"""Log templates module for the SecOps Log Hammer package."""

import json
from typing import Dict, Any, List


# Base log templates for different log types
LOG_TEMPLATES: Dict[str, List[Dict[str, Any]]] = {
    "WINEVTLOG": [
        # Windows Event Log - EventID 4624 (Successful Logon)
        json.loads(r"""
        {"EventTime": 1626772730578, "Hostname": "win-test.cbn.local", "Keywords": -9214364837600034816, "EventType": "AUDIT_SUCCESS", "SeverityValue": 2, "Severity": "INFO", "EventID": 4624, "SourceName": "Microsoft-Windows-Security-Auditing", "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "Version": 2, "Task": 12544, "OpcodeValue": 0, "RecordNumber": 563207, "ProcessID": 700, "ThreadID": 6616, "Channel": "Security", "Message": "An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{logon_guid}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t{source_ip}\r\n\tSource Port:\t\t63359\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0", "Category": "Logon", "Opcode": "Info", "SubjectUserSid": "{target_sid}", "SubjectUserName": "{target_username}", "SubjectDomainName": "{domain_name}", "SubjectLogonId": "{logon_id}", "TargetUserSid": "{target_sid}", "TargetUserName": "{target_username}", "TargetDomainName": "{domain_name}", "TargetLogonId": "{logon_id}", "LogonType": "3", "LogonProcessName": "Kerberos", "AuthenticationPackageName": "Kerberos", "WorkstationName": "-", "LogonGuid": "{logon_guid}", "TransmittedServices": "-", "LmPackageName": "-", "KeyLength": "0", "ProcessName": "-", "IpAddress": "{source_ip}", "IpPort": "63359", "ImpersonationLevel": "%%1833", "RestrictedAdminMode": "-", "TargetOutboundUserName": "-", "TargetOutboundDomainName": "-", "VirtualAccount": "%%1843", "TargetLinkedLogonId": "0x0", "ElevatedToken": "%%1842", "EventReceivedTime":1629193498, "SourceModuleName": "windows_security_eventlog", "SourceModuleType": "im_msvistalog"}
        """),
        
        # Windows Event Log - EventID 4625 (Failed Logon)
        json.loads(r"""
        {"EventTime": 1626772730578, "Hostname": "win-test.cbn.local", "Keywords": -9214364837600034816, "EventType": "AUDIT_FAILURE", "SeverityValue": 2, "Severity": "INFO", "EventID": 4625, "SourceName": "Microsoft-Windows-Security-Auditing", "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "Version": 2, "Task": 12544, "OpcodeValue": 0, "RecordNumber": 563208, "ProcessID": 700, "ThreadID": 6616, "Channel": "Security", "Message": "An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\t-\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{logon_guid}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t{source_ip}\r\n\tSource Port:\t\t63359\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t0xC000006D\r\n\tSub Status:\t\t0xC000006A", "Category": "Logon", "Opcode": "Info", "SubjectUserSid": "{target_sid}", "SubjectUserName": "{target_username}", "SubjectDomainName": "{domain_name}", "SubjectLogonId": "{logon_id}", "TargetUserSid": "{target_sid}", "TargetUserName": "{target_username}", "TargetDomainName": "{domain_name}", "TargetLogonId": "{logon_id}", "LogonType": "3", "LogonProcessName": "Kerberos", "AuthenticationPackageName": "Kerberos", "WorkstationName": "-", "LogonGuid": "{logon_guid}", "TransmittedServices": "-", "LmPackageName": "-", "KeyLength": "0", "ProcessName": "-", "IpAddress": "{source_ip}", "IpPort": "63359", "ImpersonationLevel": "%%1833", "RestrictedAdminMode": "-", "TargetOutboundUserName": "-", "TargetOutboundDomainName": "-", "VirtualAccount": "%%1843", "TargetLinkedLogonId": "0x0", "ElevatedToken": "-", "EventReceivedTime":1629193498, "SourceModuleName": "windows_security_eventlog", "SourceModuleType": "im_msvistalog"}
        """),
        
        # Windows Event Log - EventID 4688 (Process Creation)
        json.loads(r"""
        {"EventTime": 1626772730578, "Hostname": "win-test.cbn.local", "Keywords": -9214364837600034816, "EventType": "AUDIT_SUCCESS", "SeverityValue": 2, "Severity": "INFO", "EventID": 4688, "SourceName": "Microsoft-Windows-Security-Auditing", "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "Version": 2, "Task": 12544, "OpcodeValue": 0, "RecordNumber": 563209, "ProcessID": 700, "ThreadID": 6616, "Channel": "Security", "Message": "A new process has been created.\r\n\r\nCreator Subject:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\r\nTarget Subject:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\r\nProcess Information:\r\n\tNew Process ID:\t\t0x1234\r\n\tNew Process Name:\tC:\\Windows\\System32\\cmd.exe\r\n\tToken Elevation Type:\t%%1936\r\n\tMandatory Label:\t\tS-1-16-8192\r\n\tCreator Process ID:\t0x1234\r\n\tCreator Process Name:\tC:\\Windows\\System32\\cmd.exe\r\n\tProcess Command Line:\t\"C:\\Windows\\System32\\cmd.exe\" /c whoami", "Category": "Process Creation", "Opcode": "Info", "SubjectUserSid": "{target_sid}", "SubjectUserName": "{target_username}", "SubjectDomainName": "{domain_name}", "SubjectLogonId": "{logon_id}", "TargetUserSid": "{target_sid}", "TargetUserName": "{target_username}", "TargetDomainName": "{domain_name}", "TargetLogonId": "{logon_id}", "ProcessId": "0x1234", "ProcessName": "C:\\Windows\\System32\\cmd.exe", "CommandLine": "\"C:\\Windows\\System32\\cmd.exe\" /c whoami", "EventReceivedTime":1629193498, "SourceModuleName": "windows_security_eventlog", "SourceModuleType": "im_msvistalog"}
        """),
        
        # Windows Event Log - EventID 4720 (Account Created)
        json.loads(r"""
        {"EventTime": 1626772730578, "Hostname": "win-test.cbn.local", "Keywords": -9214364837600034816, "EventType": "AUDIT_SUCCESS", "SeverityValue": 2, "Severity": "INFO", "EventID": 4720, "SourceName": "Microsoft-Windows-Security-Auditing", "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "Version": 2, "Task": 12544, "OpcodeValue": 0, "RecordNumber": 563210, "ProcessID": 700, "ThreadID": 6616, "Channel": "Security", "Message": "A user account was created.\r\n\r\nSubject:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\r\nNew Account:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\r\nAttributes:\r\n\tSAM Account Name:\t{target_username}\r\n\tDisplay Name:\t\t{target_username}\r\n\tUser Principal Name:\t{target_username}@{domain_name}\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t513\r\n\tAllowed To Delegate To:\t-\r\n\tOld UAC Value:\t\t0x0\r\n\tNew UAC Value:\t\t0x15\r\n\tUser Account Control:\t\t%%2080\r\n\t\t%%2082\r\n\t\t%%2083\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\tAll\r\n\tAdditional Information:\r\n\t\tPrivileges\t\t-\r\n\t\tSecurity Enabled\t\tYes\r\n\t\tSecurity Disabled\tNo", "Category": "User Account Management", "Opcode": "Info", "SubjectUserSid": "{target_sid}", "SubjectUserName": "{target_username}", "SubjectDomainName": "{domain_name}", "SubjectLogonId": "{logon_id}", "TargetUserSid": "{target_sid}", "TargetUserName": "{target_username}", "TargetDomainName": "{domain_name}", "TargetLogonId": "{logon_id}", "EventReceivedTime":1629193498, "SourceModuleName": "windows_security_eventlog", "SourceModuleType": "im_msvistalog"}
        """),
        
        # Windows Event Log - EventID 4732 (Account Added to Group)
        json.loads(r"""
        {"EventTime": 1626772730578, "Hostname": "win-test.cbn.local", "Keywords": -9214364837600034816, "EventType": "AUDIT_SUCCESS", "SeverityValue": 2, "Severity": "INFO", "EventID": 4732, "SourceName": "Microsoft-Windows-Security-Auditing", "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "Version": 2, "Task": 12544, "OpcodeValue": 0, "RecordNumber": 563211, "ProcessID": 700, "ThreadID": 6616, "Channel": "Security", "Message": "A member was added to a security-enabled global group.\r\n\r\nSubject:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-1234567890-1234567890-1234567890-1103\r\n\tGroup Name:\t\tDomain Admins\r\n\tGroup Domain:\t\t{domain_name}\r\n\r\nMember:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\r\nAdditional Information:\r\n\tPrivileges\t\t-\r\n\tSecurity Enabled\t\tYes\r\n\tSecurity Disabled\tNo", "Category": "Security Group Management", "Opcode": "Info", "SubjectUserSid": "{target_sid}", "SubjectUserName": "{target_username}", "SubjectDomainName": "{domain_name}", "SubjectLogonId": "{logon_id}", "TargetUserSid": "{target_sid}", "TargetUserName": "{target_username}", "TargetDomainName": "{domain_name}", "TargetLogonId": "{logon_id}", "EventReceivedTime":1629193498, "SourceModuleName": "windows_security_eventlog", "SourceModuleType": "im_msvistalog"}
        """),
        
