The Advanced Security Information Model (ASIM) Network Session normalization schema reference (Public preview)

The Microsoft Sentinel Network Session normalization schema represents an IP network activity, such as network connections and network sessions. Such events are reported, for example, by operating systems, routers, firewalls, and intrusion prevention systems.

The network normalization schema can represent any type of an IP network session but is designed to provide support for common source types, such as Netflow, firewalls, and intrusion prevention systems.

For more information about normalization in Microsoft Sentinel, see Normalization and the Advanced Security Information Model (ASIM).

This article describes version 0.2.x of the network normalization schema. Version 0.1 was released before ASIM was available and doesn't align with ASIM in several places. For more information, see Differences between network normalization schema versions.

Parsers

For more information about ASIM parsers, see the ASIM parsers overview.

Unifying parsers

To use parsers that unify all ASIM out-of-the-box parsers, and ensure that your analysis runs across all the configured sources, use the _Im_NetworkSession filtering parser or the _ASim_NetworkSession parameter-less parser.

You can also use workspace-deployed ImNetworkSession and ASimNetworkSession parsers by deploying them from the Microsoft Sentinel GitHub repository.

For more information, see built-in ASIM parsers and workspace-deployed parsers.

Out-of-the-box, source-specific parsers

For the list of the Network Session parsers Microsoft Sentinel provides out-of-the-box refer to the ASIM parsers list

Add your own normalized parsers

When developing custom parsers for the Network Session information model, name your KQL functions using the following syntax:

• vimNetworkSession<vendor><Product> for parametrized parsers
• ASimNetworkSession<vendor><Product> for regular parsers

Refer to the article Managing ASIM parsers to learn how to add your custom parsers to the network session unifying parsers.

Filtering parser parameters

The Network Session parsers support filtering parameters. While these parameters are optional, they can improve your query performance.

The following filtering parameters are available:

Some parameter can accept both list of values of type dynamic or a single string value. To pass a literal list to parameters that expect a dynamic value, explicitly use a dynamic literal. For example: dynamic(['192.168.','10.'])

For example, to filter only network sessions for a specified list of domain names, use:

let torProxies=dynamic(["tor2web.org", "tor2web.com", "torlink.co"]);
_Im_NetworkSession (hostname_has_any = torProxies)

Normalized content

For a full list of analytics rules that use normalized DNS events, see Network session security content.

Schema overview

The Network Session information model is aligned with the OSSEM Network entity schema.

The Network Session schema serves several types of similar but distinct scenarios, which share the same fields. Those scenarios are identified by the EventType field:

• NetworkSession - a network session reported by an intermediate device monitoring the network, such as a Firewall, a router, or a network tap.
• L2NetworkSession - a network sessions for which only layer 2 information is available. Such events will include MAC addresses but not IP addresses.
• Flow - an aggregated event that reports multiple similar network sessions, typically over a predefined time period, such as Netflow events.
• EndpointNetworkSession - a network session reported by one of the end points of the session, including clients and servers. For such events, the schema supports the remote and local alias fields.
• IDS - a network session reported as suspicious. Such an event will have some of the inspection fields populated, and may have just one IP address field populated, either the source or the destination.

Typically, a query should either select just a subset of those event types, and may need to address separately unique aspects of the use cases. For example, IDS events do not reflect the entire network volume and should not be taken into account in column based analytics.

Network session events use the descriptors Src and Dst to denote the roles of the devices and related users and applications involved in the session. So, for example, the source device hostname and IP address are named SrcHostname and SrcIpAddr. Other ASIM schemas typically use Target instead of Dst.

For events reported by an endpoint and for which the event type is EndpointNetworkSession, the descriptors Local and Remote denote the endpoint itself and the device at the other end of the network session respectively.

The descriptor Dvc is used for the reporting device, which is the local system for sessions reported by an endpoint, and the intermediary device or network tap for other network session events.

Schema details

Common ASIM fields

Common fields with specific guidelines

The following list mentions fields that have specific guidelines for Network Session events:

All common fields

Fields that appear in the table below are common to all ASIM schemas. Any guideline specified above overrides the general guidelines for the field. For example, a field might be optional in general, but mandatory for a specific schema. For more information on each field, refer to the ASIM Common Fields article.

