Solutions/Jamf Protect/Parsers/JamfProtectTelemetry.yaml (740 lines of code) (raw):
id: d941b837-88fa-4c77-a4d8-76af0044cac0
Function:
Title: Parser for Jamf Protect Telemetry Events
Version: '3.2.4'
LastUpdated: '2025-03-25'
Category: Microsoft Sentinel Parser
FunctionName: JamfProtectTelemetry
FunctionAlias: JamfProtectTelemetry
FunctionQuery: |
jamfprotecttelemetryv2_CL
// Generic Fields
| extend
EventExpanded = tostring(parse_json(event)[strcat_array(bag_keys(event), '.')]),
eventTypeHuman = tostring(bag_keys(event)[0])
| extend EventResult = iif((event[eventTypeHuman]['success'] == true), "Success", dynamic(null))
| extend
EventMessage = case(
eventTypeHuman == "authentication",
"A user authentication happened",
eventTypeHuman == "authorization_judgement",
"A process has its rights petition judged",
eventTypeHuman == "authorization_petition",
"A process has its rights petition judged",
eventTypeHuman == "bios_uefi",
"Collection of bios and firmware data",
eventTypeHuman == "btm_launch_item_add",
"Apple's Background Task Manager notified that an item has been added",
eventTypeHuman == "btm_launch_item_remove",
"Apple's Background Task Manager notified that an existing item has been removed",
eventTypeHuman == "chroot",
"Software has changed its apparent root directory in which it's actively operating out of",
eventTypeHuman == "cs_invalidated",
"The system detected that a process has had its code signature marked as invalid",
eventTypeHuman == "exec",
"A new process has been executed",
eventTypeHuman == "kextload",
"A kernel extension (kext) was loaded",
eventTypeHuman == "kextunload",
"A kernel extension (kext) was unloaded",
eventTypeHuman == "login_login",
"A user attempted to log in using /usr/bin/login",
eventTypeHuman == "login_logout",
"A user logged out from /usr/bin/login",
eventTypeHuman == "lw_session_lock",
"A user has locked the screen",
eventTypeHuman == "lw_session_login",
"A user has logged in via the Login Window",
eventTypeHuman == "lw_session_logout",
"A user has logged out of an active graphical session",
eventTypeHuman == "lw_session_unlock",
"A user has unlocked the screen from the Login Window",
eventTypeHuman == "mount",
"A file system has been mounted",
eventTypeHuman == "od_attribute_set",
"Attribute set on user or group using Open Directory",
eventTypeHuman == "od_attribute_value_add",
"Attribute added to a user or group using Open Directory",
eventTypeHuman == "od_attribute_value_remove",
"Attribute removed from a user or group using Open Directory",
eventTypeHuman == "od_create_group",
"A group has been created using Open Directory",
eventTypeHuman == "od_create_user",
"A user has been created using Open Directory",
eventTypeHuman == "od_delete_group",
"A group has been deleted using Open Directory",
eventTypeHuman == "od_delete_user",
"A user has been deleted using Open Directory",
eventTypeHuman == "od_disable_user",
"A user has been disabled using Open Directory",
eventTypeHuman == "od_enable_user",
"A user has been enabled using Open Directory",
eventTypeHuman == "od_group_add",
"A member has been added to a group using Open Directory",
eventTypeHuman == "od_group_remove",
"A member has been removed from a group using Open Directory",
eventTypeHuman == "od_group_set",
"A group has a member initialised or replaced using Open Directory",
eventTypeHuman == "od_modify_password",
"A user password is modified via Open Directory",
eventTypeHuman == "openssh_login",
"A user has logged into the system via OpenSSH",
eventTypeHuman == "openssh_logout",
"A user has logged out of an OpenSSH session",
eventTypeHuman == "performance",
"Collection of system performance data",
eventTypeHuman == "profile_add",
"A configuration profile is installed on the system",
eventTypeHuman == "profile_remove",