        # Windows Event Log - EventID 5140 (Network Share Access)
        json.loads(r"""
        {"EventTime": 1626772730578, "Hostname": "win-test.cbn.local", "Keywords": -9214364837600034816, "EventType": "AUDIT_SUCCESS", "SeverityValue": 2, "Severity": "INFO", "EventID": 5140, "SourceName": "Microsoft-Windows-Security-Auditing", "ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", "Version": 2, "Task": 12544, "OpcodeValue": 0, "RecordNumber": 563212, "ProcessID": 700, "ThreadID": 6616, "Channel": "Security", "Message": "A network share object was accessed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\t{target_sid}\r\n\tAccount Name:\t\t{target_username}\r\n\tAccount Domain:\t\t{domain_name}\r\n\tLogon ID:\t\t{logon_id}\r\n\r\nNetwork Information:\r\n\tObject Type:\t\tFile\r\n\tSource Address:\t\t{source_ip}\r\n\tSource Port:\t\t63359\r\n\r\nShare Information:\r\n\tShare Name:\t\t\\\\*\\C$\r\n\tShare Path:\t\tC:\\\r\n\r\nAccess Request Information:\r\n\tAccess:\t\tReadData (or ListDirectory)\r\n\tAccess Mask:\t\t0x1\r\n\r\nAdditional Information:\r\n\tRelative Target Name:\tWindows\\System32\\config\\SAM", "Category": "File Share", "Opcode": "Info", "SubjectUserSid": "{target_sid}", "SubjectUserName": "{target_username}", "SubjectDomainName": "{domain_name}", "SubjectLogonId": "{logon_id}", "TargetUserSid": "{target_sid}", "TargetUserName": "{target_username}", "TargetDomainName": "{domain_name}", "TargetLogonId": "{logon_id}", "IpAddress": "{source_ip}", "IpPort": "63359", "EventReceivedTime":1629193498, "SourceModuleName": "windows_security_eventlog", "SourceModuleType": "im_msvistalog"}
        """)
    ],
    
    "OKTA": [
        # Okta - user.session.start event
        json.loads(r"""
        {"actor":{"id":"00uttu7unjNbCqQbh1t6","type":"User","alternateId":"andreww@acme.com","displayName":"Andrew User","detailEntry":null},"authenticationContext":{"authenticationProvider":null,"credentialProvider":null,"credentialType":null,"issuer":null,"interface":null,"authenticationStep":0,"externalSessionId":"102Ft93etECSqii8cJPEGooLw"},"displayMessage":"Evaluation of sign-on policy","eventType":"policy.evaluate_sign_on","outcome":{"result":"CHALLENGE","reason":"Sign-on policy evaluation resulted in CHALLENGE"},"published":"2020-04-19T21:28:40.879Z","securityContext":{"asNumber":null,"asOrg":null,"isp":null,"domain":null,"isProxy":null},"severity":"INFO","debugContext":{"debugData":{"requestId":"XfvriI17-NL8irx3E-KQbgAAByw","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"legacyEventType":null,"transaction":{"type":"WEB","id":"XfvriI17-NL8irx3E-KQbgAAByw","detail":{}},"uuid":"86bed42a-22a6-11ea-b224-5743a575edfd","version":"0","request":{"ipChain":[{"ip":"1.2.3.4","geographicalContext":{"city":"Hawthorn","state":"Victoria","country":"Australia","postalCode":"3122","geolocation":{"lat":-37.8199,"lon":145.0285}},"version":"V4","source":null}]},"target":[{"id":"00p2a89ys10b5RgVF1t7","type":"PolicyEntity","alternateId":"unknown","displayName":"MFA - All","detailEntry":{"policyType":"OktaSignOn"}},{"id":"0pr2a8ajrj0EmqOCW1t7","type":"PolicyRule","alternateId":"00p2a89ys10b5RgVF1t7","displayName":"MFA - All offnet","detailEntry":null}]}
        """),
        
        # Okta - security.threat.detected
        json.loads(r"""
        {"eventType":"security.threat.detected","outcome":{"result":"ALLOW","reason":"Password Spray"},"client":{"ipAddress":"1.2.2.1","id":null,"userAgent":{"browser":"UNKNOWN","os":"Windows","rawUserAgent":"MSFT-WIN-4/10.0.10574"},"zone":"null","device":"Computer","geographicalContext":{"city":null,"geolocation":{"lat":0.0,"lon":0.0},"postalCode":null,"state":null,"country":null}},"uuid":"480e83ce-8304-11ea-b37e-9fada5a657a0","authenticationContext":{"credentialProvider":null,"issuer":null,"authenticationProvider":null,"authenticationStep":0,"externalSessionId":null,"interface":null,"credentialType":null},"displayMessage":"Request from suspicious actor","legacyEventType":"security.threat.detected","transaction":{"type":"WEB","detail":{},"id":"Xp2YgzXhb3kVxVStsXB6fAAABBs"},"request":{"ipChain":[{"ip":"1.2.2.1","version":"V4","source":null,"geographicalContext":{"city":null,"geolocation":{"lat":0.0,"lon":0.0},"postalCode":null,"state":null,"country":null}},{"ip":"40.97.157.117","version":"V4","source":null,"geographicalContext":{"city":"Cheyenne","geolocation":{"lat":41.1399,"lon":-104.8193},"postalCode":"82002","state":"Wyoming","country":"United States"}}]},"debugContext":{"debugData":{"requestId":"Xp2YgzXhb3kVxVStsXB6fAAABBs","requestUri":"/app/office365/exk1jkymj0sdRaX0f1t7/sso/wsfed/active","threatSuspected":"true","url":"/app/office365/exk1jkymj0sdRaX0f1t7/sso/wsfed/active?"}},"version":"0","target":null,"severity":"WARN","actor":{"type":"IP address","alternateId":"unknown","id":"1.2.2.1","displayName":"1.2.2.1","detailEntry":null},"securityContext":{"asOrg":"keff networks stockholm","isProxy":false,"asNumber":41281,"isp":"keff networks ltd","domain":"as41281.net"},"published":"2020-04-20T12:45:16.134Z"}
        """),
        
        # Okta - user.authentication.sso
        json.loads(r"""
        {"actor":{"alternateId":"user@example.com","detailEntry":null,"displayName":"Example User","id":"00u1mygkhxcrIV73z0h8","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102rZE-CdjTQ8OMVfytcatuTA","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"San Francisco","country":"United States","geolocation":{"lat":37.7506,"lon":-122.4121},"postalCode":"94110","state":"California"},"id":null,"ipAddress":"172.4.91.32","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0"},"zone":"null"},"debugContext":{"debugData":{"audience":"example","authTime":"2021-08-15T15:52:42.131Z","authenticationClassRef":"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport","dtHash":"aae683f21519c20fb21ff1e99072fd18c90d25b9c6d5fbf3419feb6f27ea2c18","initiationType":"SP_INITIATED","requestId":"YtGUjDW2UE5s5BJnbSCu5wAACGE","threatSuspected":"false"}},"displayMessage":"User single sign on to app","eventType":"user.authentication.sso","legacyEventType":"app.auth.sso","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-04-19T21:07:10.282Z","request":{"ipChain":[{"geographicalContext":{"city":"San Francisco","country":"United States","geolocation":{"lat":37.7506,"lon":-122.4121},"postalCode":"94110","state":"California"},"ip":"172.4.91.32","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":[{"alternateId":"App","detailEntry":{"signOnModeType":"SAML_2_0"},"displayName":"Example Application","id":"0oa1ijf8z4kzVrRBb0h8","type":"AppInstance"},{"alternateId":"user","detailEntry":null,"displayName":"Example User","id":"0ua1mzpwycbrtJrZJ0h8","type":"AppUser"}],"transaction":{"detail":{},"id":"YtGUjDW2UE5s5BJnbSCu5wAACGE","type":"WEB"},"uuid":"7cc5f8b0-045a-11ed-85b0-1bf5db802391","version":"0"}
        """),
        
