[ASIM Parsers] Generate deployable ARM templates from KQL function YA…

…ML files.

Parsers/ASimAuditEvent/ARM/ASimAuditEventNative/ASimAuditEventNative.json

@@ -27,7 +27,7 @@
         "displayName": "Audit Event ASIM parser for Microsoft Sentinel native Audit Event table",
         "category": "ASIM",
         "FunctionAlias": "ASimAuditEventNative",
-        "query": "let parser=(disabled:bool=false) \n{\n  ASimAuditEventLogs  | where not(disabled)\n    | extend EventSchema = \"AuditEvent\"\n    | extend\n        Value\t= NewValue,\n        User =  ActorUsername,\n        Application =  TargetAppName,\n        Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n        Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)), \n        Rule=RuleName,\n        EventStartTime = TimeGenerated,\n        EventEndTime = TimeGenerated\n    | project-rename\n        EventUid = _ItemId\n    | project-away\n        _ResourceId, _SubscriptionId\n};\nparser  (disabled=disabled)\n",
+        "query": "let parser=(disabled:bool=false) \n{\n  ASimAuditEventLogs  | where not(disabled)\n    | extend EventSchema = \"AuditEvent\"\n    | extend\n        Value\t= NewValue,\n        User =  ActorUsername,\n        Application =  TargetAppName,\n        Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n        Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)), \n        Rule=RuleName,\n        EventStartTime = TimeGenerated,\n        EventEndTime = TimeGenerated\n    | project-away\n        _ResourceId, _SubscriptionId\n};\nparser  (disabled=disabled)\n",
         "version": 1,
         "functionParameters": "disabled:bool=False"
       }

Parsers/ASimAuditEvent/ARM/vimAuditEventNative/vimAuditEventNative.json

@@ -27,7 +27,7 @@
         "displayName": "Audit Event ASIM filtering parser for Microsoft Sentinel native Audit Event table",
         "category": "ASIM",
         "FunctionAlias": "vimAuditEventNative",
-        "query": "let parser=\n(\n  starttime: datetime=datetime(null), \n  endtime: datetime=datetime(null),\n  srcipaddr_has_any_prefix: dynamic=dynamic([]), \n  eventtype_in: dynamic=dynamic([]),\n  eventresult: string='*',\n  actorusername_has_any: dynamic=dynamic([]),\n  operation_has_any: dynamic=dynamic([]),\n  object_has_any: dynamic=dynamic([]),\n  newvalue_has_any: dynamic=dynamic([]),\n  disabled: bool = false\n)\n{\n  ASimAuditEventLogs  | where not(disabled)\n  | where (isnull(starttime) or TimeGenerated >= starttime) \n                  and (isnull(endtime) or TimeGenerated <= endtime)\n                  and ((array_length(srcipaddr_has_any_prefix) == 0) or SrcIpAddr has_any (srcipaddr_has_any_prefix))\n                  and (array_length(actorusername_has_any) == 0  or ActorUsername has_any (actorusername_has_any))\n                  and (array_length(newvalue_has_any) == 0 or NewValue has_any (newvalue_has_any))\n                  and (array_length(eventtype_in) == 0 or EventType has_any (eventtype_in))\n                  and (array_length(operation_has_any) == 0 or Operation has_any (operation_has_any))\n                  and (eventresult == '*' or EventResult == eventresult)\n                  and (array_length(object_has_any) == 0 or Object has_any (object_has_any))\n  | extend EventSchema = \"AuditEvent\"\n  | extend\n        Value\t= NewValue,\n        User =  ActorUsername,\n        Application =  TargetAppName,\n        Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n        Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)),\n        Rule=RuleName,\n        EventStartTime = TimeGenerated,\n        EventEndTime = TimeGenerated\n  | project-rename\n        EventUid = _ItemId\n    | project-away \n        _ResourceId, _SubscriptionId\n  };\n  parser(\n    starttime=starttime, \n    endtime=endtime, \n    srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, \n    eventtype_in=eventtype_in, \n    eventresult=eventresult, \n    actorusername_has_any=actorusername_has_any, \n    operation_has_any=operation_has_any, \n    object_has_any=object_has_any, \n    newvalue_has_any=newvalue_has_any, \n    disabled=disabled\n  )\n  ",
+        "query": "let parser=\n(\n  starttime: datetime=datetime(null), \n  endtime: datetime=datetime(null),\n  srcipaddr_has_any_prefix: dynamic=dynamic([]), \n  eventtype_in: dynamic=dynamic([]),\n  eventresult: string='*',\n  actorusername_has_any: dynamic=dynamic([]),\n  operation_has_any: dynamic=dynamic([]),\n  object_has_any: dynamic=dynamic([]),\n  newvalue_has_any: dynamic=dynamic([]),\n  disabled: bool = false\n)\n{\n  ASimAuditEventLogs  | where not(disabled)\n  | where (isnull(starttime) or TimeGenerated >= starttime) \n                  and (isnull(endtime) or TimeGenerated <= endtime)\n                  and ((array_length(srcipaddr_has_any_prefix) == 0) or SrcIpAddr has_any (srcipaddr_has_any_prefix))\n                  and (array_length(actorusername_has_any) == 0  or ActorUsername has_any (actorusername_has_any))\n                  and (array_length(newvalue_has_any) == 0 or NewValue has_any (newvalue_has_any))\n                  and (array_length(eventtype_in) == 0 or EventType has_any (eventtype_in))\n                  and (array_length(operation_has_any) == 0 or Operation has_any (operation_has_any))\n                  and (eventresult == '*' or EventResult == eventresult)\n                  and (array_length(object_has_any) == 0 or Object has_any (object_has_any))\n  | extend EventSchema = \"AuditEvent\"\n  | extend\n        Value\t= NewValue,\n        User =  ActorUsername,\n        Application =  TargetAppName,\n        Dst = coalesce (TargetDvcId, TargetHostname, TargetIpAddr, TargetAppId, TargetAppName),\n        Dvc = coalesce (DvcFQDN, DvcHostname, DvcIpAddr, DvcId, _ResourceId, strcat (EventVendor,'/', EventProduct)),\n        Rule=RuleName,\n        EventStartTime = TimeGenerated,\n        EventEndTime = TimeGenerated\n    | project-away \n        _ResourceId, _SubscriptionId\n  };\n  parser(\n    starttime=starttime, \n    endtime=endtime, \n    srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, \n    eventtype_in=eventtype_in, \n    eventresult=eventresult, \n    actorusername_has_any=actorusername_has_any, \n    operation_has_any=operation_has_any, \n    object_has_any=object_has_any, \n    newvalue_has_any=newvalue_has_any, \n    disabled=disabled\n  )\n  ",
         "version": 1,
         "functionParameters": "starttime:datetime=datetime(null),endtime:datetime=datetime(null),srcipaddr_has_any_prefix:dynamic=dynamic([]),actorusername_has_any:dynamic=dynamic([]),operation_has_any:dynamic=dynamic([]),eventtype_in:dynamic=dynamic([]),eventresult:string='*',object_has_any:dynamic=dynamic([]),newvalue_has_any:dynamic=dynamic([]),disabled:bool=False"
       }