"A configuration profile is removed from the system",
eventTypeHuman == "remount",
"A file system has been mounted",
eventTypeHuman == "screensharing_attach",
"A screensharing session has attached to a graphical session",
eventTypeHuman == "screensharing_detach",
"A screensharing session has detached from a graphical session",
eventTypeHuman == "settime",
"The system time was attempted to be set",
eventTypeHuman == "su",
"A user attempts to start a new shell using a substitute user identity",
eventTypeHuman == "sudo",
"A sudo attempt occured",
eventTypeHuman == "unmount",
"A file system has been mounted",
eventTypeHuman == "xp_malware_detected",
"Apple's XProtect detected malware on the system",
eventTypeHuman == "xp_malware_remediated",
"Apple's XProtect remediated malware on the system",
eventTypeHuman == "file_collection",
"A crash or diagnostic file has been collected",
eventTypeHuman == "log_collection",
"Entries from a log file have been collected",
eventTypeHuman == "gatekeeper_user_override",
"Gatekeeper controls were overridden",
"No reason yet defined for this event"
),
EventType = case(
eventTypeHuman == "authentication",
"Logon",
eventTypeHuman == "authorization_judgement",
"ProcessCreated",
eventTypeHuman == "authorization_petition",
"ProcessCreated",
eventTypeHuman == "bios_uefi",
"Hardware",
eventTypeHuman == "btm_launch_item_add",
"Create",
eventTypeHuman == "btm_launch_item_remove",
"Delete",
eventTypeHuman == "chroot",
"Set",
eventTypeHuman == "cs_invalidated",
"Other",
eventTypeHuman == "exec",
"ProcessCreated",
eventTypeHuman == "kextload",
"Create",
eventTypeHuman == "kextunload",
"Delete",
eventTypeHuman == "login_login",
"Logon",
eventTypeHuman == "login_logout",
"Logoff",
eventTypeHuman == "lw_session_lock",
"Logoff",
eventTypeHuman == "lw_session_login",
"Logon",
eventTypeHuman == "lw_session_logout",
"Logoff",
eventTypeHuman == "lw_session_unlock",
"Logon",
eventTypeHuman == "mount",
"FileSystemMounted",
eventTypeHuman == "od_attribute_set",
"Set",
eventTypeHuman == "od_attribute_value_add",
"Create",
eventTypeHuman == "od_attribute_value_remove",
"Delete",
eventTypeHuman == "od_create_group",
"GroupCreated",
eventTypeHuman == "od_create_user",
"UserCreated",
eventTypeHuman == "od_delete_group",
"GroupDeleted",
eventTypeHuman == "od_delete_user",
"UserDeleted",
eventTypeHuman == "od_disable_user",
"UserDisabled",
eventTypeHuman == "od_enable_user",
"UserEnabled",
eventTypeHuman == "od_group_add",
"UserAddedToGroup",
eventTypeHuman == "od_group_remove",
"UserRemovedFromGroup",
eventTypeHuman == "od_group_set",
"GroupModified",
eventTypeHuman == "od_modify_password",
"PasswordChanged",
eventTypeHuman == "openssh_login",
"Logon",
eventTypeHuman == "openssh_logout",
"Logoff",
eventTypeHuman == "performance",
"PerformanceData",
eventTypeHuman == "profile_add",
"Create",
eventTypeHuman == "profile_remove",
"Delete",
eventTypeHuman == "remount",
"FileSystemRemounted",
eventTypeHuman == "screenscharing_attach",
"Logon",
eventTypeHuman == "screenscharing_detach",
"Logoff",
eventTypeHuman == "settime",
"Set",
eventTypeHuman == "su",
"Elevate",
eventTypeHuman == "sudo",
"Elevate",
eventTypeHuman == "unmount",
"FileSystemUnmounted",
eventTypeHuman == "xp_malware_detected",
"MalwareDetected",
eventTypeHuman == "xp_malware_remediated",
"MalwareRemediated",
eventTypeHuman == "xp_malware_remediated",
"GatekeeperOverride",
""
),
EventSubType = case(
eventTypeHuman == "authentication",
"Interactive",
eventTypeHuman == "btm_launch_item_add",
"btm",
eventTypeHuman == "btm_launch_item_remove",
"btm",
eventTypeHuman == "chroot",
"Directory",
eventTypeHuman == "cs_invalidated",
"Other",
eventTypeHuman == "kextload",
"System Settings",
eventTypeHuman == "kextunload",
"System Settings",
eventTypeHuman == "login_login",
"Interactive",
