diff --git a/packages/crowdstrike/changelog.yml b/packages/crowdstrike/changelog.yml index 6e075e2270b..cfcd4566037 100644 --- a/packages/crowdstrike/changelog.yml +++ b/packages/crowdstrike/changelog.yml @@ -1,4 +1,12 @@ # newer versions go on top +- version: "4.3.0" + changes: + - description: Add ECS categorization and field mappings for new FDR event types including IDP telemetry, Active Directory account changes, DBus/systemd events, network containment, host firewall, sensor diagnostics, and container activity. + type: enhancement + link: https://github.com/elastic/integrations/pull/20079 + - description: Map Active Directory events to ECS user fields from SamAccountName, AccountObjectSid, and AccountDomain, and add DNS enrichment for DNSRequestDetectInfo events. + type: enhancement + link: https://github.com/elastic/integrations/pull/20079 - version: "4.2.0" changes: - description: Add support for OverwatchGenericDetectionSummaryEvent in the Falcon data stream. diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json index 17b5d70e9cb..aa10617169d 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json @@ -1342,9 +1342,17 @@ }, "event": { "action": "ChannelVersionRequired", + "category": [ + "configuration" + ], "created": "2021-07-07T17:04:53.974Z", "id": "ffffffff-1111-11eb-b7e0-02332cdcc16d|ffffffff25b14d4aa96de99e24bad2fa|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1156120155\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"12\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV2\",\"id\":\"ffffffff-1111-11eb-b7e0-02332cdcc16d\",\"ErrorCode\":\"0\",\"aid\":\"ffffffff25b14d4aa96de99e24bad2fa\",\"timestamp\":\"1625677493974\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + "kind": "event", + "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1156120155\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"12\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV2\",\"id\":\"ffffffff-1111-11eb-b7e0-02332cdcc16d\",\"ErrorCode\":\"0\",\"aid\":\"ffffffff25b14d4aa96de99e24bad2fa\",\"timestamp\":\"1625677493974\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] }, "host": { "id": "ffffffff25b14d4aa96de99e24bad2fa", @@ -1490,9 +1498,17 @@ }, "event": { "action": "ChannelVersionRequired", + "category": [ + "configuration" + ], "created": "2021-07-07T17:04:40.455Z", "id": "ffffffff-1111-11eb-8cc5-02c6fb049dd3|ffffffff2d7b4778a73b2cf58d327e42|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1620585913\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.13\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"210\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ChannelVersionRequiredMacV2\",\"id\":\"ffffffff-1111-11eb-8cc5-02c6fb049dd3\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff2d7b4778a73b2cf58d327e42\",\"timestamp\":\"1625677480455\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + "kind": "event", + "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1620585913\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.13\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"210\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ChannelVersionRequiredMacV2\",\"id\":\"ffffffff-1111-11eb-8cc5-02c6fb049dd3\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff2d7b4778a73b2cf58d327e42\",\"timestamp\":\"1625677480455\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] }, "host": { "id": "ffffffff2d7b4778a73b2cf58d327e42", @@ -3604,9 +3620,17 @@ }, "event": { "action": "ChannelVersionRequired", + "category": [ + "configuration" + ], "created": "2021-07-07T17:05:07.901Z", "id": "ffffffff-1111-11eb-b411-06baeacb7a63|ffffffff67d54f7daf3d998ffc74d48e|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"ChannelVersion\":\"25\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"3155796140\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"20\",\"ConfigBuild\":\"1007.8.0011110.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV1\",\"id\":\"ffffffff-1111-11eb-b411-06baeacb7a63\",\"aid\":\"ffffffff67d54f7daf3d998ffc74d48e\",\"timestamp\":\"1625677507901\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + "kind": "event", + "original": "{\"ChannelVersion\":\"25\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"3155796140\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"20\",\"ConfigBuild\":\"1007.8.0011110.