What Changed

Two new YAML parsers (ASimAlertEventGoogleThreatIntelligence and vimAlertEventGoogleThreatIntelligence) have been added to the ASIM AlertEvent schema, normalising Google Threat Intelligence (GTI) Relevance System Alerts from the RelevanceSystemAlerts_CL custom table. Both the union parser (ASimAlertEvent) and the filtering parser (imAlertEvent) have been updated to include these new parsers, bumping both to version 0.1.7.

Parser Impact

  • Schema: ASIM AlertEvent (version 0.1)
  • Source table: RelevanceSystemAlerts_CL
  • Change type: Net-new parser — prior to this PR, GTI Relevance System Alerts ingested into RelevanceSystemAlerts_CL were invisible to any detection or hunting query referencing imAlertEvent or ASimAlertEvent. This is a data fidelity gap now closed.

Key field mappings:

  • state to AlertStatus (via lookup: NEW/READ/TRIAGED/ESCALATED maps to Active; RESOLVED/DUPLICATE/FALSE_POSITIVE/BENIGN/NOT_ACTIONABLE/TRACKED_EXTERNALLY maps to Closed)
  • state to AlertVerdict (FALSE_POSITIVE, BENIGN, RESOLVED mapped; all others default to Unknown)
  • severityAnalysis_severityLevel to EventSeverity (CRITICAL/HIGH maps to High, MEDIUM to Medium, LOW to Low, else Informational)
  • detail_detailType to ThreatCategory and EventSubType (maps data_leak, initial_access_broker, insider_threat)
  • relevanceAnalysis_confidence to ThreatConfidence (HIGH=90, MEDIUM=60, LOW=30, default=50)
  • priorityAnalysis_priorityLevel to ThreatRiskLevel (CRITICAL=100, HIGH=75, MEDIUM=50, LOW=25)
  • ThreatIsActive set to true for open states (NEW, READ, TRIAGED, ESCALATED, STATE_UNSPECIFIED)

pack mode includes additional context fields: etag, findings, discovery document IDs per alert type, relevance analysis reasoning, severity confidence, and priority reasoning.

The filtering parser (vimAlertEventGoogleThreatIntelligence) supports the full ASIM filter parameter set: starttime/endtime, ipaddr_has_any_prefix, hostname_has_any, username_has_any, attacktactics_has_any, attacktechniques_has_any, threatcategory_has_any, alertverdict_has_any, and eventseverity_has_any.

Affected Files

Parsers/ASimAlertEvent/ARM/ASimAlertEvent/ASimAlertEvent.json
Parsers/ASimAlertEvent/ARM/ASimAlertEventGoogleThreatIntelligence/ASimAlertEventGoogleThreatIntelligence.json
Parsers/ASimAlertEvent/ARM/ASimAlertEventGoogleThreatIntelligence/README.md
Parsers/ASimAlertEvent/ARM/FullDeploymentAlertEvent.json
Parsers/ASimAlertEvent/ARM/imAlertEvent/imAlertEvent.json
Parsers/ASimAlertEvent/ARM/vimAlertEventGoogleThreatIntelligence/README.md
Parsers/ASimAlertEvent/ARM/vimAlertEventGoogleThreatIntelligence/vimAlertEventGoogleThreatIntelligence.json
Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEvent.md
Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventGoogleThreatIntelligence.md
Parsers/ASimAlertEvent/CHANGELOG/imAlertEvent.md
Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventGoogleThreatIntelligence.md
Parsers/ASimAlertEvent/Parsers/ASimAlertEvent.yaml
Parsers/ASimAlertEvent/Parsers/ASimAlertEventGoogleThreatIntelligence.yaml
Parsers/ASimAlertEvent/Parsers/imAlertEvent.yaml
Parsers/ASimAlertEvent/Parsers/vimAlertEventGoogleThreatIntelligence.yaml
Parsers/ASimAlertEvent/Tests/GoogleThreatIntelligence_ASimAlertEvent_ASimDataTester.csv
Parsers/ASimAlertEvent/Tests/GoogleThreatIntelligence_ASimAlertEvent_ASimSchemaTester.csv
Parsers/ASimAlertEvent/Tests/GoogleThreatIntelligence_vimAlertEvent_ASimDataTester.csv
Parsers/ASimAlertEvent/Tests/GoogleThreatIntelligence_vimAlertEvent_ASimSchemaTester.csv
Sample Data/ASIM/Google_Google Threat Intelligence_AlertEvent_IngestedLogs.csv