eventTypeHuman == "login_logout",
"Interactive",
eventTypeHuman == "lw_session_lock",
"Interactive",
eventTypeHuman == "lw_session_login",
"Interactive",
eventTypeHuman == "lw_session_logout",
"Interactive",
eventTypeHuman == "lw_session_unlock",
"Interactive",
eventTypeHuman == "od_attribute_set",
"Attribute",
eventTypeHuman == "od_attribute_value_add",
"Attribute",
eventTypeHuman == "od_attribute_value_remove",
"Attribute",
eventTypeHuman == "openssh_login",
"Interactive",
eventTypeHuman == "openssh_logout",
"Interactive",
eventTypeHuman == "profile_add",
"Configuration Profile",
eventTypeHuman == "profile_remove",
"Configuration Profile",
eventTypeHuman == "screenscharing_attach",
"RemoteInteractive",
eventTypeHuman == "screenscharing_detach",
"RemoteInteractive",
eventTypeHuman == "settime",
"System Settings",
eventTypeHuman == "su",
"Interactive",
eventTypeHuman == "sudo",
"Interactive",
""
)
// Jamf Protect Telemetry - Event Process
| extend eventContext =
iif(
isnotempty(event[eventTypeHuman]['app']['audit_token']),
event[eventTypeHuman]['app'],
iif(
isnotempty(event[eventTypeHuman]['target']['audit_token']),
event[eventTypeHuman]['target'],
iif(
isnotempty(event[eventTypeHuman]['data']['od']['audit_token']),
event[eventTypeHuman]['data']['od'],
iif(
isnotempty(event[eventTypeHuman]['data']['token']['audit_token']),
event[eventTypeHuman]['data']['token'],
iif(
isnotempty(event[eventTypeHuman]['data']['touchid']['audit_token']),
event[eventTypeHuman]['data']['touchid'],
iif(
isnotempty(event[eventTypeHuman]['instigator']['audit_token']),
event[eventTypeHuman]['instigator'],
['process']
)
)
)
)
)
)
| extend
TargetProcessName = tostring(eventContext.executable.path),
TargetProcessId = tostring(eventContext.audit_token.pid),
TargetProcessGuid = tostring(eventContext.audit_token.uuid),
TargetProcessCreationTime = tostring(eventContext.start_time),
TargetProcessSHA1 = tostring(eventContext.executable.sha1),
TargetProcessSHA256 = tostring(eventContext.executable.sha256),
TargetProcessCommandLine = event[eventTypeHuman]['args'],
TargetProcessTTY = tostring(eventContext.tty.path),
TargetBinarySigningAppID = tostring(eventContext.signing_id),
TargetBinarySigningTeamID = tostring(eventContext.team_id),
TargetBinaryCDHash = tostring(eventContext.cdhash),
TargetBinaryIsESClient = tobool(eventContext.is_es_client),
TargetBinaryIsPlatformBinary = tobool(eventContext.is_platform_binary),
TargetUserId = tostring(eventContext.audit_token.euid),
ActingProcessId = tostring(eventContext.parent_audit_token.pid),
ActingProcessGuid = tostring(eventContext.parent_audit_token.uuid),
ActorUserId = tostring(eventContext.parent_audit_token.euid),
ParentProcessId = tostring(eventContext.responsible_audit_token.pid),
ParentProcessGuid = tostring(eventContext.responsible_audit_token.uuid)
// Jamf Protect Telemetry - Revealing Code Signing flags
| extend TargetProcessCodesignFlags =
iif(isnotempty(eventContext.codesigning_flags),
bag_pack(
"CS_VALID",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000001) > 0, true, false),
"CS_ADHOC",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000002) > 0, true, false),
"CS_GET_TASK_ALLOW",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000004) > 0, true, false),
"CS_INSTALLER",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000008) > 0, true, false),
"CS_FORCED_LV",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000010) > 0, true, false),
"CS_INVALID_ALLOWED",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000020) > 0, true, false),
"CS_HARD",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000100) > 0, true, false),
"CS_KILL",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000200) > 0, true, false),
"CS_CHECK_EXPIRATION",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000400) > 0, true, false),
