How to use the SonicWall ASIM Parsers in your Sentinel workspace?

This article covers how to use the SonicWall ASIM parsers in your Microsoft Sentinel workspace.

This article has a prerequisite: How to Deploy the SonicWall ASIM Parsers into your Sentinel workspace.

While the parsers are built into every Microsoft Sentinel workspace for broader use and unification of NetworkSession or WebSession events across multiple vendors, deploying the SonicWall parsers into the workspace enables the Workbooks, Analytic Rules, Hunting Queries, etc. to function using the workspace function names, rather than the built-in function names.

Parser Overview

Advanced Security Information Model (ASIM) parsers are used in Microsoft Sentinel for parsing and normalization of event data stored in existing table, such as CommonSecurityLog. There are built-in parsers as well as “workspace-deployed” parsers. There are advantages and disadvantages to each.

You can read more about ASIM parsers here: https://learn.microsoft.com/en-us/azure/sentinel/normalization-parsers-overview

ASim and vim parser variants:

• Regular parsers (prefixed with “ASim”) are parsers that do not require filtering parameters, and support setting a time range from a drop down when writing queries on the “Logs” page.
• Parameterized parsers (prefixed with “vim”) require filtering parameters. Filtering parameters can improve your query performance by fine-tuning the query using the available parameters such as start time/end time, source/destination IP address prefix, port number, action, and event result.
  • Each schema has a set of filtering parameters.

SonicWall provides a regular parser and parameterized parser for each schema we support. Each schema has a set fields and guidelines, so it’s a good idea to review schema documentation for information about the available fields. Learn more about the Network Session and Web Session schemas at the links in the table below.

 

Table of filtering parameters

Mapping Table: fw_action to DvcAction to EventResult

Instructions

In your Microsoft Sentinel workspace:

Navigate to the “General” > “Logs” page.

Querying the CommonSecurityLog table

Query the CommonSecurityLog table to confirm data from your firewall is being ingested by Microsoft Sentinel. Use the queries below to display a limited number of events and reorder columns for easier identification by model and serial number. The second query returns a list of distinct serial numbers from the data in CommonSecurityLog. Adjust these queries as needed to confirm that data you expect is reaching Microsoft Sentinel.

CommonSecurityLog

| limit 10

| project-reorder DeviceVendor, DeviceProduct, Computer

 

CommonSecurityLog

| distinct Computer

Querying with the regular parsers

Use the following basic queries individually to display events parsed, normalized, and filtered down based on the ASIM schemas. These queries reorder a few columns so that the schema and firewall can be quickly identified.

ASimNetworkSessionSonicWallFirewall

| limit 10

| project-reorder EventVendor, Dvc, DvcDescription, EventSchema

 

 

ASimWebSessionSonicWallFirewall

| limit 10

| project-reorder EventVendor, Dvc, DvcDescription, EventSchema

Querying with the parameterized parsers

Use the following queries individually to display events parsed, normalized, and filtered down based on the ASIM schemas. These queries are parameterized, meaning they expect filtering parameters to be applied to the query. Adjust the queries as needed (in particular, the start and end times). Refer to the filtering parameters table above in this article for details and example values.

Network Session:

let starttime = todatetime('2024-10-1 05:04:36');

let endtime = todatetime('2024-10-1 08:04:36');

let srcipaddr_has_any_prefix = dynamic([]);

let dstipaddr_has_any_prefix = dynamic([]);

let ipaddr_has_any_prefix = dynamic([]);

let dstportnumber = int(null);

let hostname_has_any = dynamic([]);

let dvcaction = dynamic([]);

let eventresult = "*";

let disabled = False;

vimNetworkSessionSonicWallFirewall(

    starttime=starttime,

    endtime=endtime,

    srcipaddr_has_any_prefix=srcipaddr_has_any_prefix,

    dstipaddr_has_any_prefix=dstipaddr_has_any_prefix,

    ipaddr_has_any_prefix=ipaddr_has_any_prefix,

    dstportnumber=dstportnumber,

    hostname_has_any=hostname_has_any,

    dvcaction=dvcaction,

    eventresult=eventresult,

    disabled=disabled

)

| limit 10

| project-reorder EventVendor, Dvc, DvcDescription, EventSchema

Web Session:

let starttime = todatetime('2024-10-1 05:04:36');

let endtime = todatetime('2024-10-1 08:04:36');

let srcipaddr = dynamic([]);

let dstipaddr = dynamic([]);

let ipaddr = dynamic([]);

let url_has_any = dynamic([]);

let httpuseragent_has_any = dynamic([]);

let eventresult = "*";

let disabled = False;

vimWebSessionSonicWallFirewall(

starttime=starttime, endtime=endtime,

srcipaddr_has_any_prefix=srcipaddr,

ipaddr_has_any_prefix=ipaddr,

url_has_any=url_has_any,

httpuseragent_has_any=httpuseragent_has_any,

eventresult=eventresult,

disabled=disabled

)

| limit 10

| project-reorder EventVendor, Dvc, DvcDescription, EventSchema