Audit - CyberArk IdP to XDM SaaS Story Mapping */
118+
[RULE: CyberArk_Saas_Mapping]
119+
alter
120+
source_ip = coalesce(json_extract_scalar(CustomData, "$.source_ip_address"), FromIPAddress),
121+
roles_val = json_extract_scalar(CustomData, "$.roles"),
122+
level_val = json_extract_scalar(CustomData, "$.level"),
123+
status_val = json_extract_scalar(CustomData, "$.status"),
124+
failure_reason_val = json_extract_scalar(CustomData, "$.failure_reason"),
125+
user_state_val = json_extract_scalar(CustomData, "$.user_state"),
126+
user_agent_val = json_extract_scalar(CustomData, "$.user_agent"),
127+
device_os_val = json_extract_scalar(CustomData, "$.device_os"),
128+
entity_uuid_val = json_extract_scalar(CustomData, "$.entity_uuid"),
129+
application_id_val = json_extract_scalar(CustomData, "$.application_id"),
130+
role_id_val = json_extract_scalar(CustomData, "$.role_id"),
131+
application_name_val = json_extract_scalar(CustomData, "$.application_name"),
132+
entity_name_val = json_extract_scalar(CustomData, "$.entity_name"),
133+
role_name_val = json_extract_scalar(CustomData, "$.role_name"),
134+
policy_name_val = json_extract_scalar(CustomData, "$.policy_name"),
135+
object_name_val = json_extract_scalar(CustomData, "$.object_name"),
136+
session_id_val = json_extract_scalar(CustomData, "$.internal_session_id"),
137+
session_guid_val = json_extract_scalar(CustomData, "$.session_guid"),
138+
browser_name_val = json_extract_scalar(CustomData, "$.browser_name"),
139+
action_type_lower = lowercase(ActionType),
140+
message_lower = lowercase(EventType)
141+
| alter
142+
xdm.event.type = "saas audit",
143+
xdm.event.id = Uuid,
144+
xdm.source.cloud.project_id = TenantId,
145+
xdm.session_context_id = coalesce(session_id_val, session_guid_val),
146+
xdm.event.original_event_type = message_lower,
147+
xdm.event.operation = if(
148+
action_type_lower in ("create", "add"), "CREATE",
149+
action_type_lower = "delete" or message_lower contains "remove", "DELETE",
150+
action_type_lower in ("edit", "approve", "upgrade"), "MODIFY",
151+
action_type_lower = "connect", "OTHER",
152+
"OTHER"
153+
),
154+
xdm.source.user.upn = UserName,
155+
xdm.source.user.identifier = UserGuid,
156+
xdm.source.user.identity_type = if(
157+
UserName contains "SYSTEM$" or UserName contains "RA-SYSTEM-USER$", "SERVICE_ACCOUNT",
158+
IdentityType = "HUMAN", "USER",
159+
"USER"
160+
),
161+
xdm.auth.privilege_level = if(
162+
roles_val contains "sysadmin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
163+
roles_val contains "Admin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
164+
XDM_CONST.PRIVILEGE_LEVEL_USER
165+
),
166+
xdm.event.outcome = if(
167+
level_val = "Error" or status_val = "NonExist", XDM_CONST.OUTCOME_FAILED,
168+
status_val in ("Deleted", "Created", "Updated", "Success", "Normal"), XDM_CONST.OUTCOME_SUCCESS,
169+
XDM_CONST.OUTCOME_SUCCESS
170+
),
171+
xdm.event.outcome_reason = coalesce(failure_reason_val, status_val, user_state_val),
172+
xdm.target.resource.type = if(
173+
AuditCode ~= "^IDP4", "Policy",
174+
AuditCode ~= "^IDP15", "Access Right",
175+
AuditCode ~= "^IDP60" or AuditCode ~= "^IDP21", "Application",
176+
AuditCode in ("IDP2001", "IDP2002", "IDP2003", "IDP2701"), "User",
177+
"Other"
178+
),
179+
xdm.target.resource.id = coalesce(entity_uuid_val, application_id_val, role_id_val),
180+
xdm.target.resource.name = coalesce(application_name_val, entity_name_val, role_name_val, policy_name_val, object_name_val),
181+
xdm.source.user_agent = user_agent_val,
182+
xdm.source.ipv4 = source_ip,
183+
xdm.source.application.name = browser_name_val,
184+
xdm.source.host.os_family = if(
185+
device_os_val contains "Windows", XDM_CONST.OS_FAMILY_WINDOWS,
186+
device_os_val contains "Mac", XDM_CONST.OS_FAMILY_MACOS,
187+
device_os_val contains "Linux", XDM_CONST.OS_FAMILY_LINUX,
188+
device_os_val contains "Android", XDM_CONST.OS_FAMILY_ANDROID,
189+
device_os_val contains "iOS", XDM_CONST.OS_FAMILY_IOS,
190+
device_os_val contains "Chrome", XDM_CONST.OS_FAMILY_CHROMEOS,
191+
device_os_val = null, null,
192+
to_string(device_os_val)
193+
),
194+
xdm.observer.type = "Identity";
195+
1196
[MODEL: dataset=cyberark_identity_raw]
2197
filter
3198
EventType in ("Cloud.Core.OAuthToken.Create", "Cloud.Core.Logout", "Cloud.Core.MfaSummary", "Cloud.Core.StartImpersonate","Cloud.Core.Login", "Cloud.Core.LoginFail", "Cloud.Core.Logout", "Cloud.Core.OAuthToken.InvalidClient" )
@@ -31,4 +226,14 @@ filter EventType not in ("Cloud.Core.OAuthToken.Create", "Cloud.Core.Logout", "
31226
xdm.target.resource_before.type = OldLicenseType,
32227
xdm.target.resource.sub_type = MobileAppType,
33228
xdm.session_context_id = coalesce(JobUniqueId, SessionId),
34-
xdm.event.type=EventType;
229+
xdm.event.type=EventType;
230+
231+
/* Auth 102 - CyberArk IdP Authentication Story */
232+
call CyberArk_Auth_OR_Saas_classification
233+
| filter is_auth
234+
| call CyberArk_Auth_Mapping;
235+
236+
/* SaaS Audit - CyberArk IdP to XDM SaaS Story */
237+
call CyberArk_Auth_OR_Saas_classification
238+
| filter is_saas
239+
| call CyberArk_Saas_Mapping;

0 commit comments

Comments
 (0)