Skip to content

Commit e129e8f

Browse files
akshotiamit-paCI Bot
akshotiamit-pa
and
CI Bot
authored
CRTX-220668-CyberArkIdentity-StoryMapping (#43649)
* update xif yml schema * update readme rn metadata * remove eventtypes without samples * fix precommit * fix precommit2 * ai review fix * update files * update readme * update rn and readme * fix precommit * fix yml validation * Trigger GitHub pipeline (user-created PR) --------- Co-authored-by: CI Bot <ci@demisto.com>
1 parent 02f16d5 commit e129e8f

6 files changed

Lines changed: 499 additions & 5 deletions

File tree

‎Packs/CyberArkPAS/ModelingRules/CyberArkISP/CyberArkISP.xif‎

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
/* Auth Classification Rule */
2+
[RULE: CyberArk_Audit_Auth_Classification]
3+
alter
4+
is_auth = if(
5+
lowercase(message) in (
6+
"cloud.core.login.multifactorchallenge",
7+
"cloud.core.login",
8+
"cloud.core.oauthtoken.create",
9+
"cloud.core.mfasummary",
10+
"cloud.core.login.multifactorchallenge.multifactorresponse"
11+
) or auditCode in (
12+
"IDP2005", "IDP2008", "IDP2007", "IDP2009",
13+
"IDP2013", "IDP2014", "IDP6006"
14+
), true, false
15+
);
16+
17+
/* SaaS Classification Rule */
18+
[RULE: CyberArk_Audit_Saas_Classification]
19+
alter
20+
is_saas = if(
21+
auditCode in (
22+
"IDP2001", "IDP2002", "IDP2003", "IDP2701", "IDP2702", "IDP3001", "IDP3004", "IDP4001",
23+
"IDP4002", "IDP6001", "IDP6004", "IDP6010", "IDP6011", "IDP6016",
24+
"IDP1501", "IDP1502",
25+
"IDP4005", "IDP5001", "IDP5002", "IDP5003", "IDP5004", "IDP5005", "IDP5006",
26+
"IDP1201", "IDP1204", "IDP2401", "IDP2402", "IDP2023",
27+
"IDP1707", "IDP1706", "IDP1802", "IDP1803", "IDP2102"
28+
), true, false
29+
);
30+
31+
/* Auth 102 - CyberArk Audit Authentication Story Mapping */
32+
[RULE: CyberArk_Audit_Auth_Mapping]
33+
alter
34+
get_source_ip = coalesce(json_extract_scalar(customData, "$.client_ip_address"), source),
35+
get_success = json_extract_scalar(customData, "$.success"),
36+
get_failure_reason = json_extract_scalar(customData, "$.failure_reason"),
37+
get_denied_by_user = json_extract_scalar(customData, "$.denied_by_user"),
38+
get_mechanism = json_extract_scalar(customData, "$.mechanism"),
39+
get_auth_method = json_extract_scalar(customData, "$.authentication_method"),
40+
get_factors = json_extract_scalar(customData, "$.factors"),
41+
get_roles = json_extract_scalar(customData, "$.roles"),
42+
get_mobile_device = json_extract_scalar(customData, "$.mobile_device"),
43+
get_cookie_session = json_extract_scalar(customData, "$.cookie_session"),
44+
get_device_os = json_extract_scalar(customData, "$.device_os"),
45+
get_browser_name = json_extract_scalar(customData, "$.browser_name"),
46+
get_user_agent = json_extract_scalar(customData, "$.user_agent"),
47+
get_entity_name = json_extract_scalar(customData, "$.entity_name"),
48+
get_session_id = json_extract_scalar(customData, "$.internal_session_id"),
49+
get_session_guid = json_extract_scalar(customData, "$.session_guid"),
50+
get_city = json_extract_scalar(customData, "$.geoip_city_name"),
51+
get_country = json_extract_scalar(customData, "$.geoip_country_name"),
52+
get_latitude = json_extract_scalar(customData, "$.geoip_latitude"),
53+
get_longitude = json_extract_scalar(customData, "$.geoip_longitude")
54+
| alter
55+
get_outcome = if(
56+
get_success = "True", XDM_CONST.OUTCOME_SUCCESS,
57+
auditCode = "IDP2005" and get_cookie_session != null, XDM_CONST.OUTCOME_SUCCESS,
58+
auditCode = "IDP2009", XDM_CONST.OUTCOME_SUCCESS,
59+
XDM_CONST.OUTCOME_FAILED
60+
)
61+
| alter
62+
xdm.event.type = "authentication",
63+
xdm.event.tags = arraycreate(XDM_CONST.EVENT_TAG_AUTHENTICATION),
64+
xdm.event.id = uuid,
65+
xdm.event.original_event_type = lowercase(message),
66+
xdm.event.description = action,
67+
xdm.event.operation = if(
68+
get_factors contains ",", XDM_CONST.OPERATION_TYPE_AUTH_MFA,
69+
auditCode in ("IDP2012", "IDP2013", "IDP2014"), XDM_CONST.OPERATION_TYPE_AUTH_MFA,