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV1\",\"id\":\"ffffffff-1111-11eb-b411-06baeacb7a63\",\"aid\":\"ffffffff67d54f7daf3d998ffc74d48e\",\"timestamp\":\"1625677507901\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] }, "host": { "id": "ffffffff67d54f7daf3d998ffc74d48e", diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log index 6ab6c2e5419..47d2b97a3a1 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log @@ -3,3 +3,11 @@ {"CapPrm":"3800192030037","ParentProcessId":"8081349242194000050","SourceProcessId":"8081349242194000050","aip":"81.2.69.192","SessionProcessId":"4102020000109002000","SyntheticPR2Flags":"4","event_platform":"Lin","ProcessEndTime":"1745972888.297","SVUID":"0","EventOrigin":"45","id":"fb9bd5f0314e46ce785f479aed8f3032fcd9","EffectiveTransmissionClass":"2","timestamp":"1743508799999","ProcessGroupId":"7001610480104066706","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"8905032","ContextTimeStamp":"1752350302.359","GID":"0","ConfigStateHash":"5001020160","SVGID":"0","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","CommandLine":"e7f8eac7d","TargetProcessId":"6059002040716020903","ImageFileName":"/501e","RGID":"0","SourceThreadId":"0","Entitlements":"56","name":"4f32166a22f49735247598b45006","ProcessStartTime":"1745953229.264","RUID":"0","aid":"8c687fb6b1e8231200c77ef5e3175d0e","cid":"4092825518eaf67377a6e4492ae44577"} {"event_simpleName":"TerminateProcess","RawProcessId":"1070050","ContextTimeStamp":"1751300030.984","ConfigStateHash":"8001020160","ContextProcessId":"9960000700989070560","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","TargetProcessId":"6960000700989070560","Entitlements":"36","name":"6b1c662a760f5ed9750d4","EventOrigin":"1","id":"3e71b26395f4386bcb6602ee6777bb5f3124","EffectiveTransmissionClass":"2","aid":"12111f24f25a2a99438b40765c236577","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} {"ChangeTime":"1731329600.968","OciContainerId":"sw345tf5e3455r7dw32w23t6t7fde34ed345rfe45rf0ew4fd","CapPrm":"123438954321","ParentProcessId":"12347782548906","SourceProcessId":"12347782548906","aip":"89.160.20.128","SessionProcessId":"1234915117961","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1760406073.595","SVUID":"0","ParentBaseFileName":"runc","EventOrigin":"17","id":"1w23e4r-d03e-4003-bc75-71c6e819ca5f","EffectiveTransmissionClass":"2","Tags":"874, 17179870274, 12094627905582, 12094627906234, 212205744162400","timestamp":"1760406074201","ProcessGroupId":"1234915117961","LocalAddressIP4":"0.0.0.0","event_simpleName":"ProcessRollup2","RawProcessId":"1234","RootPath":"/","GID":"0","ConfigStateHash":"1026580567","UserName":"root","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"runc init","TargetProcessId":"12347783237538","ImageFileName":"/","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV12","RUID":"0","ProcessStartTime":"1760406073.568","ComputerName":"comp2","aid":"ffffffff62714a708030d494ca0a7e60","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DNSRequestDetectInfo","ContextBaseFileName":"example","IP4Records":"192.0.2.30","TemplateInstanceId":"28184","aip":"192.0.2.3","QueryStatus":"0","event_platform":"Lin","SessionPatternIdList":"1001,1002,1003","PatternId":"30997","EventOrigin":"1","id":"a8762b4b-f927-4800-8631-ad275fd3e55a","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785494.176","ConfigStateHash":"4058413047","TemplateDisposition":"10","ContextProcessId":"1781784074817030518","DomainName":"api.example.com","ConfigBuild":"1007.8.0019004.15","Entitlements":"15","name":"DNSRequestDetectInfoLinV2","ComputerName":"LIN-HOST-01","aid":"0ce22396112f4f748024a6356ceee4de","cid":"2cc98db1a47b4c98b913c94d43bfab70","RequestType":"1"} +{"event_simpleName":"DBusMessage","DBusDestination":":1.100","aip":"192.0.2.3","DBusReplySerial":"0","DBusNumUnixFiles":"0","DBusSender":"","event_platform":"Lin","DBusSerial":"11","EventOrigin":"1","id":"05ad40d8-fd06-4f2e-91e6-99eb94a334b0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785754.694","DBusPayload":"[233]","ConfigStateHash":"4058413047","ContextProcessId":"1781785754634192743","DBusPath":"/","ConfigBuild":"1007.8.0019004.15","DBusMember":"SetFeatureFlags","DBusMessageFlags":"0","Entitlements":"15","name":"DBusMessageLinV1","DBusInterface":"org.example.service","ComputerName":"LIN-HOST-01","aid":"0ce22396112f4f748024a6356ceee4de","cid":"2cc98db1a47b4c98b913c94d43bfab70","DBusMessageKind":"method_call"} +{"event_simpleName":"CreateSocket","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785861.437","SocketType":"3","ConfigStateHash":"784305823","ContextProcessId":"106167322594972","ContextThreadId":"0","aip":"192.0.2.3","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","NetlinkFamily":"9","ImageFileName":"/usr/sbin/crond","Entitlements":"15","name":"CreateSocketLinV3","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"3a91a3a3-e739-4762-8169-7c7913f7601d","AddressFamily":"16","EffectiveTransmissionClass":"3","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"PacketFilterAttached","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781250697.368","ConfigStateHash":"1180378067","ContextProcessId":"1781250696892936591","aip":"192.0.2.2","FilterContent":"0102030405060708","SHA256HashData":"8f3aeb46f41e411b524118e77ca53995c6a273b12f98fc41d7b62cf907511a6c","FilterLength":"80","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","ImageFileName":"/usr/libexec/example/fwupd","Entitlements":"15","name":"PacketFilterAttachedLinV3","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"e6ed60ef-4c04-49c8-b426-92734a68d946","EffectiveTransmissionClass":"3","aid":"0ce22396112f4f748024a6356ceee4de","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"SystemdServiceCreated","SystemdUnitFileState":"static","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781747971.022","ConfigStateHash":"4058413047","aip":"192.0.2.3","SystemdUnitPath":"/usr/lib/systemd/system/example.service","ConfigBuild":"1007.8.0019004.15","SystemdUnitProperties":"{\"Type\":\"dbus\",\"Description\":\"Example