// KQL Sysmon Event Parser
// Last Updated Date: {{today}}
// Sysmon Version: {{sysmonversion}}, Binary Version : {{binaryversion}}, Schema Version: {{schemaversion}}
//
// Authors:
// Roberto Rodriguez (@Cyb3rWard0g), Ashwin Patil (@ashwinpatil), MSTIC R&D
//{% raw %}
let EventData = Event
| where Source == "Microsoft-Windows-Sysmon"
| extend RenderedDescription = tostring(split(RenderedDescription, ":")[0])
| project TimeGenerated,
    Source,
    EventID,
    Computer,
    UserName,
    EventData,
    RenderedDescription
| extend EvData = parse_xml(EventData)
| extend EventDetail = EvData.DataItem.EventData.Data
| project-away EventData,
    EvData;{% endraw %}
{% for event in sysmon %}// Event ID {{event['id']}}
//--------------------------
let {{event['name']}}_{{event['id']}}{% raw %}=() {
let processEvents = EventData
| where EventID == {% endraw %}{{event['id']}}
| extend {% for field in event['events'] if field['name'] not in ['Hashes','Hash'] %}{{field['name']}}{% raw %} = EventDetail.[{% endraw %}{{field['index']}}{% raw %}].["#text"]{% endraw %}{{ ", " if not loop.last else "" }}
{% endfor -%}
{% for field in event['events'] -%}
    {% if field['name'] in ['Hashes','Hash'] -%}
        {%- raw %}| extend {% endraw %}{{field['name']}}{% raw %} = extract_all(@"(?P<key>\w+)=(?P<value>[a-zA-Z0-9]+)", dynamic(["key","value"]), tostring(EventDetail.[{% endraw %}{{field['index']}}{% raw %}].["#text"])){% endraw %}
        {%- raw %}| mv-apply {% endraw %}{{field['name']}}{% raw %} on (summarize {% endraw %}{{field['name']}}{% raw %} = make_bag(pack(tostring({% endraw %}{{field['name']}}{% raw %}[0]), tostring({% endraw %}{{field['name']}}{% raw %}[1])))){% endraw %}
{% endif %}{% endfor %}
{%- raw %}| project-away EventDetail
;
processEvents;
};
{% endraw %}
{%- endfor -%}
{% raw %}(union isfuzzy=true{% endraw %}
{% for event in sysmon -%}
    {{event['name']}}_{{event['id']}}{{ ", " if not loop.last else "" }}
{% endfor -%}){% raw %}
| extend Details = column_ifexists("Details", ""), 
RuleName = column_ifexists("RuleName", ""),
PreviousCreationUtcTime=column_ifexists("PreviousCreationUtcTime", ""),
Hashes = column_ifexists("Hashes", ""),
Hash = column_ifexists("Hash", ""){% endraw %}
{%raw%}| project {% endraw %}{% for uniqueevent in uniquesysmon %}{{ uniqueevent }}{{ ", " if not loop.last else "" }}
{% endfor -%}