"CS_RESTRICT",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00000800) > 0, true, false),
"CS_ENFORCEMENT",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00001000) > 0, true, false),
"CS_REQUIRE_LV",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00002000) > 0, true, false),
"CS_ENTITLEMENTS_VALIDATED",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00004000) > 0, true, false),
"CS_NVRAM_UNRESTRICTED",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00008000) > 0, true, false),
"CS_RUNTIME",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00010000) > 0, true, false),
"CS_LINKER_SIGNED",
iff(binary_and(toint(eventContext.codesigning_flags), 0x20000) > 0, true, false),
"CS_EXEC_SET_HARD",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00100000) > 0, true, false),
"CS_EXEC_SET_KILL",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00200000) > 0, true, false),
"CS_EXEC_SET_ENFORCEMENT",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00400000) > 0, true, false),
"CS_EXEC_INHERIT_SIP",
iff(binary_and(toint(eventContext.codesigning_flags), 0x00800000) > 0, true, false),
"CS_KILLED",
iff(binary_and(toint(eventContext.codesigning_flags), 0x01000000) > 0, true, false),
"CS_DYLD_PLATFORM",
iff(binary_and(toint(eventContext.codesigning_flags), 0x02000000) > 0, true, false),
"CS_PLATFORM_BINARY",
iff(binary_and(toint(eventContext.codesigning_flags), 0x04000000) > 0, true, false),
"CS_PLATFORM_PATH",
iff(binary_and(toint(eventContext.codesigning_flags), 0x08000000) > 0, true, false),
"CS_DEBUGGED",
iff(binary_and(toint(eventContext.codesigning_flags), 0x10000000) > 0, true, false),
"CS_SIGNED",
iff(binary_and(toint(eventContext.codesigning_flags), 0x20000000) > 0, true, false),
"CS_DEV_CODE",
iff(binary_and(toint(eventContext.codesigning_flags), 0x40000000) > 0, true, false),
"CS_DATAVAULT_CONTROLLER",
iff(binary_and(toint(eventContext.codesigning_flags), 0x80000000) > 0, true, false)
), "")
// Event Specific - authentication
| extend TargetUsername =
iif(
isnotempty(event[eventTypeHuman]['username']),
event[eventTypeHuman]['username'],
iif(
isnotempty(event[eventTypeHuman]['to_username']),
event[eventTypeHuman]['to_username'],
iif(
isnotempty(event[eventTypeHuman]['account_name']),
event[eventTypeHuman]['account_name'],
iif(
isnotempty(event[eventTypeHuman]['user_name']),
event[eventTypeHuman]['user_name'],
iif(
isnotempty(event[eventTypeHuman]['authentication_username']),
event[eventTypeHuman]['authentication_username'],
""
)
)
)
)
)
// Event Specific - authentication
| extend ActorUsername =
iif(
isnotempty(event[eventTypeHuman]['from_username']),
event[eventTypeHuman]['from_username'],
iif(
isnotempty(event[eventTypeHuman]['session_username']),
event[eventTypeHuman]['session_username'],
""
)
)
| extend Authentication = iif(
eventTypeHuman == "authentication",
bag_pack(
"authentication_method",
iff(isnotempty(event[eventTypeHuman].data), tostring(bag_keys(event[eventTypeHuman].data)[0]), "")
),
dynamic(null)
)
// Event Specific - bios_uefi
| extend HardwareInformation = iif(
eventTypeHuman == "bios_uefi",
bag_pack(
"host_architecture",
iff(isnotempty(event[eventTypeHuman].architecture), event[eventTypeHuman].architecture, ""),
"firmware_version",
iff(isnotempty(event[eventTypeHuman].bios.['firmware-version']), event[eventTypeHuman].bios.['firmware-version'], ""),
"system_firmware_version",
iff(isnotempty(event[eventTypeHuman].bios.['system-firmware-version']), event[eventTypeHuman].bios.['system-firmware-version'], "")
),
dynamic(null)
)
// Event Specific - btm_launch_item_add & btm_launch_item_remove
| extend BtmItem = iif(
eventTypeHuman in ("btm_launch_item_add", "btm_launch_item_remove", "remount"),
bag_pack(
"btm_executable_path",
iff(isnotempty(event[eventTypeHuman].executable_path), event[eventTypeHuman].executable_path, ""),
