data source output normalization

data_sources/azure_active_directory.yml

@@ -11,3 +11,10 @@ supported_TA:
 - name: Splunk Add-on for Microsoft Cloud Services
   url: https://splunkbase.splunk.com/app/3110
   version: 5.4.2
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml

@@ -118,3 +118,10 @@ example_log: '{"time": "2024-02-08T21:49:53.7643129Z", "resourceId": "/tenants/7
   "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20
   21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"},
   {"key": "AppId", "value": "00000002-0000-0ff1-ce00-000000000000"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_add_member_to_role.yml

@@ -83,3 +83,10 @@ example_log: '{"time": "2023-04-28T16:39:51.9312625Z", "resourceId": "/tenants/f
   []}, {"id": "38bf5baf-7ec7-4bc2-8920-6d4044da12c2", "displayName": null, "type":
   "Role", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails":
   []}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_add_owner_to_application.yml

@@ -88,3 +88,10 @@ example_log: '{"time": "2023-06-20T15:54:13.2420879Z", "resourceId": "/tenants/f
   "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin
   22.4.0 Darwin Kernel Version 22.4.0: Mon Mar  6 21:00:17 PST 2023; root:xnu-8796.101.5~3/RELEASE_X86_64;
   en-US) PowerShell/7.3.4"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_add_service_principal.yml

@@ -86,3 +86,10 @@ example_log: '{"time": "2024-02-07T22:31:14.4970418Z", "resourceId": "/tenants/a
   "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value":
   "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like
   Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "e06366ca-8489-4748-b6a2-d7e4332f45c1"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_add_unverified_domain.yml

@@ -81,3 +81,10 @@ example_log: '{"time": "2023-07-26T13:45:54.1582053Z", "resourceId": "/tenants/f
   "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails":
   [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
   AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_consent_to_application.yml

@@ -96,3 +96,10 @@ example_log: '{"time": "2023-10-27T16:14:14.9747033Z", "resourceId": "/tenants/7
   null, "newValue": "\"Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException\""}],
   "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value":
   "EvoSTS"}, {"key": "AppId", "value": "96f6a3d6-d5aa-4af5-a77a-9319b5283712"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_disable_strong_authentication.yml

@@ -78,3 +78,10 @@ example_log: '{"time": "2023-07-11T00:01:35.0251899Z", "resourceId": "/tenants/f
   "newValue": "[]"}, {"displayName": "Included Updated Properties", "oldValue": null,
   "newValue": "\"StrongAuthenticationRequirement\""}], "administrativeUnits": []}],
   "additionalDetails": []}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_enable_account.yml

@@ -79,3 +79,10 @@ example_log: '{"time": "2023-07-24T14:28:15.2223487Z", "resourceId": "/tenants/f
   "newValue": "[true]"}, {"displayName": "Included Updated Properties", "oldValue":
   null, "newValue": "\"AccountEnabled\""}], "administrativeUnits": []}], "additionalDetails":
   []}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_invite_external_user.yml

@@ -80,3 +80,10 @@ example_log: '{"time": "2023-07-13T00:29:59.5100003Z", "resourceId": "/tenants/f
   {"key": "wids", "value": "62e90394-69f5-4237-9190-012177145e10"}, {"key": "InvitationId",
   "value": "65c7d12f-c6f3-44f0-8fad-4f57a1020484"}, {"key": "invitedUserEmailAddress",
   "value": "oops360@gmail.com"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_reset_password_(by_admin).yml

@@ -77,3 +77,10 @@ example_log: '{"time": "2023-07-24T14:28:55.0648789Z", "resourceId": "/tenants/f
   "displayName": "test", "type": "User", "userPrincipalName": "testuser@splunkresearch.com",
   "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key":
   "OnPremisesAgent", "value": "None"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_set_domain_authentication.yml

@@ -81,3 +81,10 @@ example_log: '{"time": "2023-07-26T13:44:59.0372448Z", "resourceId": "/tenants/f
   "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails":
   [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
   AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_sign_in_activity.yml

@@ -159,3 +159,10 @@ example_log: '{"time": "2023-10-24T20:13:31.4449614Z", "resourceId": "/tenants/8
   "ropc", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575",
   "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod":
   "none"}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_update_application.yml

@@ -81,3 +81,10 @@ example_log: '{"time": "2024-01-29T21:31:03.0102031Z", "resourceId": "/tenants/7
   "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value":
   "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like
   Gecko) Chrome/120.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "867f0d29-0eab-4017-b691-c4713cc7d7b0"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_update_authorization_policy.yml

@@ -82,3 +82,10 @@ example_log: '{"time": "2023-10-26T19:22:20.2814027Z", "resourceId": "/tenants/5
   Properties", "oldValue": null, "newValue": "\"AllowUserConsentForRiskyApps, PermissionGrantPolicyIdsAssignedToDefaultUserRole\""}],
   "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value":
   "Swagger-Codegen/1.0.0.0/csharp/msal"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_update_user.yml

@@ -81,3 +81,10 @@ example_log: '{"time": "2023-07-24T14:28:15.2233481Z", "resourceId": "/tenants/f
   Properties", "oldValue": null, "newValue": "\"AccountEnabled\""}, {"displayName":
   "TargetId.UserType", "oldValue": null, "newValue": "\"Member\""}], "administrativeUnits":
   []}], "additionalDetails": [{"key": "UserType", "value": "Member"}]}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_active_directory_user_registered_security_info.yml

@@ -76,3 +76,10 @@ example_log: '{"time": "2023-01-30T21:11:30.8690619Z", "resourceId": "/tenants/9
   "roles": []}}, "targetResources": [{"id": "40b61050-e814-4ae5-8ffe-66b6f0c53998",
   "displayName": "User30", "type": "User", "userPrincipalName": "User30@splunkresearch.com",
   "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": []}}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_audit_create_or_update_an_azure_automation_account.yml

@@ -133,3 +133,10 @@ example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccou
   "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value":
   "", "localizedValue": ""}, "eventTimestamp": "2022-08-22T15:09:21.8694806Z", "submissionTimestamp":
   "2022-08-22T15:10:51.152208Z", "subscriptionId": "67165197-75ea-4ca3-96a5-3e23868eacd0"}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml

@@ -134,3 +134,10 @@ example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccou
   "Succeeded"}, "subStatus": {"value": "", "localizedValue": ""}, "eventTimestamp":
   "2022-08-22T19:07:34.1346086Z", "submissionTimestamp": "2022-08-22T19:08:54.1547383Z",
   "subscriptionId": "1aee0e3d-b75b-440a-a927-76f0552a14e6"}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml

@@ -145,3 +145,10 @@ example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccou
   "Succeeded"}, "subStatus": {"value": "Created", "localizedValue": "Created (HTTP
   Status Code: 201)"}, "eventTimestamp": "2022-08-23T20:57:22.2707386Z", "submissionTimestamp":
   "2022-08-23T20:58:54.2071536Z", "subscriptionId": "e0c00901-96b2-4151-80f7-746e24c03e98"}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product

data_sources/azure_monitor_activity.yml

@@ -109,3 +109,10 @@ example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b
   "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]},
   "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00",
   "identity": "brian.cove@frothlydev.onmicrosoft.com"}'
+output_fields:
+- action
+- dest
+- user
+- src
+- vendor_account
+- vendor_product