search

Azure / Azure-Sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.
https://azure.microsoft.com/en-us/services/azure-sentinel/
MIT License
4.38k stars 2.89k forks source link

Azure Firewall ASIM Network Parser | ICMP code and Type parsing #10532

Open cgiamp opened 1 month ago

cgiamp commented 1 month ago

Hello,

It appears that there is a small bug on the following line which extracts the ICMP code: https://github.com/Azure/Azure-Sentinel/blob/a0a2d1d4b3fe5caf51a73963497950af9d18a9c1/Parsers/ASimNetworkSession/Parsers/ASimNetworkSessionAzureFirewall.yaml#L43C11-L43C137 Based on what I see on azure firewall logging and the sample logs here: https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/AzureFirewall/AzureFirewallNetworkRuleLogs_sample-dataset.kql#L7 the Type keyword has a capital 'T' which causes the regular expression to fail.

I propose changing the regular expression to (not case-sensitive for failsafe):

| extend NetworkIcmpCode = iff(NetworkProtocol startswith "ICMP", toint(extract ("(?i)type=(\\d+)", 1, NetworkProtocol)), int(null))

Also, based on the documentation the fields NetworkIcmpType, NetworkIcmpCode should be the corresponding number of the ICMP type and code. On this parser, the NetworkIcmpCode has the value of the ICMP type and the NetworkIcmpType contains the description of the numeric value of the ICMP Type which is a bit misleading. image I think its more appropriate to store the numeric value of the ICMP type on the NetworkIcmpType field.

cgiamp commented 3 days ago

Hi,

any update on this one?