"btm_item_app_url",
iff(isnotempty(event[eventTypeHuman].item.app_url), event[eventTypeHuman].item.app_url, ""),
"btm_item_url",
iff(isnotempty(event[eventTypeHuman].item.item_url), event[eventTypeHuman].item.item_url, ""),
"btm_item_managed",
iff(isnotempty(event[eventTypeHuman].item.managed), event[eventTypeHuman].item.managed, ""),
"btm_item_legacy",
iff(isnotempty(event[eventTypeHuman].item.legacy), event[eventTypeHuman].item.legacy, ""),
"btm_item_uid",
iff(isnotempty(event[eventTypeHuman].item.uid), event[eventTypeHuman].item.uid, ""),
"btm_item_type",
iff(
isnotempty(event[eventTypeHuman].item.item_type),
case(
event[eventTypeHuman].item.item_type == 0,
"UserItem",
event[eventTypeHuman].item.item_type == 1,
"App",
event[eventTypeHuman].item.item_type == 2,
"LoginItem",
event[eventTypeHuman].item.item_type == 3,
"LaunchAgent",
event[eventTypeHuman].item.item_type == 4,
"LaunchDaemon",
"Unknown"
),
""
)
),
dynamic(null)
)
// Event Specific - chroot
| extend Chroot = iif(
eventTypeHuman == "chroot",
bag_pack(
"apparent_root_directory",
iff(isnotempty(event[eventTypeHuman].target), event[eventTypeHuman].target.path, ""),
"stats",
iff(isnotempty(event[eventTypeHuman].target.stat), event[eventTypeHuman].target.stat, "")
),
dynamic(null)
)
// Event Specific - cs_invalidated
// Event Specific - exec
// Event Specific - kextload & kextunload
| extend KernelExtension = iif(
eventTypeHuman in ("kextload", "kextunload"),
bag_pack(
"kext_identifier",
iff(isnotempty(event[eventTypeHuman].identifier), event[eventTypeHuman].identifier, "")
),
dynamic(null)
)
// Event Specific - lw_session_lock & lw_session_unlock & lw_session_login & lw_session_logout
| extend LoginWindowSession = iif(
eventTypeHuman in ("lw_session_lock", "lw_session_unlock", "lw_session_login", "lw_session_logout"),
bag_pack(
"graphical_session_id",
iff(isnotempty(event[eventTypeHuman].graphical_session_id), event[eventTypeHuman].graphical_session_id, "")
),
dynamic(null)
)
// Event Specific - mount & remount & unmount
| extend FileSystem = iif(
eventTypeHuman in ("mount", "unmount", "remount"),
bag_pack(
"volume_device_name",
iff(isnotempty(event[eventTypeHuman].statfs.f_mntfromname), event[eventTypeHuman].statfs.f_mntfromname, ""),
"volume_mount_name",
iff(isnotempty(event[eventTypeHuman].statfs.f_mntonname), event[eventTypeHuman].statfs.f_mntonname, ""),
"volume_file_system_type",
iff(isnotempty(event[eventTypeHuman].statfs.f_fstypename), event[eventTypeHuman].statfs.f_fstypename, ""),
"volume_size",
iff(isnotempty(event[eventTypeHuman].statfs.f_bsize), event[eventTypeHuman].statfs.f_bsize, "")
),
dynamic(null)
)
// Event Specific - od_attribute_set & od_attribute_value_add & od_attribute_value_remove & od_create_group & od_create_user & od_delete_group & od_delete_user & od_disable_user & od_enable_user
| extend OpenDirectory = iif(
eventTypeHuman in ("od_attribute_set", "od_attribute_value_add", "od_attribute_value_remove", "od_create_group", "od_create_user", "od_delete_group", "od_delete_user", "od_disable_user", "od_enable_user"),
bag_pack(
"group_name",
iff(isnotempty(event[eventTypeHuman].group_name), event[eventTypeHuman].group_name, ""),
"member_array",
iff(isnotempty(event[eventTypeHuman].members.member_array), event[eventTypeHuman].members.member_array, ""),
"member_value",
iff(isnotempty(event[eventTypeHuman].member.member_value), event[eventTypeHuman].member.member_value, ""),
"user_name",
iff(isnotempty(event[eventTypeHuman].user_name), event[eventTypeHuman].user_name, ""),
"account_name",
iff(isnotempty(event[eventTypeHuman].account_name), event[eventTypeHuman].account_name, ""),
"db_path",
iff(isnotempty(event[eventTypeHuman].db_path), event[eventTypeHuman].db_path, ""),
"record_name",