70+
XDM_CONST.OPERATION_TYPE_AUTH_LOGIN
71+
),
72+
xdm.event.operation_sub_type = if(
73+
get_mechanism = "Email", "email",
74+
get_mechanism = "SMS", "sms",
75+
get_auth_method = "Federation", "Generic SSO",
76+
"password"
77+
),
78+
xdm.event.outcome = get_outcome,
79+
xdm.event.outcome_reason = if(
80+
get_outcome = XDM_CONST.OUTCOME_SUCCESS, null,
81+
get_failure_reason contains "abandoned", "mfa_expired",
82+
get_failure_reason contains "Internal error", "OTHER",
83+
get_denied_by_user = "True", "user_reject",
84+
"failed_login"
85+
),
86+
xdm.source.ipv4 = get_source_ip,
87+
xdm.source.port = to_integer(0),
88+
xdm.source.user_agent = get_user_agent,
89+
xdm.source.user.upn = username,
90+
xdm.source.user.identifier = userId,
91+
xdm.source.user.username = username,
92+
xdm.source.user.user_type = if(identityType = "HUMAN", XDM_CONST.USER_TYPE_REGULAR, XDM_CONST.USER_TYPE_SERVICE_ACCOUNT),
93+
xdm.source.host.device_id = get_source_ip,
94+
xdm.source.host.device_category = if(get_mobile_device = "True", "Mobile", "Computer"),
95+
xdm.source.host.os_family = if(
96+
get_device_os contains "Windows", XDM_CONST.OS_FAMILY_WINDOWS,
97+
get_device_os contains "Mac", XDM_CONST.OS_FAMILY_MACOS,
98+
get_device_os contains "Linux", XDM_CONST.OS_FAMILY_LINUX,
99+
get_device_os contains "Android", XDM_CONST.OS_FAMILY_ANDROID,
100+
get_device_os contains "iOS", XDM_CONST.OS_FAMILY_IOS,
101+
get_device_os contains "Chrome", XDM_CONST.OS_FAMILY_CHROMEOS,
102+
get_device_os = null, null,
103+
to_string(get_device_os)
104+
),
105+
xdm.source.application.name = get_browser_name,
106+
xdm.source.location.city = get_city,
107+
xdm.source.location.country = get_country,
108+
xdm.source.location.latitude = to_float(get_latitude),
109+
xdm.source.location.longitude = to_float(get_longitude),
110+
xdm.target.ipv4 = "",
111+
xdm.target.port = to_integer(0),
112+
xdm.target.resource.name = get_entity_name,
113+
xdm.network.ip_protocol = XDM_CONST.IP_PROTOCOL_TCP,
114+
xdm.network.session_id = get_session_id,
115+
xdm.session_context_id = coalesce(get_session_id, get_session_guid),
116+
xdm.logon.type = if(message = "Cloud.Core.O365WsTrustLogin", XDM_CONST.LOGON_TYPE_SERVICE, XDM_CONST.LOGON_TYPE_INTERACTIVE),
117+
xdm.auth.service = if(
118+
auditCode in ("IDP2013", "IDP2014", "IDP2012"), "IDP",
119+
get_auth_method = "Federation", "SP",
120+
"IDP"
121+
),
122+
xdm.auth.privilege_level = if(
123+
get_roles contains "sysadmin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
124+
get_roles contains "Admin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
125+
XDM_CONST.PRIVILEGE_LEVEL_USER
126+
),
127+
xdm.observer.type = "Identity";
128+
129+
/* SaaS Audit - CyberArk Audit to XDM SaaS Story Mapping */
130+
[RULE: CyberArk_Audit_Saas_Mapping]
131+
alter
132+
get_source_ip = coalesce(json_extract_scalar(customData, "$.source_ip_address"), source),
133+
get_roles = json_extract_scalar(customData, "$.roles"),
134+
get_level = json_extract_scalar(customData, "$.level"),
135+
get_status = json_extract_scalar(customData, "$.status"),
136+
get_failure_reason = json_extract_scalar(customData, "$.failure_reason"),
137+
get_user_state = json_extract_scalar(customData, "$.user_state"),
138+
get_user_agent = json_extract_scalar(customData, "$.user_agent"),
139+
get_browser_name = json_extract_scalar(customData, "$.browser_name"),
140+
get_entity_uuid = json_extract_scalar(customData, "$.entity_uuid"),
141+
get_application_id = json_extract_scalar(customData, "$.application_id"),
142+
get_role_id = json_extract_scalar(customData, "$.role_id"),
143+
get_device_id = json_extract_scalar(customData, "$.device_id"),
144+
get_target_user_id = json_extract_scalar(customData, "$.target_user_id"),
145+
get_proxy_id = json_extract_scalar(customData, "$.proxy_id"),
146+
get_application_name = json_extract_scalar(customData, "$.application_name"),
147+
