All Apps and Add-ons

GraphSecurityAlert - Invalid JSON for recommendedActions node

ChrisBell04
Communicator

System
Microsoft Graph Security API Add-On for Splunk v1.1.0
Splunk Enterprise 7.1.10

Problem
recommendedActions node for Network_TrafficFromUnrecommendedIP events are not valid JSON

Details
The data contained within the recommendedActions node isn’t JSON, which prevents Splunk from being able to properly apply the JSON indexed_extraction. Thus it shows up as a large text string and the contained fields are not reportable.

Using any JSON formatting tool, the highlighted row is are the fields in question for correction:

"azureSubscriptionId": "48381800-1ec9-4a2f-bbda-a1a1a188a2b1",
"recommendedActions": [
    "{\"kind\":\"openBlade\",\"displayValue\":\"Enforce rule\",\"extension\":\"Microsoft_Azure_Security_R3\",\"detailBlade\":\"AdaptiveNetworkControlsResourceBlade\",\"detailBladeInputs\":\"protectedResourceId=/subscriptions/48381800-1ec9-4a2f-bbda-a1a1a188a2b1/resourcegroups/freddata-rg/providers/microsoft.compute/virtualmachines/fredcomputebdc1111111\"}"
],
"title": "Traffic detected from IP addresses recommended for blocking",

After minor regex to remove the invalid characters, that same section above would look like the following:

"azureSubscriptionId": "48381800-1ec9-4a2f-bbda-a1a1a188a2b1",
"recommendedActions": [
    {
        "kind": "openBlade",
        "displayValue": "Enforce rule",
        "extension": "Microsoft_Azure_Security_R3",
        "detailBlade": "AdaptiveNetworkControlsResourceBlade",
        "detailBladeInputs": "protectedResourceId=/subscriptions/48381800-1ec9-4a2f-bbda-a1a1a188a2b1/resourcegroups/freddata-rg/providers/microsoft.compute/virtualmachines/fredcomputebdc947035"
    }
],
"title": "Traffic detected from IP addresses recommended for blocking",
0 Karma

to4kawa
Ultra Champion
| makeresults 
 |eval _raw="\"azureSubscriptionId\": \"48381800-1ec9-4a2f-bbda-a1a1a188a2b1\",
  \"recommendedActions\": [
      \"{\\\"kind\\\":\\\"openBlade\\\",\\\"displayValue\\\":\\\"Enforce rule\\\",\\\"extension\\\":\\\"Microsoft_Azure_Security_R3\\\",\\\"detailBlade\\\":\\\"AdaptiveNetworkControlsResourceBlade\\\",\\\"detailBladeInputs\\\":\\\"protectedResourceId=/subscriptions/48381800-1ec9-4a2f-bbda-a1a1a188a2b1/resourcegroups/freddata-rg/providers/microsoft.compute/virtualmachines/fredcomputebdc1111111\\\"}\"
  ],
  \"title\": \"Traffic detected from IP addresses recommended for blocking\","
| rex mode=sed "s/(?s)^.*?(\{.*}).*$/\1/g"
| rex mode=sed "s$\\\$$g"
| spath

This query works well.

props.conf

[msgraph_json]
SEDCMD-backslash = s/\\\//g
EXTRACT-azureSubscriptionId = azureSubscriptionId\"\:\s+\"(?<azureSubscriptionId>\S+)\",
EXTRACT-title = title\"\:\s+\"(?<title>[^\"]+)\"
SEDCMD-trim = s/(?s)^.*?(\{.*}).*$/\1/g
KV_MODE = json
0 Karma

to4kawa
Ultra Champion
| makeresults 
|eval _raw="\"azureSubscriptionId\": \"48381800-1ec9-4a2f-bbda-a1a1a188a2b1\",
 \"recommendedActions\": [
     \"{\\\"kind\\\":\\\"openBlade\\\",\\\"displayValue\\\":\\\"Enforce rule\\\",\\\"extension\\\":\\\"Microsoft_Azure_Security_R3\\\",\\\"detailBlade\\\":\\\"AdaptiveNetworkControlsResourceBlade\\\",\\\"detailBladeInputs\\\":\\\"protectedResourceId=/subscriptions/48381800-1ec9-4a2f-bbda-a1a1a188a2b1/resourcegroups/freddata-rg/providers/microsoft.compute/virtualmachines/fredcomputebdc1111111\\\"}\"
 ],
 \"title\": \"Traffic detected from IP addresses recommended for blocking\","
 | eval _raw=split(_raw,",")
 | stats count by _raw
 | fields - count
 | rex max_match=0 "(?m)(?<keyvalue>\".*:.*\")"
 | eval keyvalue=replace(keyvalue,"[{\\\\\"}]","")
 | eval _raw=replace(keyvalue,"(\w+):(.*)","\1=\"\2\"")
 | kv
 | fields - keyvalue
 | stats values(*) as *
 | foreach * [eval <<FIELD>> = trim('<<FIELD>>')]
0 Karma

ChrisBell04
Communicator

Thanks for the code.

Yup, that can work for an adhoc fix. Still would like to see MS implement the fix in their addon or in the API data.

0 Karma

to4kawa
Ultra Champion

my props.conf example is useless? `

0 Karma

to4kawa
Ultra Champion

what do you want to do?

0 Karma

ChrisBell04
Communicator

Have the addon (either the python input code) or props, implement a fix.

None of the other categories of data have the backslash quoted fields either, so not sure if its a problem upstream with the API or how the input handles the data.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...