What Changed
Critical fixes to ASIM Authentication parsers for Microsoft Windows Event and SSH (sshd) sources addressing SrcHostname resolution when WorkstationName is empty and correcting IpAddr field aliasing.
Parser Impact
- Microsoft Windows Event parser: SrcHostname now falls back to Computer when WorkstationName is empty or ‘-’, preventing null hostname values in normalized output
- SSH parser: IpAddr alias corrected to reference SrcIpAddr instead of DvcIpAddr for proper source IP visibility
- Added DvcHostName alias mapping in both parsers for improved field standardization
- No change to normalised field names or core filter logic — safe for existing detections using these parsers
Affected Files
Parsers/ASimAuthentication/Parsers/ASimAuthenticationMicrosoftWindowsEvent.yaml
Parsers/ASimAuthentication/Parsers/vimAuthenticationMicrosoftWindowsEvent.yaml
Parsers/ASimAuthentication/Parsers/ASimAuthenticationSshd.yaml
Parsers/ASimAuthentication/Parsers/vimAuthenticationSshd.yaml
(ARM templates: ASimAuthenticationMicrosoftWindowsEvent.json, ASimAuthenticationSshd.json, vimAuthenticationMicrosoftWindowsEvent.json, vimAuthenticationSshd.json)