        # Okta - user.account.privilege.grant
        json.loads(r"""
        {"actor":{"alternateId":"name_usr@abc.com","detailEntry":null,"displayName":"Raul Zayat","id":"00u13sjju468gSAL1357","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102DmV95R48T5KOiEJ4LveYdg","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Hadera","country":"Israel","geolocation":{"lat":32.4334,"lon":34.9267},"postalCode":null,"state":"Haifa"},"id":null,"ipAddress":"11.22.33.44","userAgent":{"browser":"CHROME","os":"Windows 10","rawUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36"},"zone":"null"},"debugContext":{"debugData":{"privilegeGranted":"Read only admin","requestId":"YWaKHI4j8habVRrtXV5o2wAADKY","requestUri":"/api/internal/administrators","url":"/api/internal/administrators?"}},"device":null,"displayMessage":"Grant user privilege","eventType":"user.account.privilege.grant","legacyEventType":"core.user.admin_privilege.granted","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-08-13T07:26:20.356Z","request":{"ipChain":[{"geographicalContext":{"city":"Hadera","country":"Israel","geolocation":{"lat":32.4334,"lon":34.9267},"postalCode":null,"state":"Haifa"},"ip":"11.22.33.44","source":null,"version":"V4"}]},"securityContext":{"asNumber":12400,"asOrg":"smile internet gold","domain":"inter.net.il","isProxy":false,"isp":"partner communications ltd."},"severity":"INFO","target":[{"alternateId":"user@abc.com","detailEntry":null,"displayName":"Hen Korman","id":"00ucle6lbfgynfWgP357","type":"User"}],"transaction":{"detail":{},"id":"YWaKHI4j8habVRrtXV5o2wAADKY","type":"WEB"},"uuid":"dc89091b-2bf6-11ec-bdc0-25058da0d6c1","version":"0"}
        """),
        
        # Okta - group.user_membership.remove
        json.loads(r"""
        {"actor":{"alternateId":"unknown","detailEntry":null,"displayName":"oktaGroupOrMemberSync","id":"0oakd21gn0veIuDxr696","type":"PublicClientAppEntity"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"trsmcUjmNk3TvCwk9-psMjZZQ","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Chicago","country":"United States","geolocation":{"lat":41.8882,"lon":-87.6164},"postalCode":"60601","state":"Illinois"},"id":null,"ipAddress":"1.1.1.6","userAgent":{"browser":"UNKNOWN","os":"Linux","rawUserAgent":"okta-sdk-java/8.1.0 java/11.0.16 Linux/3.10.0-1160.71.1.el7.x86_64"},"zone":"null"},"debugContext":{"debugData":{"requestId":"YyL1AKw4fIG7Y5f0A3TKSgAADOc","requestUri":"/api/v1/groups/00g1ubj3liF8lRuqv697/users/00u1agww44LB9e4yU697","url":"/api/v1/groups/00g1ubj3liF8lRuqv697/users/00u1agww44LB9e4yU697?"}},"device":null,"displayMessage":"Remove user from group membership","eventType":"group.user_membership.remove","legacyEventType":"core.user_group_member.user_remove","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-08-15T09:48:48.559Z","request":{"ipChain":[{"geographicalContext":{"city":"Chicago","country":"United States","geolocation":{"lat":41.8882,"lon":-87.6164},"postalCode":"60601","state":"Illinois"},"ip":"1.1.1.66","source":null,"version":"V4"}]},"securityContext":{"asNumber":160,"asOrg":"university of chicago","domain":"uchicago.edu","isProxy":false,"isp":"university of chicago"},"severity":"INFO","target":[{"alternateId":"abc@uchicago.edu","detailEntry":null,"displayName":"Rebecca Spasari","id":"00u1agww44LB9e4yU697","type":"User"},{"alternateId":"unknown","detailEntry":null,"displayName":"Application Access:UCM:ICIMS:authorized","id":"00g1ubj3liF8lRuqv697","type":"UserGroup"}],"transaction":{"detail":{"requestApiTokenId":"AT.T_9a-21apCEvnXNhQniEMIV-S-RUDkVrQG-YESlrzb8"},"id":"YyL1AKw4fIG7Y5f0A3TKSgAADOc","type":"WEB"},"uuid":"98df0c8c-34db-11ed-a553-a1f3f71364e6","version":"0"}
        """),
        # Okta - user.account.report_suspicious_activity_by_enduser
        json.loads(r"""
        {"actor":{"alternateId":"abc@domain.com","detailEntry":null,"displayName":"Einat Refaeli","id":"00ue22xdfnPoyK9YG357","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"trsKZOtnRZXQL2HG4wPfIouIw","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Tel Aviv","country":"Israel","geolocation":{"lat":32.0668,"lon":34.7649},"postalCode":null,"state":"Tel Aviv"},"id":null,"ipAddress":"4.22.33.1","userAgent":{"browser":"CHROME","os":"Windows 10","rawUserAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36"},"zone":"null"},"debugContext":{"debugData":{"requestId":"YiRaHLfTl9KtpDpLBlokSgAAB08","requestUri":"/api/internal/users/me/report-suspicious-activity","suspiciousActivityBrowser":"CHROME","suspiciousActivityEventCity":"Tel Aviv","suspiciousActivityEventCountry":"Israel","suspiciousActivityEventId":"b726cf88-9d19-11ec-a1e8-ed4de7000be6","suspiciousActivityEventIp":"4.22.33.1","suspiciousActivityEventLatitude":"32.0668","suspiciousActivityEventLongitude":"34.7649","suspiciousActivityEventState":"Tel Aviv","suspiciousActivityEventTransactionId":"YiRZthniFuAly3FkZ8poBQAADkU","suspiciousActivityEventType":"user.account.update_password","suspiciousActivityOs":"Windows 10","suspiciousActivityTimestamp":"2022-03-06T06:50:31.416Z","url":"/api/internal/users/me/report-suspicious-activity?i=eyJ6aXAiOiJERUYiLCJ2ZXIiOiIxIiwiZW5jIjoiQTI1NkdDTSIsImFsZyI6ImRpciJ9..399BbRns-ZFJjhgv.POeC_lkLKxwtoV5QVsnc0btkAbvxOaDqn8sLWrQWERcywZckacV0kR9rdl9OJb5awRfwc0iJMLC_O75UUrA2l6RLmaMir_ojY1hzTDWdTXGU-0pv4DbwLK02FA8bNooNiGuaTwyQVths9Ivh7Kz0cUOEtBwTNvOSNt-MbRXfVIjXvixzYXmfGowUqVMVYlblx0IJE-2mQusvaHdoSm0.ltKbGcLJnLAzMQJiM8nytA"}},"device":null,"displayMessage":"User report suspicious activity","eventType":"user.account.report_suspicious_activity_by_enduser","legacyEventType":"core.user.account.report_suspicious_activity_by_enduser","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-08-06T06:52:13.002Z","request":{"ipChain":[{"geographicalContext":{"city":"Tel Aviv","country":"Israel","geolocation":{"lat":32.0668,"lon":34.7649},"postalCode":null,"state":"Tel Aviv"},"ip":"4.22.33.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":12400,"asOrg":"smile internet gold","domain":"inter.net.il","isProxy":false,"isp":"partner communications ltd."},"severity":"WARN","target":[{"alternateId":"abc@domain.com","detailEntry":null,"displayName":"Einat Refaeli","id":"00ue22xdfnPoyK9YG357","type":"User"}],"transaction":{"detail":{},"id":"YiRaHLfTl9KtpDpLBlokSgAAB08","type":"WEB"},"uuid":"f3b39b17-9d19-11ec-9dc2-4f9461e0c95f","version":"0"}
        """)
    ],
    
