Parser for MicrosoftWindowsEvents parses out TargetProcessFilename but Parser for MicrosoftSecurityEvents does not

[matterje]

PROBLEM

The vimProcessCreateMicrosoftWindowsEvents parser includes a function that extracts the TargetProcessFilename from the field TargetProcessName. We use this field in KQL queries with a =~ for the exact binary match which is clean and performant.

However the parser vimProcessCreateMicrosoftSecurityEvents does not extract this field name, resulting in an empty TargetProcessFilename field.

Both these parsers are looking at 4688 Windows events therefore both should have the same data and should both be capable of parsing the TargetProcessFilename field. The base log source and data are the same.

PROPOSED SOLUTION

Implement the same functionality from vimProcessCreateMicrosoftWindowsEvents to vimProcessCreateMicrosoftSecurityEvents in regards to extracting the TargetProcessFilename from TargetProcessName

The lines in question:

let ASIM_GetFilenamePart = (path:string) { tostring(split(path,@'\')[-1]) };

| extend 
    ActingProcessFilename = ASIM_GetFilenamePart(ActingProcessName),
    TargetProcessFilename = ASIM_GetFilenamePart(TargetProcessName)

These lines should be added in their respective places in vimProcessCreateMicrosoftSecurityEvents similar to the parser vimProcessCreateMicrosoftWindowsEvents

ADDITIONAL CONTEXT

vimProcessCreateMicrosoftWindowsEvents: https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimProcessEvent/Parsers/vimProcessCreateMicrosoftWindowsEvents.yaml

vimProcessCreateMicrosoftSecurityEvents: https://github.com/Azure/Azure-Sentinel/blob/master/Parsers/ASimProcessEvent/Parsers/vimProcessCreateMicrosoftSecurityEvents.yaml