ASIM parsers and analytics rules

Question

Hi Team,

As far as I understand, ASIM parsers combine similar logs from different sources, for eg., "imAuthentication" combines Azure AD interactive and non-interactive Sign in logs, M365 Defender-based sign in logs etc. So when an incident is generated from an analytics rule(for eg., "Brute force attack against user credentials (Uses Authentication Normalization)"), how to understand what is the log source and what kind of sign in it is(without checking the Sentinel Logs)? When tested with this rule, the incident generated showed just the user accounts as entities.

Also, is it proposed to gradually phase out normal parsers and analytics rules based on them in favor of ASIM parsers and rules? Thank you.

Regards,
Anand R Menon

Answer 1

@Anand R Menon

I have checked with my team about the above problem statement.

This is indeed not apparent from the incident today. We are planning to add the Device Vendor and Device Product fields as custom fields to the incident.

To that end, we have updated now this specific rule to display the Vendor and Product in custom fields: Azure-Sentinel/imAuthBruteForce.yaml at master · Azure/Azure-Sentinel - github.com. It would be available in a week or two in the product, and can be used as a guideline to update the rule manually now.

https://github.com/Azure/Azure-Sentinel/blob/master/Detections/ASimAuthentication/imAuthBruteForce.yaml

As to the larger question: yes, we plan to move all relevant detections to ASIM.

Let me know if you have any questions.

If this answer was helpful to you, please consider "marking as answer" so that others in the community with similar questions will more easily find the resolution.