    "AZURE_AD": [
        # Azure AD - Sign-in activity (Blocked by Conditional Access)
        json.loads(r"""
        {"time":"2019-09-18T06:52:51.6025883Z","resourceId":"/tenants/fabb61b8-3afe-4e75-b934-a47f782b8cd7/providers/Microsoft.aadiam","operationName":"Sign-in activity","operationVersion":"1.0","category":"SignInLogs","tenantId":"fabb61b8-3afe-4e75-b934-a47f782b8cd7","resultType":"53003","resultSignature":"None","resultDescription":"Access has been blocked due to conditional access policies.","durationMs":0,"callerIpAddress":"1.2.3.4","correlationId":"b805794a-52c1-4401-905c-c20dade8403e","identity":"D***, J****","Level":4,"location":"US","properties":{"id":"2148342a-46f0-4dda-b33c-2af6f4cc1a00","createdDateTime":"2019-09-18T06:52:51.6025883+00:00","userDisplayName":"D***, J****","userPrincipalName":"j****@acme.com","userId":"c952360e-b09a-4331-9351-5b4e4d07ca18","appId":"00000002-0000-0ff1-ce00-000000000000","appDisplayName":"Office 365 Exchange Online","ipAddress":"1.2.3.4","status":{"errorCode":53003,"failureReason":"Access has been blocked due to conditional access policies."},"clientAppUsed":"Other clients; Older Office clients","deviceDetail":{"deviceId":"","operatingSystem":"Windows 7","browser":"Microsoft Office 14.0"},"location":{"city":"Lynn Haven","state":"Florida","countryOrRegion":"US","geoCoordinates":{"latitude":30.22658920288086,"longitude":-85.63883972167969}},"correlationId":"b805794a-52c1-4401-905c-c20dade8403e","conditionalAccessStatus":"failure","appliedConditionalAccessPolicies":[{"id":"c04708c3-25ec-4282-aaca-8739084d87e0","displayName":"Production-06.14.2018-Block Basic Auth from External for EXO","enforcedGrantControls":["Block"],"enforcedSessionControls":[],"result":"failure"}],"originalRequestId":"2148342a-46f0-4dda-b33c-2af6f4cc1a00","isInteractive":false,"tokenIssuerName":"","tokenIssuerType":"AzureAD","authenticationProcessingDetails":[],"networkLocationDetails":[],"processingTimeInMilliseconds":242,"riskDetail":"none","riskLevelAggregated":"none","riskLevelDuringSignIn":"medium","riskState":"none","riskEventTypes":[],"authenticationDetails":[],"authenticationRequirementPolicies":[]},"am_tenantId":"FABB61B8-3AFE-4E75-B934-A47F782B8CD7","am_category":"SIGNINLOGS"}
        """),
        
        # Azure AD - Successful ADFederationServices Sign-in
        json.loads(r"""
        {"time":"2019-09-17T11:44:13Z","resourceId":"/tenants/fabb61b8-3afe-4e75-b934-a47f782b8cd7/providers/Microsoft.aadiam","operationName":"Sign-in activity","operationVersion":"1.0","category":"SignInLogs","tenantId":"fabb61b8-3afe-4e75-b934-a47f782b8cd7","resultType":"0","resultSignature":"None","durationMs":0,"callerIpAddress":"1.2.3.19","correlationId":"00000000-0000-0000-3c23-0080020000ff","identity":"D***, Kyle","Level":4,"location":"US","properties":{"id":"56e17a09-e4a4-4633-8ad6-594e2e702c2d","createdDateTime":"2019-09-17T11:44:13+00:00","userDisplayName":"D***, Kyle","userPrincipalName":"D***k12@acme.com","userId":"b159cba7-aa2e-4609-8da5-3b8ca459986e","appId":null,"appDisplayName":"urn:federation:MicrosoftOnline","ipAddress":"1.2.3.19","status":{"errorCode":0},"deviceDetail":{"deviceId":""},"location":{"city":"Middletown","state":"Connecticut","countryOrRegion":"US","geoCoordinates":{"latitude":41.54951858520508,"longitude":-72.6518325805664}},"correlationId":"00000000-0000-0000-3c23-0080020000ff","appliedConditionalAccessPolicies":[],"originalRequestId":"56e17a09-e4a4-4633-8ad6-594e2e702c2d","isInteractive":true,"tokenIssuerName":"adfs.acme.com","tokenIssuerType":"ADFederationServices","authenticationProcessingDetails":[{"key":"ServerName","value":"MIDP-ADFS3-001"},{"key":"Authentication Protocol","value":"WSTrust"},{"key":"IPAddresses Involved in Auth Flow","value":"1.2.3.19, 4.5.6.7,5.6.7.8"}],"networkLocationDetails":[{"networkType":"extranet"}],"processingTimeInMilliseconds":0,"riskDetail":"none","riskLevelAggregated":"none","riskLevelDuringSignIn":"none","riskState":"none","riskEventTypes":[],"resourceDisplayName":"urn:federation:MicrosoftOnline","authenticationDetails":[{"authenticationStepDateTime":"2019-09-17T11:44:13+00:00","authenticationMethod":"None, Multifactor","authenticationMethodDetail":"","succeeded":true,"authenticationStepRequirement":"Primary Authentication"}],"authenticationRequirementPolicies":[],"alternateSignInName":"a1234@acme.com"},"am_tenantId":"FABB61B8-3AFE-4E75-B934-A47F782B8CD7","am_category":"SIGNINLOGS"}
        """),

        # Azure AD - Add Member to Group (AuditLog)
        json.loads(r"""
        {"time":"2019-09-18T05:28:27.1875672Z","resourceId":"/tenants/fabb61b8-3afe-4e75-b934-a47f782b8cd7/providers/Microsoft.aadiam","operationName":"Add member to group","operationVersion":"1.0","category":"AuditLogs","tenantId":"fabb61b8-3afe-4e75-b934-a47f782b8cd7","resultSignature":"None","durationMs":0,"correlationId":"3558f3f3-c6d9-4072-90a5-7bf2481bd2a8","identity":"Microsoft Teams Services","level":"Informational","properties":{"id":"Directory_UNQQY_97307514","category":"GroupManagement","correlationId":"3558f3f3-c6d9-4072-90a5-7bf2481bd2a8","result":"success","resultReason":"","activityDisplayName":"Add member to group","activityDateTime":"2019-09-18T05:28:27.1875672+00:00","loggedByService":"Core Directory","operationType":"Assign","initiatedBy":{"user":{"id":"S-1-2-12277-13818","displayName":"Microsoft Teams Services","userPrincipalName":"s*****123@acme.com","ipAddress":null}},"targetResources":[{"id":"3528b99a-5795-48f2-9db7-4c16cde98ced","displayName":null,"type":"User","userPrincipalName":"D***123@acme.com","modifiedProperties":[{"displayName":"Group.ObjectID","oldValue":null,"newValue":"\\\"3e853e2d-cd3c-47cc-b12b-dd6b4da782d8\\\""},{"displayName":"Group.DisplayName","oldValue":null,"newValue":"\\\"GPS Train 4 Architects\\\""},{"displayName":"Group.WellKnownObjectName","oldValue":null,"newValue":null}]}]},"am_tenantId":"FABB61B8-3AFE-4E75-B934-A47F782B8CD7","am_category":"AUDITLOGS"}
        """),

        # Azure AD - Account Locked (Failed Login)
        json.loads(r"""
        {"appDisplayName":"Office 365 Exchange Online","appId":"00000002-0000-0ff1-ce00-000000000000","appliedConditionalAccessPolicies":[],"clientAppUsed":"Other clients; IMAP","conditionalAccessStatus":"notApplied","correlationId":"c15cbd00-8150-4b27-a940-4b79d07059c4","createdDateTime":"2019-12-18T20:25:57.1371239Z","deviceDetail":{"browser":null,"deviceId":"","displayName":null,"isCompliant":null,"isManaged":null,"operatingSystem":null,"trustType":null},"id":"cb20f882-5970-4b0f-917b-1727064b0000","ipAddress":"31.0.66.4","isInteractive":false,"location":{"city":"Warszawa","countryOrRegion":"PL","geoCoordinates":{"altitude":null,"latitude":52.2317008972168,"longitude":21.018339157104492},"state":"Mazowieckie"},"resourceDisplayName":null,"resourceId":null,"riskDetail":"none","riskEventTypes":[],"riskLevelAggregated":"none","riskLevelDuringSignIn":"none","riskState":"none","status":{"additionalDetails":null,"errorCode":50053,"failureReason":"Account is locked because user tried to sign in too many times with an incorrect user ID or password."},"userDisplayName":"D***, J****","userId":"S-1-2-5542-26854","userPrincipalName":"jd250550@acme.com"}
        """),

        # Azure AD - Failed Auth with Compliant Mobile Device
        json.loads(r"""
        {"appDisplayName":"Office 365 Exchange Online","appId":"00000002-0000-0ff1-ce00-000000000000","appliedConditionalAccessPolicies":[],"clientAppUsed":"Exchange ActiveSync (supported)","conditionalAccessStatus":"notApplied","correlationId":"dc721108-d654-4125-8613-c4acab588f29","createdDateTime":"2019-12-18T20:25:30.7431373Z","deviceDetail":{"browser":null,"deviceId":"9612e4a1-6b28-4d21-9959-50fe8ae12ea7","displayName":"as250714_Android_10/16/2019_7:18 AM","isCompliant":true,"isManaged":true,"operatingSystem":"Android","trustType":"Azure AD registered"},"id":"cb20f882-5970-4b0f-917b-1727984a0000","ipAddress":"90.202.195.82","isInteractive":false,"location":{"city":"Edinburgh","countryOrRegion":"GB","geoCoordinates":{"altitude":null,"latitude":55.946388244628906,"longitude":-3.200000047683716},"state":"Edinburgh"},"resourceDisplayName":"Office 365 Exchange Online","resourceId":"00000002-0000-0ff1-ce00-000000000000","riskDetail":"none","riskEventTypes":[],"riskLevelAggregated":"none","riskLevelDuringSignIn":"none","riskState":"none","status":{"additionalDetails":null,"errorCode":50126,"failureReason":"Invalid username or password or Invalid on-premise username or password."},"userDisplayName":"D***, A*******","userId":"S-1-2-1096-6007","userPrincipalName":"ad250714@acme.com"}
        """),