iff(isnotempty(event[eventTypeHuman].record_name), event[eventTypeHuman].record_name, ""),
"attribute_name",
iff(isnotempty(event[eventTypeHuman].attribute_name), event[eventTypeHuman].attribute_name, ""),
"attribute_value",
iff(isnotempty(event[eventTypeHuman].attribute_value), event[eventTypeHuman].attribute_value, ""),
"node_name",
iff(isnotempty(event[eventTypeHuman].node_name), event[eventTypeHuman].node_name, "")
),
dynamic(null)
)
// Event Specific - openssh_login & openssh_logout
| extend SSHContext = iif(
eventTypeHuman in ("openssh_login", "openssh_logout"),
bag_pack(
"source_address_type",
iff(
isnotempty(event[eventTypeHuman].source_address_type),
case(
event[eventTypeHuman].source_address_type == 0,
"Unknown",
event[eventTypeHuman].source_address_type == 1,
"IPv4",
event[eventTypeHuman].source_address_type == 2,
"IPv6",
event[eventTypeHuman].source_address_type == 3,
"UNIX Socket",
"Unknown"
),
""
),
"result_type",
iff(
isnotempty(event[eventTypeHuman].result_type),
case(
event[eventTypeHuman].result_type == 0,
"Exceeded maximum attempts",
event[eventTypeHuman].result_type == 1,
"Denied by root",
event[eventTypeHuman].result_type == 2,
"Success",
event[eventTypeHuman].result_type == 3,
"No reason",
event[eventTypeHuman].result_type == 4,
"Password",
event[eventTypeHuman].result_type == 5,
"kbdint",
event[eventTypeHuman].result_type == 6,
"Public key",
event[eventTypeHuman].result_type == 7,
"Host based",
event[eventTypeHuman].result_type == 8,
"GSS API",
event[eventTypeHuman].result_type == 9,
"Invalid user",
"Unknown"
),
""
)
),
dynamic(null)
)
// Event Specific - performance
// Event Specific - profile_add & profile_remove
| extend Profile = iif(
eventTypeHuman in ("profile_add", "profile_remove"),
bag_pack(
"profile_scope",
iff(isnotempty(event[eventTypeHuman].profile.scope), event[eventTypeHuman].profile.scope, ""),
"profile_identifier",
iff(isnotempty(event[eventTypeHuman].profile.identifier), event[eventTypeHuman].profile.identifiery, ""),
"profile_uuid",
iff(isnotempty(event[eventTypeHuman].profile.uuid), event[eventTypeHuman].profile.uuid, ""),
"profile_display_name",
iff(isnotempty(event[eventTypeHuman].profile.display_name), event[eventTypeHuman].profile.display_name, ""),
"profile_organization",
iff(isnotempty(event[eventTypeHuman].profile.organization), event[eventTypeHuman].profile.organization, ""),
"profile_is_updated",
iff(isnotempty(event[eventTypeHuman].is_update), event[eventTypeHuman].is_update, ""),
"profile_install_source",
iff(
isnotempty(event[eventTypeHuman].profile.install_source),
case(
event[eventTypeHuman].profile.install_source == 0,
"mdm",
event[eventTypeHuman].profile.install_source == 1,
"manual",
"Unknown"
),
""
)
),
dynamic(null)
)
// Event Specific - screenscharing_attach & screensharing_detach
| extend Screensharing = iif(
eventTypeHuman in ("screensharing_attach", "screensharing_detach"),
bag_pack(
"existing_session",
iff(isnotempty(event[eventTypeHuman].existing_session), event[eventTypeHuman].existing_session, ""),
"graphical_session_id",
iff(isnotempty(event[eventTypeHuman].graphical_authentication_username), event[eventTypeHuman].graphical_authentication_username, ""),
"session_username",
iff(isnotempty(event[eventTypeHuman].session_username), event[eventTypeHuman].session_username, ""),
"viewer_appleid",
iff(isnotempty(event[eventTypeHuman].viewer_appleid), event[eventTypeHuman].viewer_appleid, ""),
"authentication_type",
iff(isnotempty(event[eventTypeHuman].authentication_type), event[eventTypeHuman].authentication_type, ""),
"source_address",
iff(isnotempty(event[eventTypeHuman].source_address), event[eventTypeHuman].source_address, ""),
"source_address_type",
iff(
isnotempty(event[eventTypeHuman].source_address_type),
case(
event[eventTypeHuman].source_address_type == 0,
"Unknown",
