| title | description | author | ms.topic | ms.date | ms.author |
|---|---|---|---|---|---|
The Advanced Security Information Model (ASIM) Authentication normalization schema reference (Public preview) | Microsoft Docs |
This article describes the Microsoft Sentinel Authentication normalization schema. |
oshezaf |
reference |
11/09/2021 |
ofshezaf |
The Advanced Security Information Model (ASIM) Authentication normalization schema reference (Public preview)
[!INCLUDE Banner for top of topics]
The Microsoft Sentinel Authentication schema is used to describe events related to user authentication, sign-in, and sign-out. Authentication events are sent by many reporting devices, usually as part of the event stream alongside other events. For example, Windows sends several authentication events alongside other OS activity events.
Authentication events include both events from systems that focus on authentication such as VPN gateways or domain controllers, and direct authentication to an end system, such as a computer or firewall.
For more information about normalization in Microsoft Sentinel, see Normalization and the Advanced Security Information Model (ASIM).
Important
The Authentication normalization schema is currently in PREVIEW. This feature is provided without a service level agreement, and is not recommended for production workloads.
The Azure Preview Supplemental Terms include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
Deploy ASIM authentication parsers from the Microsoft Sentinel GitHub repository. For more information about ASIM parsers, see the articles ASIM parsers overview..
To use parsers that unify all ASIM out-of-the-box parsers, and ensure that your analysis runs across all the configured sources, use the imAuthentication filtering parser or the ASimAuthentication parameter-less parser.
For the list of authentication parsers Microsoft Sentinel provides refer to the ASIM parsers list:
When implementing custom parsers for the Authentication information model, name your KQL functions using the following syntax:
vimAuthentication<vendor><Product>for filtering parsersASiAuthentication<vendor><Product>for parameter-less parsers
For information on adding your custom parsers to the unifying parser, refer to Managing ASIM parsers.
The im and vim* parsers support filtering parameters. While these parsers are optional, they can improve your query performance.
The following filtering parameters are available:
| Name | Type | Description |
|---|---|---|
| starttime | datetime | Filter only authentication events that ran at or after this time. |
| endtime | datetime | Filter only authentication events that finished running at or before this time. |
| targetusername_has | string | Filter only authentication events that have any of the listed user names. |
For example, to filter only authentication events from the last day to a specific user, use:
imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=now())Tip
To pass a literal list to parameters that expect a dynamic value, explicitly use a dynamic literal. For example: dynamic(['192.168.','10.']).
Normalized authentication analytic rules are unique as they detect attacks across sources. So, for example, if a user logged in to different, unrelated systems, from different countries, Microsoft Sentinel will now detect this threat.
For a full list of analytics rules that use normalized Authentication events, see Authentication schema security content.
The Authentication information model is aligned with the OSSEM logon entity schema.
The fields listed in the table below are specific to Authentication events, but are similar to fields in other schemas and follow similar naming conventions.
Authentication events reference the following entities:
- TargetUser - The user information used to authenticate to the system. The TargetSystem is the primary subject of the authentication event, and the alias User aliases a TargetUser identified.
- TargetApp - The application authenticated to.
- Target - The system on which TaregtApp* is running.
- Actor - The user initiating the authentication, if different than TargetUser.
- ActingApp - The application used by the Actor to perform the authentication.
- Src - The system used by the Actor to initiate the authentication.
The relationship between these entities is best demonstrated as follows:
An Actor, running an acting Application, ActingApp, on a source system, Src, attempts to authenticate as a TargetUser to a target application, TargetApp, on a target system, TargetDvc.
In the following tables, Type refers to a logical type. For more information, see Logical types.
Important
Fields common to all schemas are described in detail in the ASIM Common Fields article.
The following list mentions fields that have specific guidelines for authentication events:
| Field | Class | Type | Description |
|---|---|---|---|
| EventType | Mandatory | Enumerated | Describes the operation reported by the record. For Authentication records, supported values include: - Logon - Logoff |
| EventResultDetails | Recommended | String | One of the following values: - No such user or password. This value should be used also when the original event reports that there is no such user, without reference to a password. - Incorrect password- Account expired- Password expired- User locked- User disabled- Logon violates policy. This value should be used when the original event reports, for example: MFA required, logon outside of working hours, conditional access restrictions, or too frequent attempts.- Session expired- OtherNote: The value may be provided in the source record using different terms, which should be normalized to these values. The original value should be stored in the field EventOriginalResultDetails |
| EventSubType | Optional | String | The sign-in type. Allowed values include: System, Interactive, Service, RemoteInteractive, RemoteService, AssumeRole. Example: Interactive. Store the original value in EventOriginalSubType. |
| EventSchemaVersion | Mandatory | String | The version of the schema. The version of the schema documented here is 0.1.1 |
| EventSchema | Optional | String | The name of the schema documented here is Authentication. |
| Dvc fields | - | - | For authentication events, device fields refer to the system reporting the event. |
Important
The EventSchema field is currently optional but will become Mandatory on July 1st 2022.