        # Azure AD - Failed Flow Token Expired
        json.loads(r"""
        {"appDisplayName":"Microsoft Office","appId":"d3590ed6-52b3-4102-aeff-aad2292ab01c","appliedConditionalAccessPolicies":[],"clientAppUsed":"Mobile Apps and Desktop clients","conditionalAccessStatus":"notApplied","correlationId":"ffb262c7-6191-4b8d-ae46-154a2710bdcf","createdDateTime":"2019-12-18T13:51:40.9990924Z","deviceDetail":{"browser":"Edge 18.1776","deviceId":"db533c1e-8472-478b-b6c0-7b02a1146bf5","displayName":"DAMIEN-NEWPC","isCompliant":null,"isManaged":null,"operatingSystem":"Windows 10","trustType":"Azure AD registered"},"id":"d1f53d8d-785d-46e2-8aec-24509ea20100","ipAddress":"205.237.248.44","isInteractive":true,"location":{"city":"Cap-Aux-Meules","countryOrRegion":"CA","geoCoordinates":{"altitude":null,"latitude":47.383968353271484,"longitude":-61.85877990722656},"state":"Quebec"},"resourceDisplayName":"Office 365 Exchange Online","resourceId":"00000002-0000-0ff1-ce00-000000000000","riskDetail":"none","riskEventTypes":[],"riskLevelAggregated":"none","riskLevelDuringSignIn":"none","riskState":"none","status":{"additionalDetails":null,"errorCode":50089,"failureReason":"Flow token expired - Authentication Failed. Have user try signing-in again with username -password."},"userDisplayName":"D***, Damien","userId":"S-1-2-22711-4510","userPrincipalName":"dd250258@acme.com"}
        """),

        # Azure AD - iOS Authentication with trusted device
        json.loads(r"""
        {"time":"2025-03-10T11:29:21.7306656Z","resourceId":"/tenants/a25fff9c-3f63-4fb2-9a8a-d9bdd0321f9a/providers/Microsoft.aadiam","operationName":"Sign-in activity","operationVersion":"1.0","category":"SignInLogs","tenantId":"a25fff9c-3f63-4fb2-9a8a-d9bdd0321f9a","resultType":"0","resultSignature":"None","durationMs":0,"callerIpAddress":"2607:fb90:3e93:4e27:e4a2:e3db:6828:1d59","correlationId":"8cb1cee1-ae57-4983-a286-c5cdce6ef42c","identity":"Tater, Maiya A.","Level":4,"location":"US","properties":{"id":"73969e70-e255-442e-b1d7-f17eb2360000","createdDateTime":"2025-03-10T11:27:42.5592924+00:00","userDisplayName":"Tater, Maiya A.","userPrincipalName":"abc@abc.com","userId":"11dbb8f4-1e0f-4da0-a61d-cf1ed433634c","appId":"29d9ed98-a469-4536-ade2-f981bc1d605e","appDisplayName":"Microsoft Authentication Broker","ipAddress":"2607:fb90:3e93:4e27:e4a2:e3db:6828:1d59","status":{"errorCode":0},"clientAppUsed":"Mobile Apps and Desktop clients","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","deviceDetail":{"deviceId":"427b54a9-0d34-4585-abad-c9cacaa00f53","displayName":"R5511166","operatingSystem":"Ios 18.2.0","browser":"Chrome 133.0.0","isCompliant":true,"isManaged":true,"trustType":"Azure AD joined"},"location":{"city":"Jacksonville","state":"Florida","countryOrRegion":"US","geoCoordinates":{"latitude":30.314599990844727,"longitude":-81.681602478027344}},"correlationId":"8cb1cee1-ae57-4983-a286-c5cdce6ef42c","conditionalAccessStatus":"notApplied","appliedConditionalAccessPolicies":[],"authenticationContextClassReferences":[],"originalRequestId":"73969e70-e255-442e-b1d7-f17eb2360000","isInteractive":true,"tokenIssuerName":"","tokenIssuerType":"AzureAD","authenticationProcessingDetails":[{"key":"Legacy TLS (TLS 1.0, 1.1, 3DES)","value":"False"},{"key":"Is CAE Token","value":"False"}],"networkLocationDetails":[{"networkType":"namedNetwork","networkNames":["Mayo Regional Access United States"]}],"clientCredentialType":"none","processingTimeInMilliseconds":2024,"riskDetail":"none","riskLevelAggregated":"none","riskLevelDuringSignIn":"none","riskState":"none","riskEventTypes":[],"riskEventTypes_v2":[],"resourceId":"90a2e5d2-fd7a-4a2e-bc90-3dc50ae8e3ee","resourceTenantId":"a25fff9c-3f63-4fb2-9a8a-d9bdd0321f9a","homeTenantId":"a25fff9c-3f63-4fb2-9a8a-d9bdd0321f9a","tenantId":"a25fff9c-3f63-4fb2-9a8a-d9bdd0321f9a","authenticationDetails":[],"authenticationRequirementPolicies":[],"sessionLifetimePolicies":[],"authenticationRequirement":"singleFactorAuthentication","alternateSignInName":"abc@abc.com","signInIdentifier":"abc@abc.com","servicePrincipalId":"","userType":"Member","flaggedForReview":false,"isTenantRestricted":false,"autonomousSystemNumber":21928,"crossTenantAccessType":"none","privateLinkDetails":{},"ssoExtensionVersion":"","uniqueTokenIdentifier":"cJ6Wc1XiLkSx1_F-sjYAAA","authenticationStrengths":[],"incomingTokenType":"primaryRefreshToken","authenticationProtocol":"deviceCode","appServicePrincipalId":null,"resourceServicePrincipalId":"8b76350e-1ba9-4d5d-b220-6ad45de14e96","rngcStatus":0,"signInTokenProtectionStatus":"none","tokenProtectionStatusDetails":{"signInSessionStatus":"unbound","signInSessionStatusCode":1007},"originalTransferMethod":"none","isThroughGlobalSecureAccess":false,"sessionId":"4ccb7441-1fee-4a66-be32-56c8b45425cd","resourceOwnerTenantId":"00000000-0000-0000-0000-000000000000"}}
        """),

        # Azure AD - Service Principal Sign-in
        json.loads(r"""
        {"time":"2025-03-31T15:31:42.4380358Z","resourceId":"/tenants/1640f4ce-86c6-44f2-a477-06bd39617e97/providers/Microsoft.aadiam","operationName":"Sign-in activity","operationVersion":"1.0","category":"ServicePrincipalSignInLogs","tenantId":"1640f4ce-86c6-44f2-a477-06bd39617e97","resultType":"0","resultSignature":"SUCCESS","durationMs":0,"callerIpAddress":"1.1.1.1","correlationId":"ae6f414c-a217-47dd-9523-44accf7e520f","Level":4,"location":"US","properties":{"id":"f965f75e-7003-4a53-86a2-4eb483630600","createdDateTime":"2025-03-31T15:30:38.7174136+00:00","userId":null,"appId":"2204bee2-9f9c-458d-8862-15f8ec54aed7","ipAddress":"1.1.1.1","status":{"errorCode":0},"location":{"city":"Chicago","state":"Illinois","countryOrRegion":"US","geoCoordinates":{"latitude":41.848850250244141,"longitude":-87.671249389648438}},"correlationId":"ae6f414c-a217-47dd-9523-44accf7e520f","conditionalAccessStatus":"notApplied","appliedConditionalAccessPolicies":[],"isInteractive":false,"tokenIssuerType":"AzureAD","servicePrincipalName":"abc","servicePrincipalId":"3ecaf2ff-95c9-40ec-928e-e25751826044"}}
        """)
    ],
    
