What Changed
Two new ASIM Authentication parsers have been added for Palo Alto Prisma Cloud Compute:
- ASimAuthenticationPaloAltoPrismaCloud (parameter-less) - v0.1.0
- vimAuthenticationPaloAltoPrismaCloud (filtering) - v0.1.0
Both unifying parsers (ASimAuthentication v0.2.19 and imAuthentication v0.3.16) have been updated to include the new source, making Prisma Cloud Compute login events immediately available to any detection or hunting query that calls imAuthentication.
Sample data (13 records) and ARM deployment templates are included.
Parser Impact
- Schema: ASIM Authentication (v0.1.4)
- Source table: Syslog, filtered to ProcessName == Twistlock-Console with type == management_audit and log_type == login
- Event types covered: successful logins, invalid credentials (No such user or password), and expired-token failures (Session expired)
- Key fields mapped: TargetUsername, SrcIpAddr (IPv4 and IPv6), TargetAppName = Prisma Cloud Compute, LogonMethod (Username and Password vs. Other based on /api/v1/authenticate API path), EventResult, EventResultDetails, EventSeverity
- FQDN resolution: _ASIM_ResolveDvcFQDN called on HostName; DvcHostname, DvcDomain, and DvcFQDN all populated
Before this PR: Queries against imAuthentication or ASimAuthentication returned zero rows for Prisma Cloud Compute login events. Brute-force and credential-stuffing activity against the Prisma Cloud management console was invisible to any ASIM-based detection.
After this PR: All 13 ingested event types are normalized. Existing ASIM-based detections covering failed logon patterns (T1110, T1110.001) and valid-account misuse (T1078) will now surface Prisma Cloud Compute authentication events without rule modification.
MITRE Mapping
| Technique | Description |
|---|---|
| T1078 | Valid Accounts - successful logins to Prisma Cloud management console |
| T1110 | Brute Force |
| T1110.001 | Password Guessing - invalid credentials result mapped to No such user or password |
Affected Files
.github/skills/asim-parser-github-pr-packager/SKILL.md
Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json
Parsers/ASimAuthentication/ARM/ASimAuthenticationPaloAltoPrismaCloud/ASimAuthenticationPaloAltoPrismaCloud.json
Parsers/ASimAuthentication/ARM/ASimAuthenticationPaloAltoPrismaCloud/README.md
Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json
Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json
Parsers/ASimAuthentication/ARM/vimAuthenticationPaloAltoPrismaCloud/README.md
Parsers/ASimAuthentication/ARM/vimAuthenticationPaloAltoPrismaCloud/vimAuthenticationPaloAltoPrismaCloud.json
Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md
Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationPaloAltoPrismaCloud.md
Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md
Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationPaloAltoPrismaCloud.md
Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml
Parsers/ASimAuthentication/Parsers/ASimAuthenticationPaloAltoPrismaCloud.yaml
Parsers/ASimAuthentication/Parsers/imAuthentication.yaml
Parsers/ASimAuthentication/Parsers/vimAuthenticationPaloAltoPrismaCloud.yaml
Sample Data/ASIM/Palo Alto_Prisma Cloud Compute_Authentication_IngestedLogs.csv