Fields that appear in the table below are common to all ASIM schemas. Any guideline specified above overrides the general guidelines for the field. For example, a field might be optional in general, but mandatory for a specific schema. For further details on each field, refer to the ASIM Common Fields article.
| Class | Fields |
|---|---|
| Mandatory | - EventCount - EventStartTime - EventEndTime - EventType - EventResult - EventProduct - EventVendor - EventSchema - EventSchemaVersion - Dvc |
| Recommended | - EventResultDetails - EventSeverity - DvcIpAddr - DvcHostname - DvcDomain - DvcDomainType - DvcFQDN - DvcId - DvcIdType - DvcAction |
| Optional | - EventMessage - EventSubType - EventOriginalUid - EventOriginalType - EventOriginalSubType - EventOriginalResultDetails - EventOriginalSeverity - EventProductVersion - EventReportUrl - DvcMacAddr - DvcOs - DvcOsVersion - DvcOriginalAction - DvcInterface - AdditionalFields - DvcDescription |
| Field | Class | Type | Description |
|---|---|---|---|
| LogonMethod | Optional | String | The method used to perform authentication. Example: Username & Password |
| LogonProtocol | Optional | String | The protocol used to perform authentication. Example: NTLM |
| Field | Class | Type | Description |
|---|---|---|---|
| ActorUserId | Optional | String | A machine-readable, alphanumeric, unique representation of the Actor. For more information, and for alternative fields for additional IDs, see The User entity. Example: S-1-12-1-4141952679-1282074057-627758481-2916039507 |
| ActorUserIdType | Optional | UserIdType | The type of the ID stored in the ActorUserId field. For more information and list of allowed values, see UserIdType in the Schema Overview article. |
| ActorUsername | Optional | Username | The Actor’s username, including domain information when available. For more information, see The User entity. Example: AlbertE |
| ActorUsernameType | Optional | UsernameType | Specifies the type of the user name stored in the ActorUsername field. For more information, and list of allowed values, see UsernameType in the Schema Overview article. Example: Windows |
| ActorUserType | Optional | UserType | The type of the Actor. For more information, and list of allowed values, see UserType in the Schema Overview article. For example: Guest |
| ActorSessionId | Optional | String | The unique ID of the sign-in session of the Actor. Example: 102pTUgC3p8RIqHvzxLCHnFlg |
| Field | Class | Type | Description |
|---|---|---|---|
| ActingAppId | Optional | String | The ID of the application authorizing on behalf of the actor, including a process, browser, or service. For example: 0x12ae8 |
| ActiveAppName | Optional | String | The name of the application authorizing on behalf of the actor, including a process, browser, or service. For example: C:\Windows\System32\svchost.exe |
| ActingAppType | Optional | AppType | The type of acting application. For more information, and allowed list of values, see AppType in the Schema Overview article. |
| HttpUserAgent | Optional | String | When authentication is performed over HTTP or HTTPS, this field's value is the user_agent HTTP header provided by the acting application when performing the authentication. For example: Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1 |
| Field | Class | Type | Description |
|---|---|---|---|
| TargetUserId | Optional | UserId | A machine-readable, alphanumeric, unique representation of the target user. For more information, and for alternative fields for additional IDs, see The User entity. Example: 00urjk4znu3BcncfY0h7 |
| TargetUserIdType | Optional | UserIdType | The type of the user ID stored in the TargetUserId field. For more information and list of allowed values, see UserIdType in the Schema Overview article. Example: SID |
| TargetUsername | Optional | Username | The target user username, including domain information when available. For more information, see The User entity. Example: MarieC |
| TargetUsernameType | Optional | UsernameType | Specifies the type of the username stored in the TargetUsername field. For more information and list of allowed values, see UsernameType in the Schema Overview article. |
| TargetUserType | Optional | UserType | The type of the Target user. For more information, and list of allowed values, see UserType in the Schema Overview article. For example: Member |
| TargetSessionId | Optional | String | The sign-in session identifier of the TargetUser on the source device. |
| User | Alias | Username | Alias to the TargetUsername or to the TargetUserId if TargetUsername is not defined. Example: CONTOSO\dadmin |
| Field | Class | Type | Description |
|---|---|---|---|
| Src | Recommended | String | A unique identifier of the source device. This field may alias the SrcDvcId, SrcHostname, or SrcIpAddr fields. Example: 192.168.12.1 |
| SrcDvcId | Optional | String | The ID of the source device as reported in the record. For example: ac7e9755-8eae-4ffc-8a02-50ed7a2216c3 |
| SrcDvcIdType | Optional | DvcIdType | The type of SrcDvcId. For more information, and list of allowed values, see DvcIdType in the Schema Overview article. Note: This field is required if SrcDvcId is used. |
| SrcDeviceType | Optional | DeviceType | The type of the source device. For more information, and list of allowed values, see The Device entity. |
| SrcHostname | Recommended | Hostname | The source device hostname, excluding domain information. If no device name is available, store the relevant IP address in this field. Example: DESKTOP-1282V4D |