    "GCP_CLOUDAUDIT": [
        # GCP Cloud Audit Logs - IAM Credentials Generate Access Token
        json.loads(r"""
        {"insertId":"u0mlpdesys","logName":"projects/{project_id}/logs/cloudaudit.googleapis.com%2Fdata_access","operation":{"first":true,"id":"10468459370229865006","last":true,"producer":"iamcredentials.googleapis.com"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"test0.joonix.net","principalSubject":"user:test@test.joonix.net"},"authorizationInfo":[{"authorizationLoggingOptions":{"permissionType":"ADMIN_READ"},"granted":true,"permission":"iam.serviceAccounts.getAccessToken","resourceAttributes":{}}],"metadata":{"identityDelegationChain":["projects/-/serviceAccounts/user-test-impersonation@{project_id}.iam.gserviceaccount.com"]},"methodName":"GenerateAccessToken","request":{"@type":"type.googleapis.com/google.iam.credentials.v1.GenerateAccessTokenRequest","name":"projects/-/serviceAccounts/user-test-impersonation@{project_id}.iam.gserviceaccount.com"},"requestMetadata":{"callerIp":"34.173.221.188","callerSuppliedUserAgent":"google-cloud-sdk gcloud/392.0.0 command/gcloud.sql.instances.create invocation-id/a56be32ce8fb4e64bee10d7502542c59 environment/devshell environment-version/None interactive/True from-script/False python/3.9.2 term/screen (Linux 5.10.109+),gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2022-07-22T17:14:10.792366327Z"}},"resourceName":"projects/-/serviceAccounts/110649196922301550006","serviceName":"iamcredentials.googleapis.com","status":{}},"receiveTimestamp":"2022-07-22T17:14:11.386667307Z","resource":{"labels":{"email_id":"test-test-impersonation@{project_id}.iam.gserviceaccount.com","project_id":"{project_id}","unique_id":"110649196922301550006"},"type":"service_account"},"severity":"INFO","timestamp":"2022-07-22T17:14:10.782211853Z"}
        """),

        # GCP DNS Query Log (Note: different logName format)
        json.loads(r"""
        {"insertId": "ivbhu6ejtogb","jsonPayload": {"authAnswer": true,"protocol": "UDP","queryName": "domains.google.com.","queryType": "A","rdata": "domains.google.com.t299tINtat1.2.3.100ndomains.google.com.t299tINtat1.2.3.101ndomains.google.com.t299tINtat1.2.3.138ndomains.google.com.t299tINtat1.2.3.139ndomains.google.com.t299tINtat1.2.3.113ndomains.google.com.t299tINtat172.21...","responseCode": "NOERROR","sourceIP": "190.0.3.21","sourceNetwork": "","vmInstanceId": 8.0718425376535921e+18,"vmInstanceName": "615901203133.ext-cef1"},"logName": "projects/{project_id}/logs/dns.googleapis.com%2Fdns_queries","receiveTimestamp": "2022-10-25T04:00:02.788690195Z","resource": {"labels": {"location": "us-central1","project_id": "{project_id}","source_type": "gce-vm","target_name": "","target_type": "external"},"type": "dns_query"},"severity": "INFO","timestamp": "2022-10-25T04:00:01.889825941Z"}
        """),

        # GCP Cloud Audit Logs - Access Context Manager Create Access Level
        json.loads(r"""
        {"protoPayload": {"@type": "type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo": {"principalEmail": "admin@.ongcp.co"},"requestMetadata": {"callerIp": "190.2.3.128","callerSuppliedUserAgent": "Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/83.0.4103.44Safari/537.36Edg/83.0.478.28,gzip(gfe),gzip(gfe)","requestAttributes": {"time": "2022-10-16T17:14:00.638Z","auth": {}},"destinationAttributes": {}},"serviceName": "accesscontextmanager.googleapis.com","methodName": "google.identity.accesscontextmanager.v1.AccessContextManager.CreateAccessLevel","authorizationInfo": [{"resource": "accessPolicies/462156456446","permission": "accesscontextmanager.accessLevels.create","granted": true,"resourceAttributes": {}}],"resourceName": "accessPolicies/462156456446","request": {"accessLevel": {"title": "allowed_ips","basic": {"combiningFunction": "AND","conditions": [{"negate": false,"ipSubnetworks": ["190.2.3.128/32"]}]},"name": "accessPolicies/462156456446/accessLevels/allowed_ips"},"parent": "accessPolicies/462156456446","@type": "type.googleapis.com/google.identity.accesscontextmanager.v1.CreateAccessLevelRequest"},"metadata": {"userId": "106203048393089121897","idaasCustomerId": "C01wrq7q2"}},"insertId": "13ows56brw","resource": {"type": "audited_resource","labels": {"method": "google.identity.accesscontextmanager.v1.AccessContextManager.CreateAccessLevel","service": "accesscontextmanager.googleapis.com"}},"timestamp": "2022-10-16T17:13:57.638Z","severity": "NOTICE","logName": "organizations/177777777777/logs/cloudaudit.googleapis.com%2Factivity","operation": {"id": "operations/accessPolicies/462156456446/accessLevels/allowed_ips/create/1589649240436385","producer": "accesscontextmanager.googleapis.com","first": true,"last": true},"receiveTimestamp": "2022-10-16T17:14:01.474022840Z"}
        """),

        # GCP Cloud Audit Logs - GKE Cluster Create Error
        json.loads(r"""
        {"protoPayload": {"@type": "type.googleapis.com/google.cloud.audit.AuditLog","status": {"code": 3,"message": "Internal error."},"authenticationInfo": {"principalEmail": "demo.admin@gmail.com"},"requestMetadata": {"callerIp": "163.116.205.119","callerSuppliedUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36,gzip(gfe),gzip(gfe)","requestAttributes": {"time": "2022-10-07T12:24:00.374978528Z","auth": {}},"destinationAttributes": {}},"serviceName": "container.googleapis.com","methodName": "google.container.v1beta1.ClusterManager.CreateCluster","authorizationInfo": [{"permission": "container.clusters.create","granted": true,"resourceAttributes": {}}],"resourceName": "projects/{project_id}/zones/us-central1-a/clusters/cluster-1","request": {"parent": "projects/{project_id}/locations/us-central1-a","@type": "type.googleapis.com/google.container.v1alpha1.CreateClusterRequest","cluster": {"releaseChannel": {"channel": "STABLE"},"nodePools": [{"management": {"autoUpgrade": true,"autoRepair": true},"config": {"imageType": "COS_CONTAINERD","machineType": "custom-1-3840","oauthScopes": ["https://www.googleapis.com/auth/compute","https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append"],"diskSizeGb": 100},"name": "default-pool","autoscaling": {"minNodeCount": 1,"enabled": true,"maxNodeCount": 5},"initialNodeCount": 3}],"name": "cluster-1","addonsConfig": {"httpLoadBalancing": {},"networkPolicyConfig": {"disabled": true}},"subnetwork": "default","masterAuthorizedNetworksConfig": {},"network": "default"}},"response": {"@type": "type.googleapis.com/google.container.v1alpha1.Operation"},"resourceLocation": {"currentLocations": ["us-central1-a"]},"policyViolationInfo": {"orgPolicyViolationInfo": {}}},"insertId": "usr7uxdfxjs","resource": {"type": "gke_cluster","labels": {"project_id": "{project_id}","cluster_name": "cluster-1","location": "us-central1-a"}},"timestamp": "2022-10-07T12:24:02.993753236Z","severity": "ERROR","logName": "projects/{project_id}/logs/cloudaudit.googleapis.com%2Factivity","receiveTimestamp": "2022-10-07T12:24:03.956822192Z"}
        """),

