All Apps and Add-ons

GraphSecurityAlert - Invalid JSON for recommendedActions node

ChrisBell04
Communicator

System
Microsoft Graph Security API Add-On for Splunk v1.1.0
Splunk Enterprise 7.1.10

Problem
recommendedActions node for Network_TrafficFromUnrecommendedIP events are not valid JSON

Details
The data contained within the recommendedActions node isn’t JSON, which prevents Splunk from being able to properly apply the JSON indexed_extraction. Thus it shows up as a large text string and the contained fields are not reportable.

Using any JSON formatting tool, the highlighted row is are the fields in question for correction:

"azureSubscriptionId": "48381800-1ec9-4a2f-bbda-a1a1a188a2b1",
"recommendedActions": [
    "{\"kind\":\"openBlade\",\"displayValue\":\"Enforce rule\",\"extension\":\"Microsoft_Azure_Security_R3\",\"detailBlade\":\"AdaptiveNetworkControlsResourceBlade\",\"detailBladeInputs\":\"protectedResourceId=/subscriptions/48381800-1ec9-4a2f-bbda-a1a1a188a2b1/resourcegroups/freddata-rg/providers/microsoft.compute/virtualmachines/fredcomputebdc1111111\"}"
],
"title": "Traffic detected from IP addresses recommended for blocking",

After minor regex to remove the invalid characters, that same section above would look like the following:

"azureSubscriptionId": "48381800-1ec9-4a2f-bbda-a1a1a188a2b1",
"recommendedActions": [
    {
        "kind": "openBlade",
        "displayValue": "Enforce rule",
        "extension": "Microsoft_Azure_Security_R3",
        "detailBlade": "AdaptiveNetworkControlsResourceBlade",
        "detailBladeInputs": "protectedResourceId=/subscriptions/48381800-1ec9-4a2f-bbda-a1a1a188a2b1/resourcegroups/freddata-rg/providers/microsoft.compute/virtualmachines/fredcomputebdc947035"
    }
],
"title": "Traffic detected from IP addresses recommended for blocking",
0 Karma

to4kawa
Ultra Champion
| makeresults 
 |eval _raw="\"azureSubscriptionId\": \"48381800-1ec9-4a2f-bbda-a1a1a188a2b1\",
  \"recommendedActions\": [
      \"{\\\"kind\\\":\\\"openBlade\\\",\\\"displayValue\\\":\\\"Enforce rule\\\",\\\"extension\\\":\\\"Microsoft_Azure_Security_R3\\\",\\\"detailBlade\\\":\\\"AdaptiveNetworkControlsResourceBlade\\\",\\\"detailBladeInputs\\\":\\\"protectedResourceId=/subscriptions/48381800-1ec9-4a2f-bbda-a1a1a188a2b1/resourcegroups/freddata-rg/providers/microsoft.compute/virtualmachines/fredcomputebdc1111111\\\"}\"
  ],
  \"title\": \"Traffic detected from IP addresses recommended for blocking\","
| rex mode=sed "s/(?s)^.*?(\{.*}).*$/\1/g"
| rex mode=sed "s$\\\$$g"
| spath

This query works well.

props.conf

[msgraph_json]
SEDCMD-backslash = s/\\\//g
EXTRACT-azureSubscriptionId = azureSubscriptionId\"\:\s+\"(?<azureSubscriptionId>\S+)\",
EXTRACT-title = title\"\:\s+\"(?<title>[^\"]+)\"
SEDCMD-trim = s/(?s)^.*?(\{.*}).*$/\1/g
KV_MODE = json
0 Karma

to4kawa
Ultra Champion
| makeresults 
|eval _raw="\"azureSubscriptionId\": \"48381800-1ec9-4a2f-bbda-a1a1a188a2b1\",
 \"recommendedActions\": [
     \"{\\\"kind\\\":\\\"openBlade\\\",\\\"displayValue\\\":\\\"Enforce rule\\\",\\\"extension\\\":\\\"Microsoft_Azure_Security_R3\\\",\\\"detailBlade\\\":\\\"AdaptiveNetworkControlsResourceBlade\\\",\\\"detailBladeInputs\\\":\\\"protectedResourceId=/subscriptions/48381800-1ec9-4a2f-bbda-a1a1a188a2b1/resourcegroups/freddata-rg/providers/microsoft.compute/virtualmachines/fredcomputebdc1111111\\\"}\"
 ],
 \"title\": \"Traffic detected from IP addresses recommended for blocking\","
 | eval _raw=split(_raw,",")
 | stats count by _raw
 | fields - count
 | rex max_match=0 "(?m)(?<keyvalue>\".*:.*\")"
 | eval keyvalue=replace(keyvalue,"[{\\\\\"}]","")
 | eval _raw=replace(keyvalue,"(\w+):(.*)","\1=\"\2\"")
 | kv
 | fields - keyvalue
 | stats values(*) as *
 | foreach * [eval <<FIELD>> = trim('<<FIELD>>')]
0 Karma

ChrisBell04
Communicator

Thanks for the code.

Yup, that can work for an adhoc fix. Still would like to see MS implement the fix in their addon or in the API data.

0 Karma

to4kawa
Ultra Champion

my props.conf example is useless? `

0 Karma

to4kawa
Ultra Champion

what do you want to do?

0 Karma

ChrisBell04
Communicator

Have the addon (either the python input code) or props, implement a fix.

None of the other categories of data have the backslash quoted fields either, so not sure if its a problem upstream with the API or how the input handles the data.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...