| SrcDomain | Recommended | String | The domain of the source device. Example: Contoso |
| SrcDomainType | Recommended | DomainType | The type of SrcDomain. For a list of allowed values and further information refer to DomainType in the Schema Overview article. Required if SrcDomain is used. |
| SrcFQDN | Optional | String | The source device hostname, including domain information when available. Note: This field supports both traditional FQDN format and Windows domain\hostname format. The SrcDomainType field reflects the format used. Example: Contoso\DESKTOP-1282V4D |
| SrcDvcId | Optional | String | The ID of the source device. If multiple IDs are available, use the most important one, and store the others in the fields SrcDvc<DvcIdType>.Example: ac7e9755-8eae-4ffc-8a02-50ed7a2216c3 |
| SrcDvcIdType | Optional | DvcIdType | The type of SrcDvcId. For a list of allowed values and further information refer to DvcIdType in the Schema Overview article. Note: This field is required if SrcDvcId is used. |
| SrcDeviceType | Optional | DeviceType | The type of the source device. For a list of allowed values and further information refer to DeviceType in the Schema Overview article. |
| SrcIpAddr | Optional | IP Address | The IP address of the source device. Example: 2.2.2.2 |
| SrcDvcOs | Optional | String | The OS of the source device. Example: Windows 10 |
| IpAddr | Alias | Alias to SrcIpAddr | |
| SrcIsp | Optional | String | The Internet Service Provider (ISP) used by the source device to connect to the internet. Example: corpconnect |
| SrcGeoCountry | Optional | Country | Example: Canada For more information, see Logical types. |
| SrcGeoCity | Optional | City | Example: Montreal For more information, see Logical types. |
| SrcGeoRegion | Optional | Region | Example: Quebec For more information, see Logical types. |
| SrcGeoLongtitude | Optional | Longitude | Example: -73.614830 For more information, see Logical types. |
| SrcGeoLatitude | Optional | Latitude | Example: 45.505918 For more information, see Logical types. |
| Field | Class | Type | Description |
|---|---|---|---|
| Dst | Recommended | String | A unique identifier of the authentication target. This field may alias the TargerDvcId, TargetHostname, TargetIpAddr, TargetAppId, or TargetAppName fields. Example: 192.168.12.1 |
| TargetAppId | Optional | String | The ID of the application to which the authorization is required, often assigned by the reporting device. Example: 89162 |
| TargetAppName | Optional | String | The name of the application to which the authorization is required, including a service, a URL, or a SaaS application. Example: Saleforce |
| TargetAppType | Optional | AppType | The type of the application authorizing on behalf of the Actor. For more information, and allowed list of values, see AppType in the Schema Overview article. |
| TargetUrl | Optional | URL | The URL associated with the target application. Example: https://console.aws.amazon.com/console/home?fromtb=true&hashArgs=%23&isauthcode=true&nc2=h_ct&src=header-signin&state=hashArgsFromTB_us-east-1_7596bc16c83d260b |
| LogonTarget | Alias | Alias to either TargetAppName, TargetUrl, or TargetHostname, whichever field best describes the authentication target. | |
| TargetHostname | Recommended | Hostname | The target device hostname, excluding domain information. Example: DESKTOP-1282V4D |
| TargetDomain | Recommended | String | The domain of the target device. Example: Contoso |
| TargetDomainType | Recommended | Enumerated | The type of TargetDomain. For a list of allowed values and further information refer to DomainType in the Schema Overview article. Required if TargetDomain is used. |
| TargetFQDN | Optional | String | The target device hostname, including domain information when available. Example: Contoso\DESKTOP-1282V4D Note: This field supports both traditional FQDN format and Windows domain\hostname format. The TargetDomainType reflects the format used. |
| TargetDvcId | Optional | String | The ID of the target device. If multiple IDs are available, use the most important one, and store the others in the fields TargetDvc<DvcIdType>. Example: ac7e9755-8eae-4ffc-8a02-50ed7a2216c3 |
| TargetDvcIdType | Optional | Enumerated | The type of TargetDvcId. For a list of allowed values and further information refer to DvcIdType in the Schema Overview article. Required if TargetDeviceId is used. |
| TargetDeviceType | Optional | Enumerated | The type of the target device. For a list of allowed values and further information refer to DeviceType in the Schema Overview article. |
| TargetIpAddr | Optional | IP Address | The IP address of the target device. Example: 2.2.2.2 |
| TargetDvcOs | Optional | String | The OS of the target device. Example: Windows 10 |
| TargetPortNumber | Optional | Integer | The port of the target device. |
These are the changes in version 0.1.1 of the schema:
- Updated user and device entity fields to align with other schemas.
- Renamed
TargetDvcandSrcDvctoTargetandSrcrespectively to align with current ASIM guidelines. The renamed fields will be implemented as aliases until July 1st 2022. Those fields include:SrcDvcHostname,SrcDvcHostnameType,SrcDvcType,SrcDvcIpAddr,TargetDvcHostname,TargetDvcHostnameType,TargetDvcType,TargetDvcIpAddr, andTargetDvc. - Added the aliases
SrcandDst. - Added the fields
SrcDvcIdType,SrcDeviceType,TargetDvcIdType, andTargetDeviceType. - Added the field
EventSchema- currently optional, but will become mandatory on July 1st, 2022.
For more information, see: