Ueba Reference

@@ -31,12 +31,14 @@ These are the data sources from which the UEBA engine collects and analyzes data | AAD service principal sign-in logs  (Preview)| [Microsoft Entra ID](data-connectors-reference.md#microsoft-entra-id) | [AADServicePrincipalSignInLogs](/azure/azure-monitor/reference/tables/aadserviceprincipalsigninlogs) | All service principal sign-in events | | Audit Logs | [Microsoft Entra ID](data-connectors-reference.md#microsoft-entra-id) | [AuditLogs](/azure/azure-monitor/reference/tables/auditlogs) | ApplicationManagement<br>DirectoryManagement<br>GroupManagement<br>Device<br>RoleManagement<br>UserManagementCategory | | AWS CloudTrail  (Preview)| [Amazon Web Services](data-connectors-reference.md#amazon-web-services)<br>[Amazon Web Services S3](data-connectors-reference.md#amazon-web-services-s3) | [AWSCloudTrail](/azure/azure-monitor/reference/tables/awscloudtrail) | Console sign-in events.<br>Identified by `EventName = "ConsoleLogin"` and `EventSource = "signin.amazonaws.com"`. Events must have a valid `UserIdentityPrincipalId`. |+| AWS GuardDuty (Preview) | [Amazon Web Services S3](data-connectors-reference.md#amazon-web-services-s3) | [AWSGuardDuty](/azure/azure-monitor/reference/tables/awsguardduty) | AWS GuardDuty findings associated with AWS identities. Events must have valid `ActivityType`, `AccountId`, and `ResourceDetails` fields, including an `accessKeyDetails.principalId`. | | Azure Activity | [Azure Activity](data-connectors-reference.md#azure-activity) | [AzureActivity](/azure/azure-monitor/reference/tables/azureactivity) | Authorization<br>AzureActiveDirectory<br>Billing<br>Compute<br>Consumption<br>KeyVault<br>Devices<br>Network<br>Resources<br>Intune<br>Logic<br>Sql<br>Storage | | Device Logon Events  (Preview)| [Microsoft Defender XDR](data-connectors-reference.md#microsoft-defender-xdr) | [DeviceLogonEvents](/azure/azure-monitor/reference/tables/devicelogonevents) | All device logon events | | GCP Audit Logs  (Preview)| [GCP Pub/Sub Audit Logs](data-connectors-reference.md#gcp-pubsub-audit-logs) | [GCPAuditLogs](/azure/azure-monitor/reference/tables/gcpauditlogs) | `apigee.googleapis.com` - API Management Platform<br>`iam.googleapis.com` - Identity and Access Management (IAM) service<br>`iamcredentials.googleapis.com` - IAM Service Account Credentials API<br>`cloudresourcemanager.googleapis.com` - Cloud Resource Manager API<br>`compute.googleapis.com` - Compute Engine API<br>`storage.googleapis.com` - Cloud Storage API<br>`container.googleapis.com` - Kubernetes Engine API<br>`k8s.io` - Kubernetes API<br>`cloudsql.googleapis.com` - Cloud SQL API<br>`bigquery.googleapis.com` - BigQuery API<br>`bigquerydatatransfer.googleapis.com` - BigQuery Data Transfer Service API<br>`cloudfunctions.googleapis.com` - Cloud Functions API<br>`appengine.googleapis.com` - App Engine API<br>`dns.googleapis.com` - Cloud DNS API<br>`bigquerydatapolicy.googleapis.com` - BigQuery Data Policy API<br>`firestore.googleapis.com` - Firestore API<br>`dataproc.googleapis.com` - Dataproc API<br>`osconfig.googleapis.com` - OS Config API<br>`cloudkms.googleapis.com` - Cloud KMS API<br>`secretmanager.googleapis.com` - Secret Manager API<br>Events must have a valid:<br>- `PrincipalEmail` - The user or service account that called the API<br>- `MethodName` - The specific Google API method called<br>- Principal email, in `[email protected]` format. | | Okta CL  (Preview)| Okta Single Sign-On (using Azure Functions)| Okta_CL, OktaV2_CL | Authentication, multifactor authentication (MFA), and session events, including:<br>`app.oauth2.admin.consent.grant_success`<br>`app.oauth2.authorize.code_success`<br>`device.desktop_mfa.recovery_pin.generate`<br>`user.authentication.auth_via_mfa`<br>`user.mfa.attempt_bypass`<br>`user.mfa.factor.deactivate`<br>`user.mfa.factor.reset_all`<br>`user.mfa.factor.suspend`<br>`user.mfa.okta_verify`<br>`user.session.impersonation.grant`<br>`user.session.impersonation.initiate`<br>`user.session.start`<br>Events must have a valid User ID (`actor_id_s`). | | Security Events | [Windows Security Events via AMA](data-connectors-reference.md#windows-security-events-via-ama)<br>[Windows Forwarded Events](data-connectors-reference.md#windows-forwarded-events) | [WindowsEvent](/azure/azure-monitor/reference/tables/windowsevent)<br>[SecurityEvent](/azure/azure-monitor/reference/tables/securityevent) | 4624: An account was successfully logged on<br>4625: An account failed to log on<br>4648: A logon was attempted using explicit credentials<br>4672: Special privileges assigned to new logon<br>4688: A new process has been created | | Sign-in Logs | [Microsoft Entra ID](data-connectors-reference.md#microsoft-entra-id) | [SigninLogs](/azure/azure-monitor/reference/tables/signinlogs) | All sign-in events |+| CommonSecurityLog (Preview) | Common Event Format (CEF) | [CommonSecurityLog](/azure/azure-monitor/reference/tables/commonsecuritylog) | Firewall, VPN, and web proxy events from the following vendors and products:<br><br>**Check Point** (`DeviceVendor` is `Check Point`)<br>- `VPN-1 & FireWall-1` - VPN login events<br>- `URL Filtering` - web access events<br>- IPS, Anti-Bot, and Anti-Virus prevention events of medium severity or higher<br><br>**Fortinet** (`DeviceVendor` is `Fortinet`)<br>- `FortiGate` - VPN authentication events<br>- `FortiGate` - web filtering events<br>- `FortiGate` - administrative firewall policy changes<br><br>**Zscaler** (`DeviceVendor` is `Zscaler`)<br>- `NSSWeblog` - web proxy events<br>- Zscaler Private Access - VPN authentication events<br>- Zscaler portal - administrative actions (`SIGN_IN`, `SIGN_OUT`, `CREATE`, `UPDATE`, `DELETE`)<br><br>Events must have a valid `SourceUserName` value for user-based detections, or a valid `Computer` value for device-based detections. |  ## UEBA enrichments