get_entity_name = json_extract_scalar(customData, "$.entity_name"),
148+
get_role_name = json_extract_scalar(customData, "$.role_name"),
149+
get_policy_name = json_extract_scalar(customData, "$.policy_name"),
150+
get_object_name = json_extract_scalar(customData, "$.object_name"),
151+
get_device_name = json_extract_scalar(customData, "$.device_name"),
152+
get_success = json_extract_scalar(customData, "$.success"),
153+
get_app_url = json_extract_scalar(customData, "$.app_url"),
154+
get_session_id = json_extract_scalar(customData, "$.internal_session_id"),
155+
get_session_guid = json_extract_scalar(customData, "$.session_guid"),
156+
get_action_type_lower = lowercase(actionType),
157+
get_message_lower = lowercase(message)
158+
| alter
159+
xdm.event.type = "saas audit",
160+
xdm.event.id = uuid,
161+
xdm.event.original_event_type = get_message_lower,
162+
xdm.event.operation = if(
163+
get_action_type_lower in ("create", "add"), XDM_CONST.OPERATION_TYPE_CREATE,
164+
get_action_type_lower = "delete" or get_message_lower contains "remove", XDM_CONST.OPERATION_TYPE_DELETE,
165+
get_action_type_lower in ("edit", "approve", "upgrade"), XDM_CONST.OPERATION_TYPE_UPDATE,
166+
null
167+
),
168+
xdm.event.outcome = if(
169+
get_level = "Error" or get_status = "NonExist" or get_success = "False" or get_message_lower ~= "fail$", XDM_CONST.OUTCOME_FAILED,
170+
get_status in ("Deleted", "Created", "Updated", "Success", "Normal"), XDM_CONST.OUTCOME_SUCCESS,
171+
XDM_CONST.OUTCOME_SUCCESS
172+
),
173+
xdm.event.outcome_reason = coalesce(get_failure_reason, get_status, get_user_state),
174+
xdm.source.ipv4 = coalesce(get_source_ip, ""),
175+
xdm.source.user_agent = get_user_agent,
176+
xdm.source.user.upn = username,
177+
xdm.source.user.identifier = userId,
178+
xdm.source.user.identity_type = if(
179+
username contains "SYSTEM$" or username contains "RA-SYSTEM-USER$", "SERVICE_ACCOUNT",
180+
identityType = "HUMAN", "USER",
181+
"USER"
182+
),
183+
xdm.source.user.user_type = if(
184+
username contains "SYSTEM$" or username contains "RA-SYSTEM-USER$", XDM_CONST.USER_TYPE_SERVICE_ACCOUNT,
185+
XDM_CONST.USER_TYPE_REGULAR
186+
),
187+
xdm.source.application.name = get_browser_name,
188+
xdm.source.cloud.project_id = tenantId,
189+
xdm.session_context_id = coalesce(get_session_id, get_session_guid),
190+
xdm.auth.privilege_level = if(
191+
get_roles contains "sysadmin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
192+
get_roles contains "Admin", XDM_CONST.PRIVILEGE_LEVEL_ADMIN,
193+
XDM_CONST.PRIVILEGE_LEVEL_USER
194+
),
195+
xdm.intermediate.user.identifier = coalesce(get_application_id, get_application_name, ""),
196+
xdm.target.resource.type = if(
197+
auditCode ~= "^IDP4", "Policy",
198+
auditCode ~= "^IDP15", "Access Right",
199+
auditCode ~= "^IDP60" or auditCode ~= "^IDP21", "Application",
200+
auditCode in ("IDP2001", "IDP2002", "IDP2003", "IDP2701"), "User",
201+
auditCode in ("IDP1201", "IDP1204"), "Collection",
202+
auditCode in ("IDP1803", "IDP1802"), "CONFIGURATION",
203+
auditCode in ("IDP1707", "IDP1706"), "Device",
204+
"Other"
205+
),
206+
xdm.target.resource.id = coalesce(get_entity_uuid, get_application_id, get_role_id, get_device_id, get_target_user_id, get_proxy_id),
207+
xdm.target.resource.name = coalesce(get_application_name, get_entity_name, get_role_name, get_policy_name, get_object_name, get_device_name),
208+
xdm.target.url = coalesce(get_app_url, ""),
209+
xdm.database.statement = coalesce(get_message_lower, action, ""),
210+
xdm.observer.type = "Identity";
211+
212+
[MODEL: dataset="cyberark_isp_raw"]
213+
/* Auth 102 - CyberArk Audit Authentication Story */
214+
call CyberArk_Audit_Auth_Classification
215+
| filter is_auth = true
216+
| call CyberArk_Audit_Auth_Mapping;
217+
218+
/* SaaS Audit - CyberArk Audit to XDM SaaS Story */
219+
call CyberArk_Audit_Saas_Classification
220+
| filter is_saas = true
221+
| call CyberArk_Audit_Saas_Mapping;