Service\"}","event_platform":"Lin","SystemdUnitLoadState":"loaded","SystemdUnitName":"example.service","SystemdUnitActiveState":"active","Entitlements":"15","name":"SystemdServiceCreatedLinV2","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"d59230fa-4361-43a6-a6c9-9a12ac1492d5","EffectiveTransmissionClass":"3","aid":"0ce22396112f4f748024a6356ceee4de","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"SharedObjectLoaded","VirtualAddress":"140539515256832","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785861.426","ConfigStateHash":"784305823","ContextProcessId":"106167322594972","aip":"192.0.2.3","SHA256HashData":"bb7ae1c1c0c3cfd6a73a6839ff69d81d14d1386e24372084cd44a97c385ebc08","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","CommandLine":"/usr/sbin/crond -n","ImageFileName":"/usr/sbin/crond","Entitlements":"15","name":"SharedObjectLoadedLinV2","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"fc2c5063-1bea-4bf0-962d-7ab26a1a95b1","EffectiveTransmissionClass":"3","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70","TargetFileName":"/usr/lib64/security/pam_unix.so"} +{"event_simpleName":"OciContainerInfo","OciContainerId":"0370e0bae01215ab32fcb01fa5b21a4c7a07fe10a5a7032ccb2438fce25c6ba0","aip":"192.0.2.3","OciContainerStateOOMKilled":"0","OciContainerConfigLabels":"com.example.project:demo|com.example.service:agent","OciContainerConfigTty":"0","event_platform":"Lin","OciContainerHostConfigPublishAllPorts":"0","OciContainerMounts":"bind,/var/example/creds,/app/credentials,rw,true,rprivate","EventOrigin":"1","OciContainerName":"/example-agent","OciContainerNetworkSettingsIpAddress":"255.255.255.255","OciContainerAppName":"JAVA","id":"36bcd8e5-11d7-427b-beab-9a57c747f182","EffectiveTransmissionClass":"2","OciContainerInfoRetransmitted":"1","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ConfigStateHash":"4058413047","OciContainerStatePid":"2570469","OciContainerImageId":"be2069da187be6aa939626092187447b22d579d986cfaa065ff78408ddbb6c6c","ConfigBuild":"1007.8.0019004.15","OciContainerConfigImage":"example-agent","Entitlements":"15","name":"OciContainerInfoLinV10","ComputerName":"LIN-HOST-01","OciContainerAppVersion":"1.0.0","aid":"0ce22396112f4f748024a6356ceee4de","cid":"2cc98db1a47b4c98b913c94d43bfab70","OciContainerEngineType":"1"} +{"event_simpleName":"SensorTampering","ActionBlocked":"1","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781659012.171","SourceImageFileName":"/usr/lib/systemd/systemd","ConfigStateHash":"4058413047","ResourceName":"falcond","SourceProcessId":"1781139628182470889","SourceCommandLine":"/usr/lib/systemd/systemd --system","aip":"192.0.2.3","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","TargetProcessId":"1780602555935280240","Entitlements":"15","name":"SensorTamperingLinV1","EventOrigin":"1","ComputerName":"LIN-HOST-01","TamperingAction":"signal_process","id":"e02f29c4-344e-4d33-9cc0-2acb32a8d8ec","EffectiveTransmissionClass":"2","aid":"0ce22396112f4f748024a6356ceee4de","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json index 6e33576ee53..25f0bb3f742 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json @@ -551,6 +551,932 @@ "id": "0", "name": "root" } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4058413047", + "ContextBaseFileName": "example", + "ContextProcessId": "1781784074817030518", + "ContextTimeStamp": "2026-06-18T12:24:54.176Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "1", + "IP4Records": "192.0.2.30", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "PatternId": "30997", + "QueryStatus": "0", + "SessionPatternIdList": [ + "1001", + "1002", + "1003" + ], + "TemplateDisposition": "10", + "TemplateInstanceId": "28184", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "DNSRequestDetectInfo", + "id": "a8762b4b-f927-4800-8631-ad275fd3e55a", + "name": "DNSRequestDetectInfoLinV2" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "dns": { + "question": { + "name": "api.example.com", + "registered_domain": "example.com", + "subdomain": "api", + "top_level_domain": "com", + "type": "A" + }, + "type": "query" + }, + "event": { + "action": "DNSRequestDetectInfo", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "a8762b4b-f927-4800-8631-ad275fd3e55a|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"DNSRequestDetectInfo\",\"ContextBaseFileName\":\"example\",\"IP4Records\":\"192.0.2.30\",\"TemplateInstanceId\":\"28184\",\"aip\":\"192.0.2.3\",\"QueryStatus\":\"0\",\"event_platform\":\"Lin\",\"SessionPatternIdList\":\"1001,1002,1003\",\"PatternId\":\"30997\",\"EventOrigin\":\"1\",\"id\":\"a8762b4b-f927-4800-8631-ad275fd3e55a\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781785494.176\",\"ConfigStateHash\":\"4058413047\",\"TemplateDisposition\":\"10\",\"ContextProcessId\":\"1781784074817030518\",\"DomainName\":\"api.example.com\",\"ConfigBuild\":\"1007.8.0019004.15\",\"Entitlements\":\"15\",\"name\":\"DNSRequestDetectInfoLinV2\",\"ComputerName\":\"LIN-HOST-01\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"RequestType\":\"1\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "network": { + "protocol": "dns" + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "1781784074817030518", + "name": "example" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4058413047", + "ContextProcessId": "1781785754634192743", + "ContextTimeStamp": "2026-06-18T12:29:14.694Z", + "DBusDestination": ":1.100", + "DBusInterface": "org.example.service", + "DBusMember": "SetFeatureFlags", + "DBusMessageFlags": "0", + "DBusMessageKind": "method_call", + "DBusNumUnixFiles": "0", + "DBusPath": "/", + "DBusPayload": "[233]", + "DBusReplySerial": "0", + "DBusSerial": "11", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "DBusMessage", + "id": "05ad40d8-fd06-4f2e-91e6-99eb94a334b0", + "name": "DBusMessageLinV1" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "DBusMessage", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "05ad40d8-fd06-4f2e-91e6-99eb94a334b0|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"DBusMessage\",\"DBusDestination\":\":1.100\",\"aip\":\"192.0.2.3\",\"DBusReplySerial\":\"0\",\"DBusNumUnixFiles\":\"0\",\"DBusSender\":\"\",\"event_platform\":\"Lin\",\"DBusSerial\":\"11\",\"EventOrigin\":\"1\",\"id\":\"05ad40d8-fd06-4f2e-91e6-99eb94a334b0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781785754.694\",\"DBusPayload\":\"[233]\",\"ConfigStateHash\":\"4058413047\",\"ContextProcessId\":\"1781785754634192743\",\"DBusPath\":\"/\",\"ConfigBuild\":\"1007.8.0019004.15\",\"DBusMember\":\"SetFeatureFlags\",\"DBusMessageFlags\":\"0\",\"Entitlements\":\"15\",\"name\":\"DBusMessageLinV1\",\"DBusInterface\":\"org.example.service\",\"ComputerName\":\"LIN-HOST-01\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"DBusMessageKind\":\"method_call\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "1781785754634192743" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AddressFamily": "16", + "ConfigStateHash": "784305823", + "ContextProcessId": "106167322594972", + "ContextTimeStamp": "2026-06-18T12:31:01.437Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "NetlinkFamily": "9", + "SocketType": "3", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "CreateSocket", + "id": "3a91a3a3-e739-4762-8169-7c7913f7601d", + "name": "CreateSocketLinV3" + }, + "device": { + "id": "2e3d9c94d9c34764860b1f3b444c6d4d" + }, + "event": { + "action": "CreateSocket", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "3a91a3a3-e739-4762-8169-7c7913f7601d|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"CreateSocket\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781785861.437\",\"SocketType\":\"3\",\"ConfigStateHash\":\"784305823\",\"ContextProcessId\":\"106167322594972\",\"ContextThreadId\":\"0\",\"aip\":\"192.0.2.3\",\"ConfigBuild\":\"1007.8.0019004.15\",\"event_platform\":\"Lin\",\"NetlinkFamily\":\"9\",\"ImageFileName\":\"/usr/sbin/crond\",\"Entitlements\":\"15\",\"name\":\"CreateSocketLinV3\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"id\":\"3a91a3a3-e739-4762-8169-7c7913f7601d\",\"AddressFamily\":\"16\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "start", + "connection" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "2e3d9c94d9c34764860b1f3b444c6d4d", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "106167322594972", + "executable": "/usr/sbin/crond", + "name": "crond", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "784305823" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "1180378067", + "ContextProcessId": "1781250696892936591", + "ContextTimeStamp": "2026-06-12T07:51:37.368Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "FilterContent": "0102030405060708", + "FilterLength": "80", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "SHA256HashData": "8f3aeb46f41e411b524118e77ca53995c6a273b12f98fc41d7b62cf907511a6c", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "PacketFilterAttached", + "id": "e6ed60ef-4c04-49c8-b426-92734a68d946", + "name": "PacketFilterAttachedLinV3" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "PacketFilterAttached", + "category": [ + "configuration", + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "e6ed60ef-4c04-49c8-b426-92734a68d946|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"PacketFilterAttached\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781250697.368\",\"ConfigStateHash\":\"1180378067\",\"ContextProcessId\":\"1781250696892936591\",\"aip\":\"192.0.2.2\",\"FilterContent\":\"0102030405060708\",\"SHA256HashData\":\"8f3aeb46f41e411b524118e77ca53995c6a273b12f98fc41d7b62cf907511a6c\",\"FilterLength\":\"80\",\"ConfigBuild\":\"1007.8.0019004.15\",\"event_platform\":\"Lin\",\"ImageFileName\":\"/usr/libexec/example/fwupd\",\"Entitlements\":\"15\",\"name\":\"PacketFilterAttachedLinV3\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"id\":\"e6ed60ef-4c04-49c8-b426-92734a68d946\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "change", + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "1781250696892936591", + "executable": "/usr/libexec/example/fwupd", + "name": "fwupd" + }, + "related": { + "hash": [ + "8f3aeb46f41e411b524118e77ca53995c6a273b12f98fc41d7b62cf907511a6c", + "1180378067" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4058413047", + "ContextTimeStamp": "2026-06-18T01:59:31.022Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "SystemdUnitActiveState": "active", + "SystemdUnitFileState": "static", + "SystemdUnitLoadState": "loaded", + "SystemdUnitName": "example.service", + "SystemdUnitPath": "/usr/lib/systemd/system/example.service", + "SystemdUnitProperties": "{\"Type\":\"dbus\",\"Description\":\"Example Service\"}", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "SystemdServiceCreated", + "id": "d59230fa-4361-43a6-a6c9-9a12ac1492d5", + "name": "SystemdServiceCreatedLinV2" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "SystemdServiceCreated", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "d59230fa-4361-43a6-a6c9-9a12ac1492d5|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"SystemdServiceCreated\",\"SystemdUnitFileState\":\"static\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781747971.022\",\"ConfigStateHash\":\"4058413047\",\"aip\":\"192.0.2.3\",\"SystemdUnitPath\":\"/usr/lib/systemd/system/example.service\",\"ConfigBuild\":\"1007.8.0019004.15\",\"SystemdUnitProperties\":\"{\\\"Type\\\":\\\"dbus\\\",\\\"Description\\\":\\\"Example Service\\\"}\",\"event_platform\":\"Lin\",\"SystemdUnitLoadState\":\"loaded\",\"SystemdUnitName\":\"example.service\",\"SystemdUnitActiveState\":\"active\",\"Entitlements\":\"15\",\"name\":\"SystemdServiceCreatedLinV2\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"id\":\"d59230fa-4361-43a6-a6c9-9a12ac1492d5\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "784305823", + "ContextProcessId": "106167322594972", + "ContextTimeStamp": "2026-06-18T12:31:01.426Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "ImageFileName": "/usr/sbin/crond", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "SHA256HashData": "bb7ae1c1c0c3cfd6a73a6839ff69d81d14d1386e24372084cd44a97c385ebc08", + "VirtualAddress": "140539515256832", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "SharedObjectLoaded", + "id": "fc2c5063-1bea-4bf0-962d-7ab26a1a95b1", + "name": "SharedObjectLoadedLinV2" + }, + "device": { + "id": "2e3d9c94d9c34764860b1f3b444c6d4d" + }, + "event": { + "action": "SharedObjectLoaded", + "category": [ + "library" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "fc2c5063-1bea-4bf0-962d-7ab26a1a95b1|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"SharedObjectLoaded\",\"VirtualAddress\":\"140539515256832\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781785861.426\",\"ConfigStateHash\":\"784305823\",\"ContextProcessId\":\"106167322594972\",\"aip\":\"192.0.2.3\",\"SHA256HashData\":\"bb7ae1c1c0c3cfd6a73a6839ff69d81d14d1386e24372084cd44a97c385ebc08\",\"ConfigBuild\":\"1007.8.0019004.15\",\"event_platform\":\"Lin\",\"CommandLine\":\"/usr/sbin/crond -n\",\"ImageFileName\":\"/usr/sbin/crond\",\"Entitlements\":\"15\",\"name\":\"SharedObjectLoadedLinV2\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"id\":\"fc2c5063-1bea-4bf0-962d-7ab26a1a95b1\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"TargetFileName\":\"/usr/lib64/security/pam_unix.so\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "file": { + "directory": "/usr/lib64/security", + "extension": "so", + "name": "pam_unix.so", + "path": "/usr/lib64/security/pam_unix.so", + "type": "file" + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "2e3d9c94d9c34764860b1f3b444c6d4d", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", + "version": "1007.8.0019004.15" + }, + "process": { + "args": [ + "/usr/sbin/crond", + "-n" + ], + "args_count": 2, + "command_line": "/usr/sbin/crond -n", + "entity_id": "106167322594972" + }, + "related": { + "hash": [ + "bb7ae1c1c0c3cfd6a73a6839ff69d81d14d1386e24372084cd44a97c385ebc08", + "784305823" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4058413047", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "OciContainerAppName": "JAVA", + "OciContainerAppVersion": "1.0.0", + "OciContainerConfigImage": "example-agent", + "OciContainerConfigLabels": "com.example.project:demo|com.example.service:agent", + "OciContainerConfigTty": "0", + "OciContainerEngineType": "1", + "OciContainerHostConfigPublishAllPorts": 0, + "OciContainerId": "0370e0bae01215ab32fcb01fa5b21a4c7a07fe10a5a7032ccb2438fce25c6ba0", + "OciContainerImageId": "be2069da187be6aa939626092187447b22d579d986cfaa065ff78408ddbb6c6c", + "OciContainerInfoRetransmitted": "1", + "OciContainerMounts": "bind,/var/example/creds,/app/credentials,rw,true,rprivate", + "OciContainerName": "/example-agent", + "OciContainerNetworkSettingsIpAddress": "255.255.255.255", + "OciContainerStateOOMKilled": "0", + "OciContainerStatePid": "2570469", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "OciContainerInfo", + "id": "36bcd8e5-11d7-427b-beab-9a57c747f182", + "name": "OciContainerInfoLinV10" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "OciContainerInfo", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "36bcd8e5-11d7-427b-beab-9a57c747f182|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "state", + "original": "{\"event_simpleName\":\"OciContainerInfo\",\"OciContainerId\":\"0370e0bae01215ab32fcb01fa5b21a4c7a07fe10a5a7032ccb2438fce25c6ba0\",\"aip\":\"192.0.2.3\",\"OciContainerStateOOMKilled\":\"0\",\"OciContainerConfigLabels\":\"com.example.project:demo|com.example.service:agent\",\"OciContainerConfigTty\":\"0\",\"event_platform\":\"Lin\",\"OciContainerHostConfigPublishAllPorts\":\"0\",\"OciContainerMounts\":\"bind,/var/example/creds,/app/credentials,rw,true,rprivate\",\"EventOrigin\":\"1\",\"OciContainerName\":\"/example-agent\",\"OciContainerNetworkSettingsIpAddress\":\"255.255.255.255\",\"OciContainerAppName\":\"JAVA\",\"id\":\"36bcd8e5-11d7-427b-beab-9a57c747f182\",\"EffectiveTransmissionClass\":\"2\",\"OciContainerInfoRetransmitted\":\"1\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ConfigStateHash\":\"4058413047\",\"OciContainerStatePid\":\"2570469\",\"OciContainerImageId\":\"be2069da187be6aa939626092187447b22d579d986cfaa065ff78408ddbb6c6c\",\"ConfigBuild\":\"1007.8.0019004.15\",\"OciContainerConfigImage\":\"example-agent\",\"Entitlements\":\"15\",\"name\":\"OciContainerInfoLinV10\",\"ComputerName\":\"LIN-HOST-01\",\"OciContainerAppVersion\":\"1.0.0\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"OciContainerEngineType\":\"1\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ActionBlocked": "1", + "ConfigStateHash": "4058413047", + "ContextTimeStamp": "2026-06-17T01:16:52.171Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "ResourceName": "falcond", + "SourceCommandLine": "/usr/lib/systemd/systemd --system", + "SourceImageFileName": "/usr/lib/systemd/systemd", + "SourceProcessId": "1781139628182470889", + "TamperingAction": "signal_process", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "SensorTampering", + "id": "e02f29c4-344e-4d33-9cc0-2acb32a8d8ec", + "name": "SensorTamperingLinV1" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "SensorTampering", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "e02f29c4-344e-4d33-9cc0-2acb32a8d8ec|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"SensorTampering\",\"ActionBlocked\":\"1\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781659012.171\",\"SourceImageFileName\":\"/usr/lib/systemd/systemd\",\"ConfigStateHash\":\"4058413047\",\"ResourceName\":\"falcond\",\"SourceProcessId\":\"1781139628182470889\",\"SourceCommandLine\":\"/usr/lib/systemd/systemd --system\",\"aip\":\"192.0.2.3\",\"ConfigBuild\":\"1007.8.0019004.15\",\"event_platform\":\"Lin\",\"TargetProcessId\":\"1780602555935280240\",\"Entitlements\":\"15\",\"name\":\"SensorTamperingLinV1\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"TamperingAction\":\"signal_process\",\"id\":\"e02f29c4-344e-4d33-9cc0-2acb32a8d8ec\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "1780602555935280240" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] } ] } diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log index ee90ee5f35a..4f025a1ee9a 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log @@ -119,3 +119,11 @@ {"event_simpleName":"FileWrittenWithEntropyHigh","Size":"12216","ShannonEntropy":"932","BoundingLimitCount":"5","event_platform":"Win","EventOrigin":"1","id":"fc10d190-e98f-45fc-bb2a-ca60d3534a2a","EffectiveTransmissionClass":"3","timestamp":"1761811953235","ContextTimeStamp":"1761811952.620","ConfigStateHash":"1146505100","ContextProcessId":"111845303038","AuthenticationId":"999","ConfigBuild":"1007.3.0019907.15","FileEcpBitmask":"0","BoundingLimitDuration":"3600000","Entitlements":"15","name":"FileWrittenWithEntropyHighV2","ComputerName":"win10-qwe-3","Attacks":[{"Tactic":"Defense