event[eventTypeHuman].source_address_type == 1,
"IPv4",
event[eventTypeHuman].source_address_type == 2,
"IPv6",
event[eventTypeHuman].source_address_type == 3,
"UNIX Socket",
"Unknown"
),
""
)
),
dynamic(null)
)
// Event Specific - su
| extend Su = iif(
eventTypeHuman == "su",
bag_pack(
"username",
iff(isnotempty(event[eventTypeHuman].username), event[eventTypeHuman].username, ""),
"uid",
iff(isnotempty(event[eventTypeHuman].uid), event[eventTypeHuman].uid, ""),
"args",
iff(isnotempty(event[eventTypeHuman].argv), event[eventTypeHuman].argv, ""),
"env_vars",
iff(isnotempty(event[eventTypeHuman].env), event[eventTypeHuman].env, ""),
"env_count",
iff(isnotempty(event[eventTypeHuman].env_count), event[eventTypeHuman].env_count, ""),
"from_username",
iff(isnotempty(event[eventTypeHuman].from_username), event[eventTypeHuman].from_username, ""),
"to_username",
iff(isnotempty(event[eventTypeHuman].to_username), event[eventTypeHuman].to_username, ""),
"failure_message",
iff(isnotempty(event[eventTypeHuman].failure_reason), event[eventTypeHuman].failure_reason, "")
),
dynamic(null)
)
// Event Specific - sudo
| extend Sudo = iif(
eventTypeHuman == "sudo",
bag_pack(
"TargetProcessCommandLine",
iff(isnotempty(event[eventTypeHuman].command), event[eventTypeHuman].command, ""),
"attribute_name",
iff(isnotempty(event[eventTypeHuman].attribute_name), event[eventTypeHuman].attribute_name, ""),
"attribute_value",
iff(isnotempty(event[eventTypeHuman].attribute_value), event[eventTypeHuman].attribute_value, "")
),
dynamic(null)
)
// Event Specific - xp_malware_detected & xp_malware_remediated
| extend Xprotect = iif(
eventTypeHuman in ("xp_malware_detected", "xp_malware_remediated"),
bag_pack(
"detected_path",
iff(isnotempty(event[eventTypeHuman].detected_path), event[eventTypeHuman].detected_path, ""),
"remediated_path",
iff(isnotempty(event[eventTypeHuman].remediated_path), event[eventTypeHuman].remediated_path, ""),
"malware_identifier",
iff(isnotempty(event[eventTypeHuman].malware_identifier), event[eventTypeHuman].malware_identifier, ""),
"signature_version",
iff(isnotempty(event[eventTypeHuman].signature_version), event[eventTypeHuman].signature_version, "")
),
dynamic(null)
)
// Event Specific - gatekeeper_user_override
| extend GatekeeperOverride = iif(
eventTypeHuman == "gatekeeper_user_override",
bag_pack(
"TargetFilePath",
iff(isnotempty(event[eventTypeHuman].file.path), event[eventTypeHuman].file.path, ""),
"TargetFileSize",
iff(isnotempty(event[eventTypeHuman].file.stat.st_size), event[eventTypeHuman].file.stat.st_size, ""),
"TargetFileCreationTime",
iff(isnotempty(event[eventTypeHuman].file.stat.st_birthtimespec), event[eventTypeHuman].file.stat.st_birthtimespec, ""),
"TargetFileAccessedTime",
iff(isnotempty(event[eventTypeHuman].file.stat.st_atimespec), event[eventTypeHuman].file.stat.st_atimespec, ""),
"ActorUserId",
iff(isnotempty(event[eventTypeHuman].file.stat.st_uid), event[eventTypeHuman].file.stat.st_uid, ""),
"GroupId",
iff(isnotempty(event[eventTypeHuman].file.stat.st_gid), event[eventTypeHuman].file.stat.st_gid, ""),
"TargetFileSHA256",
iff(isnotempty(event[eventTypeHuman].sha256), event[eventTypeHuman].sha256, ""),
"TargetFileCdHash",
iff(isnotempty(event[eventTypeHuman].signing_info.cdhash), event[eventTypeHuman].signing_info.cdhash, ""),
"TargetBinarySigningTeamID",
iff(isnotempty(event[eventTypeHuman].signing_info.team_id), event[eventTypeHuman].signing_info.team_id, ""),
"TargetBinarySigningAppID",
iff(isnotempty(event[eventTypeHuman].signing_info.signing_id), event[eventTypeHuman].signing_info.signing_id, ""),
"ThreatFilePath",
iff(isnotempty(event[eventTypeHuman].file.path), event[eventTypeHuman].file.path, ""),
ThreatCategory = "Malware",
ThreatName = "User did override Gatekeeper"
),
dynamic(null)
)
| project-away
action,
event,
process