‎Packs/CyberArkPAS/ModelingRules/CyberArkISP/CyberArkISP.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
fromversion: 8.4.0
2+
id: CyberArk_ISP_ModelingRule
3+
name: CyberArk ISP Modeling Rule
4+
rules: ''
5+
schema: ''
6+
tags: ''
7+
supportedModules:
8+
- xsiam

‎Packs/CyberArkPAS/ModelingRules/CyberArkISP/CyberArkISP_schema.json‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
{
2+
"cyberark_isp_raw": {
3+
"uuid": {
4+
"type": "string",
5+
"is_array": false
6+
},
7+
"tenantId": {
8+
"type": "string",
9+
"is_array": false
10+
},
11+
"timestamp": {
12+
"type": "string",
13+
"is_array": false
14+
},
15+
"username": {
16+
"type": "string",
17+
"is_array": false
18+
},
19+
"applicationCode": {
20+
"type": "string",
21+
"is_array": false
22+
},
23+
"auditCode": {
24+
"type": "string",
25+
"is_array": false
26+
},
27+
"auditType": {
28+
"type": "string",
29+
"is_array": false
30+
},
31+
"action": {
32+
"type": "string",
33+
"is_array": false
34+
},
35+
"userId": {
36+
"type": "string",
37+
"is_array": false
38+
},
39+
"source": {
40+
"type": "string",
41+
"is_array": false
42+
},
43+
"actionType": {
44+
"type": "string",
45+
"is_array": false
46+
},
47+
"component": {
48+
"type": "string",
49+
"is_array": false
50+
},
51+
"serviceName": {
52+
"type": "string",
53+
"is_array": false
54+
},
55+
"accessMethod": {
56+
"type": "string",
57+
"is_array": false
58+
},
59+
"accountId": {
60+
"type": "string",
61+
"is_array": false
62+
},
63+
"target": {
64+
"type": "string",
65+
"is_array": false
66+
},
67+
"command": {
68+
"type": "string",
69+
"is_array": false
70+
},
71+
"sessionId": {
72+
"type": "string",
73+
"is_array": false
74+
},
75+
"message": {
76+
"type": "string",
77+
"is_array": false
78+
},
79+
"customData": {
80+
"type": "string",
81+
"is_array": false
82+
},
83+
"cloudProvider": {
84+
"type": "string",
85+
"is_array": false
86+
},
87+
"cloudWorkspacesAndRoles": {
88+
"type": "string",
89+
"is_array": false
90+
},
91+
"cloudIdentities": {
92+
"type": "string",
93+
"is_array": false
94+
},
95+
"cloudAssets": {
96+
"type": "string",
97+
"is_array": false
98+
},
99+
"safe": {
100+
"type": "string",
101+
"is_array": false
102+
},
103+
"accountName": {
104+
"type": "string",
105+
"is_array": false
106+
},
107+
"targetPlatform": {
108+
"type": "string",
109+
"is_array": false
110+
},
111+
"targetAccount": {
112+
"type": "string",
113+
"is_array": false
114+
},
115+
"identityType": {
116+
"type": "string",
117+
"is_array": false
118+
},
119+
"correlationId": {
120+
"type": "string",
121+
"is_array": false
122+
},
123+
"isDr": {
124+
"type": "boolean",
125+
"is_array": false
126+
},
127+
"originRegion": {
128+
"type": "string",
129+
"is_array": false
130+
}
131+
}
132+
}

0 commit comments

Comments
 (0)