        # GCP Cloud Audit Logs - BigQuery Table Insert Error (Already Exists)
        json.loads(r"""
        {"protoPayload": {"@type": "type.googleapis.com/google.cloud.audit.AuditLog","status": {"code": 7,"message": "VPC Service Controls: Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: ZlM-84GesuDC7Ph1qWKXtK1To2aXsnl8kqJnDtfZ5oHzsYBhzGUnHA."},"authenticationInfo": {"principalEmail": "app-jenkins-org-deploy@cmegroup-project-admin.iam.gserviceaccount.com"},"requestMetadata": {"callerIp": "127.0.0.1","callerSuppliedUserAgent": "google-cloud-sdk468.0.0 (gzip),gzip(gfe)","callerNetwork": "//compute.googleapis.com/projects/prj-dv-network-13975/global/networks/__unknown__","callerIsGceClient": true,"requestAttributes": {},"destinationAttributes": {}},"serviceName": "bigquery.googleapis.com","methodName": "google.cloud.bigquery.v2.TableService.InsertTable","authorizationInfo": [{"resource": "projects/{project_id}","permission": "bigquery.jobs.create","granted": true,"resourceAttributes": {}}],"resourceName": "projects/{project_id}/jobs/bqjob_r24718211e9ff980a_0000018e652b5cfb_1","metadata": {"@type": "type.googleapis.com/google.cloud.audit.BigQueryAuditMetadata","jobChange": {"job": {"jobConfig": {"queryConfig": {"writeDisposition": "WRITE_EMPTY","createDisposition": "CREATE_IF_NEEDED","query": "ALTER SCHEMA `prj-qa-curated-zone-ext-63f0.extdata` ADD REPLICA `us-central1` OPTIONS(location=`us-central1`, replica_kms_key=`projects/prj-qa-curated-zone-ext-63f0/locations/us-central1/keyRings/kms-kr-qa-extdata-ext-bq-f598/cryptoKeys/kms-key-qa-extdata-ext-bq-f598`)","priority": "QUERY_INTERACTIVE"},"type": "QUERY"},"jobName": "projects/{project_id}/jobs/bqjob_r24718211e9ff980a_0000018e652b5cfb_1","jobStats": {"queryStats": {},"startTime": "2024-03-22T07:58:44.815Z","createTime": "2024-03-22T07:58:44.663Z","reservation": "unreserved","endTime": "2024-03-22T07:58:44.815Z"},"jobStatus": {"errorResult": {"code": 7.0,"message": "VPC Service Controls: Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: ZlM-84GesuDC7Ph1qWKXtK1To2aXsnl8kqJnDtfZ5oHzsYBhzGUnHA."},"errors": [{"code": 7.0,"message": "VPC Service Controls: Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: ZlM-84GesuDC7Ph1qWKXtK1To2aXsnl8kqJnDtfZ5oHzsYBhzGUnHA."}],"jobState": "DONE"}},"after": "DONE"}},"redactions": [{"type": "REPLACED","field": "requestMetadata.callerIp","reason": "Request came from a GCE VM in the same organization."},{"type": "REPLACED","field": "requestMetadata.callerNetwork","reason": "Request originated from a GCE VM or an on-prem VM behind a VPN, and the log was enhanced with additional information"}]},"insertId": "-pihhlsdhey0","resource": {"type": "bigquery_project","labels": {"project_id": "{project_id}","location": "US"}},"timestamp": "2024-03-22T07:58:44.880257Z","severity": "ERROR","logName": "projects/{project_id}/logs/cloudaudit.googleapis.com%2Fdata_access","operation": {"id": "1711094324663-{project_id}:bqjob_r24718211e9ff980a_0000018e652b5cfb_1","producer": "bigquery.googleapis.com","last": true},"receiveTimestamp": "2024-03-22T07:58:44.901030684Z"}
        """)
    ],
    
    "CS_EDR": [
        # CrowdStrike EDR - ProcessRollup2
        json.loads(r"""
        {"IntegrityLevel":"16384","ParentProcessId":"96415691933129","SourceProcessId":"96415691933129","aip":"198.51.100.1","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-18","event_platform":"Win","TokenType":"1","ProcessEndTime":"","ParentBaseFileName":"cscript.exe","ImageSubsystem":"2","id":"acbe6864-f201-11ea-953c-069b51868641","EffectiveTransmissionClass":"3","SessionId":"0","Tags":"27, 151, 341, 12094627905582","timestamp":"1599589959527","event_simpleName":"ProcessRollup2","RawProcessId":"9244","ConfigStateHash":"2471234503","MD5HashData":"eaa3ee12b2caa0365f2b4d495b50ad22","SHA256HashData":"f30686dd09b81d4080ab58def209173772fa132fa3762688274270afa6407872","AuthenticationId":"999","ConfigBuild":"1007.3.0011304.1","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff","ParentAuthenticationId":"999","TargetProcessId":"96415693097233","ImageFileName":"\\Device\\HarddiskVolume2\\Windows\\System32\\conhost.exe","SourceThreadId":"392014828599785","Entitlements":"15","name":"ProcessRollup2V17","ProcessStartTime":"1599589959.084","aid":"cc71beda79b940fb4d9223464401c0e4","cid":"{customer_id}"}
        """),
        
        # CrowdStrike EDR - KernelModeLoadImage
        json.loads(r"""
        {"ModuleBaseAddress":"18446735308934676480","ModuleCharacteristics":"34","ContextThreadId":"9396918770217","aip":"198.51.100.1","IsOnNetwork":"0","event_platform":"Win","id":"6a978b97-f201-11ea-b285-06fcb2611d25","FileObject":"0","EffectiveTransmissionClass":"3","ModuleSize":"49152","timestamp":"1599589848542","event_simpleName":"KernelModeLoadImage","ContextTimeStamp":"1599589848.120","ConfigStateHash":"3817901004","ContextProcessId":"150324675820","IsOnClearCaseMvfs":"0","ConfigBuild":"1007.3.0011604.1","TargetProcessId":"150324675820","DllCharacteristics":"24928","IsOnRemovableDisk":"0","ImageFileName":"\\Device\\HarddiskVolume4\\Windows\\System32\\drivers\\mspclock.sys","Entitlements":"15","name":"KernelModeLoadImageV11","aid":"345877181217403d807cbf58029320aa","cid":"{customer_id}"}
        """),

        # CrowdStrike EDR - SuspiciousDnsRequest (Mac)
        json.loads(r"""
        {"event_simpleName":"SuspiciousDnsRequest","ContextTimeStamp":"1599589749.129","ConfigStateHash":"3601285583","ContextProcessId":"308822814554442262","DomainName":"s-vertamedia-com.geodns.me","ContextThreadId":"0","aip":"198.51.100.1","ConfigBuild":"1007.4.0011501.1","event_platform":"Mac","Entitlements":"15","name":"SuspiciousDnsRequestMacV1","id":"2f642169-f201-11ea-8654-020432d05a9d","aid":"99d4022e755646c0a207c6f97def5413","timestamp":"1599589749220","cid":"{customer_id}","RequestType":"1"}
        """),

        # CrowdStrike EDR - NewExecutableRenamed
        json.loads(r"""
        {"event_simpleName":"NewExecutableRenamed","ContextTimeStamp":"1599589874.740","ConfigStateHash":"372366231","ContextProcessId":"1827936631575","SourceFileName":"\\Device\\HarddiskVolume4\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\26fc-0\\Microsoft.SqlServer.FileSystemTask.dll","IrpFlags":"395312","ContextThreadId":"70608271935995","MinorFunction":"0","aip":"198.51.100.1","FileIdentifier":"e82e581df17edc4092fd8bd29084d4027247020000005000","ConfigBuild":"1007.3.0011604.1","event_platform":"Win","NewFileIdentifier":"e82e581df17edc4092fd8bd29084d4027247020000005000","MajorFunction":"6","Entitlements":"15","name":"NewExecutableRenamedV6","OperationFlags":"0","id":"7a72de68-f201-11ea-a8b2-0649c95cfa1d","FileObject":"18446621502106540304","EffectiveTransmissionClass":"3","aid":"11386e39649f48bc551f593a69adf28d","timestamp":"1599589875145","cid":"{customer_id}","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.S4b2e6a94#\\220695f3668988ad0f84403b534cfdb2\\Microsoft.SqlServer.FileSystemTask.ni.dll"}
        """),

        # CrowdStrike EDR - NetworkConnectIP6
        json.loads(r"""
        {"event_simpleName":"NetworkConnectIP6","ContextTimeStamp":"1599589877.857","LocalAddressIP6":"198.51.100.1","RemoteAddressIP6":"198.51.100.1","ConfigStateHash":"526721166","ConnectionFlags":"0","ContextProcessId":"1349305777529","RemotePort":"135","aip":"198.51.100.1","ConfigBuild":"1007.3.0011304.1","event_platform":"Win","LocalPort":"60433","Entitlements":"15","name":"NetworkConnectIP6V5","id":"7c6839f9-f201-11ea-bbe4-065126dd0691","Protocol":"6","EffectiveTransmissionClass":"3","aid":"d3b2536095da41a7a9550868663ad88c","ConnectionDirection":"0","InContext":"0","timestamp":"1599589878431","cid":"{customer_id}"}
        """),

        # CrowdStrike EDR - FirewallSetRuleIP4 (Mac)
        json.loads(r"""
        {"FirewallAction":"1","aip":"198.51.100.1","NegateLocalAddress":"0","InterfaceAlias":"utun4","RemoteAddressMaskIP4":"4294967295","event_platform":"Mac","NegateInterface":"0","IsUnique":"1","LocalAddressMaskIP4":"1647785569","id":"649ace95-f201-11ea-bcfa-06d056143119","Protocol":"6","timestamp":"1599589838497","LocalAddressIP4":"198.51.100.1","event_simpleName":"FirewallSetRuleIP4","ContextTimeStamp":"1599589838.448","ConfigStateHash":"3601285583","ContextProcessId":"309619233727799417","ConfigBuild":"1007.4.0011501.1","Entitlements":"15","name":"FirewallSetRuleIP4MacV1","aid":"090aac7ebe4e4caf53d90b5054a14a69","NegateRemoteAddress":"0","RemoteAddressIP4":"198.51.100.1","ConnectionDirection":"1","cid":"{customer_id}"}
        """),
        