Network session fields

Destination system fields

Destination user fields

Destination application fields

Source system fields

Source user fields

Source application fields

Local and remote aliases

All the source and destination fields listed above, can be optionally aliased by fields with the same name and the descriptors Local and Remote. This is typically helpful for events reported by an endpoint and for which the event type is EndpointNetworkSession.

For such events the descriptors Local and Remote denote the endpoint itself and the device at the other end of the network session respectively. For inbound connections, the local system is the destination, Local fields are aliases to the Dst fields, and 'Remote' fields are aliases to Src fields. Conversely, for outbound connections, the local system is the source, Local fields are aliases to the Src fields, and Remote fields are aliases to Dst fields.

For example, for an inbound event, the field LocalIpAddr is an alias to DstIpAddr and the field RemoteIpAddr is an alias to SrcIpAddr.

Hostname and IP address aliases

Intermediary device and Network Address Translation (NAT) fields

The following fields are useful if the record includes information about an intermediary device, such as a firewall or a proxy, which relays the network session.

Intermediary systems often use address translation and therefore the original address and the address observed externally are not the same. In such cases, the primary address fields such as SrcIPAddr and DstIpAddr represent the addresses observed externally, while the NAT address fields, SrcNatIpAddr and DstNatIpAddr represent the internal address of the original device before translation.

Inspection fields

The following fields are used to represent that inspection which a security device such as a firewall, an IPS, or a web security gateway performed:

Other fields

If the event is reported by one of the endpoints of the network session, it might include information about the process that initiated or terminated the session. In such cases, the ASIM Process Event schema is used to normalize this information.

Schema updates

The following are the changes in version 0.2.1 of the schema:

• Added Src and Dst as aliases to a leading identifier for the source and destination systems.
• Added the fields NetworkConnectionHistory, SrcVlanId, DstVlanId, InnerVlanId, and OuterVlanId.

The following are the changes in version 0.2.2 of the schema:

• Added Remote and Local aliases.
• Added the event type EndpointNetworkSession.
• Defined Hostname and IpAddr as aliases for RemoteHostname and LocalIpAddr respectively when the event type is EndpointNetworkSession.
• Defined DvcInterface as an alias to DvcInboundInterface or DvcOutboundInterface.
• Changed the type of the following fields from Integer to Long: SrcBytes, DstBytes, NetworkBytes, SrcPackets, DstPackets, and NetworkPackets.
• Added the fields NetworkProtocolVersion, SrcSubscriptionId, and DstSubscriptionId.
• Deprecated DstUserDomain and SrcUserDomain.

The following are the changes in version 0.2.3 of the schema:

• Added the ipaddr_has_any_prefix filtering parameter.
• The hostname_has_any filtering parameter now matches either source or destination hostnames.
• Added the fields ASimMatchingHostname and ASimMatchingIpAddr.

The following are the changes in version 0.2.4 of the schema:

• Added the TcpFlags fields.
• Updated NetworkIcpmType and NetworkIcmpCode to reflect the number value for both.
• Added additional inspection fields.
• The field 'ThreatRiskLevelOriginal' was renamed to ThreatOriginalRiskLevel to align with ASIM conventions. Existing Microsoft parsers will maintain ThreatRiskLevelOriginal until May 1st 2023.
• Marked EventResultDetails as recommended, and specified the allowed values.

The following are the changes in version 0.2.5 of the schema:

• Added the fields DstUserScope, SrcUserScope, SrcDvcScopeId, SrcDvcScope, DstDvcScopeId, DstDvcScope, DvcScopeId, and DvcScope.

The following are the changes in version 0.2.6 of the schema:

• Added IDS as an event type

Next steps

For more information, see:

• Watch the ASIM Webinar or review the slides
• Advanced Security Information Model (ASIM) overview
• Advanced Security Information Model (ASIM) schemas
• Advanced Security Information Model (ASIM) parsers
• Advanced Security Information Model (ASIM) content