        # CrowdStrike EDR - NetworkReceiveAcceptIP4
        json.loads(r"""
        {"LocalAddressIP4":"198.51.100.1","event_simpleName":"NetworkReceiveAcceptIP4","ContextTimeStamp":"1599589895.076","ConfigStateHash":"3976790071","ConnectionFlags":"0","ContextProcessId":"4261951242174","RemotePort":"64391","aip":"198.51.100.1","ConfigBuild":"1007.3.0011809.1","event_platform":"Win","TreeId":"180389360880","LocalPort":"64390","Entitlements":"15","name":"NetworkReceiveAcceptIP4V5","id":"8693697c-f201-11ea-ba77-023c0d427b63","Protocol":"6","EffectiveTransmissionClass":"3","aid":"21efc3422e0d49ed68a549433508a1e2","RemoteAddressIP4":"198.51.100.1","ConnectionDirection":"1","InContext":"0","timestamp":"1599589895491","cid":"{customer_id}"}
        """),

        # CrowdStrike EDR - UserFontLoad
        json.loads(r"""
        {"event_simpleName":"UserFontLoad","ContextTimeStamp":"1599589980.697","ConfigStateHash":"4170489579","ContextProcessId":"881033550710","ContextThreadId":"5303824566746","aip":"198.51.100.1","FontBufferLength":"44908","ConfigBuild":"1007.3.0011809.1","event_platform":"Win","FontFileCount":"0","Entitlements":"15","name":"UserFontLoadV4","FontLoadOperation":"1","FontBuffer":"324333592","id":"b9b3fc1c-f201-11ea-9c55-02e0615fd7bb","FontFileName":"","EffectiveTransmissionClass":"3","aid":"fa936c5956d94c209f1664cbdafa3dcb","timestamp":"1599589981269","cid":"{customer_id}"}
        """),

        # CrowdStrike EDR - CriticalFileAccessed (Linux)
        json.loads(r"""
        {"event_simpleName":"CriticalFileAccessed","ContextTimeStamp":"1599589801.308","GID":"0","ConfigStateHash":"3639917840","ContextProcessId":"310343684616607100","ContextThreadId":"0","aip":"198.51.100.1","ConfigBuild":"1007.8.0009808.1","UID":"0","event_platform":"Lin","UnixMode":"32768","Entitlements":"15","name":"CriticalFileAccessedLinV1","id":"4ec88827-f201-11ea-8cc7-02a4341022e7","aid":"eff88b4c27ff456463c166a175b597a0","timestamp":"1599589801887","cid":"{customer_id}","TargetFileName":"/etc/shadow"}
        """),
        
        # CrowdStrike EDR - ProcessWitness (iOS)
        json.loads(r"""
        {"event_simpleName":"ProcessWitness","ContextTimeStamp":"1599796998.875","ApplicationName":".com.apple.purplebuddy","ApplicationVersion":"1.0.0","aip":"198.51.100.1","event_platform":"iOS","TargetProcessId":"9243706336667727904","name":"ProcessWitnessIOSV1","id":"ba0953f0-f3e3-11ea-808d-061f084f01cd","ApplicationUniqueIdentifier":"000e7fda906b557985be5a06ad47460ce565e603","aid":"ebb523282679485c86a897c778553a2c","timestamp":"1599796999252","cid":"{customer_id}"}
        """),

        # CrowdStrike EDR - MobileOsIntegrityStatus (iOS)
        json.loads(r"""
        {"event_simpleName":"MobileOsIntegrityStatus","event_platform":"iOS","ContextTimeStamp":"1599794765.082","name":"MobileOsIntegrityStatusIOSV2","aip":"198.51.100.1","id":"8a131394-f3de-11ea-b07e-06f6cca0a049","aid":"1fd7836237ed4dacb124ef9cc80d227a","MobileOsIntegrityIntact":"1","timestamp":"1599794771301","cid":"{customer_id}"}
        """),

        # CrowdStrike EDR - MobilePowerStats (iOS)
        json.loads(r"""
        {"event_simpleName":"MobilePowerStats","event_platform":"iOS","ContextTimeStamp":"1599797015.769","BatteryLevel":"26","BatteryStatus":"0","name":"MobilePowerStatsIOSV1","aip":"198.51.100.1","id":"c3fd7f1e-f3e3-11ea-83eb-021cca8d909b","aid":"ce1232ea80ee4caaa0d82087fe7dc1c3","timestamp":"1599797015951","cid":"{customer_id}"}
        """),
        
        # CrowdStrike EDR - DnsRequest
        json.loads(r"""
        {"ConfigBuild":"1007.3.0007310.1","ConfigStateHash":"1398574934","ContextProcessId":"51755700331390","ContextThreadId":"169474373517494","ContextTimeStamp":"1599589693.494","DnsRequestCount":"1","DomainName":"mtXXXXXX-nb-med7.nyyyyy","DualRequest":"0","EffectiveTransmissionClass":"3","Entitlements":"15","InterfaceIndex":"0","RequestType":"1","aid":"b8ac84cd2c66401878ae9d5c1e5e12b4","aip":"198.51.100.1","cid":"{customer_id}","event_platform":"Win","event_simpleName":"DnsRequest","id":"7ec1d6bb-bba5-11e8-9975-06953f3a67fe","name":"DnsRequestV3","timestamp":"1603206879"}
        """),

        # CrowdStrike EDR - EndOfProcess (Mac)
        json.loads(r"""
        {"AsepWrittenCount":"0","ConfigBuild":"1007.4.0007201.1","ConfigStateHash":"2952273337","ContextProcessId":"1835113314488","ContextThreadId":"0","ContextTimeStamp":"1599589693.494","DirectoryCreatedCount":"0","DnsRequestCount":"0","Entitlements":"13","ExecutableDeletedCount":"0","FileDeletedCount":"1","NetworkBindCount":"0","NetworkCapableAsepWriteCount":"0","NetworkCloseCount":"0","NetworkConnectCount":"0","NetworkListenCount":"0","NetworkRecvAcceptCount":"0","NewExecutableWrittenCount":"0","RawProcessId":"31921","SHA256HashData":"9baee8d651f17578df3dae23e1648e8adf90bf83678d390467bfe15827d99457","SuspectStackCount":"0","SuspiciousDnsRequestCount":"0","TargetProcessId":"555677443321","aid":"fab120b74cc348c6648762c43322824e","aip":"198.51.100.1","cid":"{customer_id}","event_platform":"Mac","event_simpleName":"EndOfProcess","id":"83a1b594-8e22-11e8-81c5-0218ebf88a38","name":"EndOfProcessMacV9","timestamp":"1603207237"}
        """),

        # CrowdStrike EDR - FsVolumeMounted
        json.loads(r"""
        {"ConfigBuild": "100.3.0008003.1","ConfigStateHash": "2688044283","ContextProcessId": "2267742893028","ContextThreadId": "47450799251750","ContextTimeStamp": "1599589693.494","DiskParentDeviceInstanceId": "PCI\\\\VEN_8086&DEV_2822&SUBSYS_06B91028&REV_31\\\\3&11583659&1&B8","EffectiveTransmissionClass": "3","Entitlements": "15","VolumeDeviceCharacteristics": "131072","VolumeDeviceObjectFlags": "134479872","VolumeDeviceType": "8","VolumeDriveLetter": "C:","VolumeFileSystemDevice": "\\\\Ntfs","VolumeFileSystemDriver": "\\\\FileSystem\\\\NTFS","VolumeFileSystemType": "2","VolumeIsEncrypted": "0","VolumeMountPoint": "\\\\??\\\\Volume{a5494a82-0000-0000-0000-100000000000}","VolumeName": "\\\\Device\\\\HarddiskVolume1","VolumeRealDeviceName": "\\\\Device\\\\HarddiskVolume1","VolumeSectorSize": "512","aid": "88d239c4bf163951fdf30f7b04c7cfc2","aip": "198.51.100.1","cid": "{customer_id}","event_platform": "Win","event_simpleName": "FsVolumeMounted","id": "ffff3d13-ffc2-1111-aaa0-025bfbbad862","name": "FsVolumeMountedV6","timestamp": "1603214267"}
        """)
    ]
} 