Evasion","Technique":"Obfuscated Files or Information"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp"} {"event_simpleName":"ReflectiveDotnetModuleLoad","AssemblyName":"vezhsq1h, Version\u003d0.0.0.0, Culture\u003dneutral, PublicKeyToken\u003dnull","ModuleNativePath":"","NativePdbBuildPath":"","event_platform":"Win","DotnetModuleFlags":"8","DotnetModuleId":"140707789195504","EventOrigin":"1","id":"b089f099-ffac-44fd-9efe-e1bc148214ee","EffectiveTransmissionClass":"3","timestamp":"1755638644187","ManagedPdbBuildPath":"","ContextTimeStamp":"1755638637.713","ConfigStateHash":"3064617115","ContextProcessId":"11708829302","AssemblyFlags":"0","EtwProviderType":"2","ConfigBuild":"1007.3.0019907.15","CommandLine":"\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Entitlements":"15","name":"ReflectiveDotnetModuleLoadV2","AssemblyId":"1825020243168","aid":"cdbfd7c3bab5478d935db9969b5886cc","ModuleILPath":"vezhsq1h"} {"event_simpleName":"SuspiciousPrivilegedProcessHandle","IntegrityLevel":"16384","ContextThreadId":"1217210494023","TargetIntegrityLevel":"16384","event_platform":"Win","SuspiciousHandleOpenReason":"2","EventOrigin":"1","id":"87902694-15af-4692-b1e2-bf7fba80b272","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1757597618983","ContextTimeStamp":"1757597618.424","ConfigStateHash":"3591479077","ContextProcessId":"90332841484","AuthenticationId":"996","ConfigBuild":"1007.3.0019907.15","TargetProcessId":"90365065195","DesiredAccess":"2097151","Entitlements":"15","name":"SuspiciousPrivilegedProcessHandleV2","ComputerName":"win10-qwe-3","aid":"cdbfd7c3bab5478d935db9969b5886cc","TargetAuthenticationId":"996"} +{"event_simpleName":"IdpDcPerfReport","LocalAddressIP4":"192.0.2.10","ConfigStateHash":"3995347011","IdpPerfCounterPath":"\\Process(lsass)\\Working Set","aip":"192.0.2.1","IdpPerfSampleDuration":"2999997209","IdpPerfCounterMaximum":"95629312","IdpPerfSampleCount":"30","ConfigBuild":"1007.3.0021003.15","event_platform":"Win","IdpPerfCounterMinimum":"95531008","Entitlements":"15","name":"IdpDcPerfReportV1","EventOrigin":"17","ComputerName":"WIN-HOST-01","IdpPerfCounterSum":"2868150272","id":"11633f5f-6a9c-4a6a-a39b-f01bce8a2f37","EffectiveTransmissionClass":"2","aid":"3f4218d0c561464c9ef5d1c81000fc38","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"ActiveDirectoryAccountCreated","SamAccountName":"SVC-ACCT$","ContextTimeStamp":"1780575797.000","AccountDomain":"EXAMPLE.LOCAL","aip":"","event_platform":"Win","name":"ActiveDirectoryAccountCreatedV1","id":"d1972344-dae4-4cd5-910c-fbd6d71d4431","AccountObjectGuid":"82b2a1e4-585d-4d47-8f55-19b76b14a66f","aid":"","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70","AccountObjectSid":"S-1-5-21-000000000-000000000-000000000-1477"} +{"event_simpleName":"LogonBehaviorCompositionDetectInfo","TemplateInstanceId":"19717","aip":"192.0.2.2","LogonDomain":"WIN-HOST-01","RemoteAccount":"0","event_platform":"Win","PatternId":"10199","EventOrigin":"1","id":"34376fb6-4e59-4a1f-8fba-dac1fd55fe34","EffectiveTransmissionClass":"3","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ConfigStateHash":"318902667","TemplateDisposition":"10","ContextProcessId":"21475403566","LogonType":"2","AuthenticationId":"745263870","ConfigBuild":"1007.3.0020907.15","CommandLine":"System","ImageFileName":"System","Entitlements":"15","name":"LogonBehaviorCompositionDetectInfoV2","ComputerName":"WIN-HOST-01","PatternIdList":"7149,7212,8111","RemoteAddressIP4":"127.0.0.1","aid":"1a9dad0d78b44af9a1bee299862e7b4d","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"NetworkContainmentCompleted","Status":"0","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1780488158.763","ConfigStateHash":"2473141737","CloudRequestId":"201ba0eb-161d-4a37-99bd-4e0d8865b183","aip":"192.0.2.2","ConfigBuild":"1007.3.0020805.15","event_platform":"Win","Entitlements":"15","name":"NetworkContainmentCompletedV1","EventOrigin":"17","ComputerName":"WIN-HOST-01","id":"a3277aa2-a123-41d5-86bd-e6fad46f35a4","EffectiveTransmissionClass":"0","aid":"cbaab7c6e77c44099fd72d81073f9883","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"FirewallRuleIP4Matched","RuleAction":"1","aip":"192.0.2.2","RuleMatchCount":"1","event_platform":"Win","EventOrigin":"17","id":"23205a0d-b279-4527-9355-65506561b8ce","Protocol":"17","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"224.0.0.251","ContextTimeStamp":"1780377915.226","RuleMatchCountSinceLastReport":"16681","ConfigStateHash":"765810426","ContextProcessId":"13002244","RemotePort":"5353","HbfwRuleId":"3","NetworkInterfaceGuid":"00796106-8fee-442e-90ea-956af504c46d","ConfigBuild":"1007.3.0020907.15","NetworkProfile":"2","CommandLine":"C:\\Windows\\system32\\svchost.exe -k NetworkService -p","PolicyIdentifier":"f7ee517b-ff8f-4f51-ad8e-6f134f19f617","LocalPort":"5353","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","Entitlements":"15","name":"FirewallRuleIP4MatchedV6","ComputerName":"WIN-HOST-01","HbfwRuleFlags":"7","aid":"460f573fda4744708f60437e2484a38c","RemoteAddressIP4":"192.0.2.20","ConnectionDirection":"1","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"ProvisioningStarted","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781348370.024","ConfigStateHash":"386343172","aip":"192.0.2.2","ConfigBuild":"0.3.0020907.15","event_platform":"Win","AgentLoadFlags":"17","Entitlements":"15","name":"ProvisioningStartedV1","ComputerName":"WIN-HOST-01","id":"3b430dcb-dcef-4a8d-b85a-42f9c49c66de","EffectiveTransmissionClass":"0","aid":"1a9dad0d78b44af9a1bee299862e7b4d","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"SensorSelfDiagnosticTelemetry","aip":"192.0.2.2","MigoTemplateInstanceVersion":"8","event_platform":"Win","MigoTemplateId":"307","EventOrigin":"1","id":"ececeff9-9999-45ea-8a62-c620f9475548","MigoTemplateInstanceId":"15724","EffectiveTransmissionClass":"3","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781758031.318","ConfigStateHash":"4108388545","DiagnosticRunId":"34207803-666a-f111-b253-8cc6813d0f30","DiagnosticResultContext":"24:PPU","DiagnosticTriggerContext":"Scheduled","ConfigBuild":"1007.3.0020907.15","DiagnosticRunType":"0","Entitlements":"15","name":"SensorSelfDiagnosticTelemetryV1","ComputerName":"WIN-HOST-01","aid":"6e3d57c5d4dc483dac3628aee2ca62a9","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"XumdHookEvent","BaseModuleName":"samcli.dll","CommandLine":"C:\\Program Files\\Example\\app.exe","ComputerName":"WIN-HOST-01","ConfigBuild":"1007.3.0021003.15","ConfigStateHash":"3477107385","ContextProcessId":"160872222276","ContextTimeStamp":"1783594027.300","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\Example\\app.exe","LocalAddressIP4":"192.0.2.10","ModuleExportName":"NetUserGetInfo","PatternId":"10448","PatternIdList":"446,7106,8111","TemplateInstanceId":"17594","aid":"9fa290eb9c64449490d17a85801c6ebf","aip":"192.0.2.3","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Win","id":"7e857013-5bc5-4d68-9e08-6f30b8b50ccc","name":"XumdHookEventV3","timestamp":"1743508799999"} diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json index be24e63f3ea..6725d257f3c 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json @@ -10875,7 +10875,12 @@ ], "created": "2025-08-18T18:31:22.619Z", "id": "9c458f-ddfe1293cd-56445b2c4-3d0a0ef4|bae5bafaeb93295d398bf55b8ba1cf01|4092825518eaf67377a6e4492ae44577", - "original": "{\"event_simpleName\":\"MotwWritten\",\"ConfigStateHash\":\"0222222222\",\"ContextProcessId\":\"1111111111\",\"aip\":\"89.160.20.128\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"HostUrl\":\"\",\"Entitlements\":\"15\",\"name\":\"MotwWrittenV2\",\"EventOrigin\":\"1\",\"ReferrerUrl\":\"\",\"id\":\"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"timestamp\":\"1755541882619\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\Device\\\\Local\\\\Default\\\\Files\\\\asdf-ghkl\"}" + "kind": "event", + "original": "{\"event_simpleName\":\"MotwWritten\",\"ConfigStateHash\":\"0222222222\",\"ContextProcessId\":\"1111111111\",\"aip\":\"89.160.20.128\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"HostUrl\":\"\",\"Entitlements\":\"15\",\"name\":\"MotwWrittenV2\",\"EventOrigin\":\"1\",\"ReferrerUrl\":\"\",\"id\":\"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"timestamp\":\"1755541882619\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\Device\\\\Local\\\\Default\\\\Files\\\\asdf-ghkl\"}", + "outcome": "success", + "type": [ + "creation" + ] }, "file": { "directory": "\\Device\\Local\\Default\\Files", @@ -11696,6 +11701,857 @@ "tags": [ "preserve_original_event" ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "3995347011", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "17", + "IdpPerfCounterMaximum": 95629312, + "IdpPerfCounterMinimum": 95531008, + "IdpPerfCounterPath": "\\Process(lsass)\\Working Set", + "IdpPerfCounterSum": 2868150272, + "IdpPerfSampleCount": 30, + "IdpPerfSampleDuration": "2999997209", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "IdpDcPerfReport", + "id": "11633f5f-6a9c-4a6a-a39b-f01bce8a2f37", + "name": "IdpDcPerfReportV1" + }, + "device": { + "id": "3f4218d0c561464c9ef5d1c81000fc38" + }, + "event": { + "action": "IdpDcPerfReport", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "11633f5f-6a9c-4a6a-a39b-f01bce8a2f37|3f4218d0c561464c9ef5d1c81000fc38|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"IdpDcPerfReport\",\"LocalAddressIP4\":\"192.0.2.10\",\"ConfigStateHash\":\"3995347011\",\"IdpPerfCounterPath\":\"\\\\Process(lsass)\\\\Working Set\",\"aip\":\"192.0.2.1\",\"IdpPerfSampleDuration\":\"2999997209\",\"IdpPerfCounterMaximum\":\"95629312\",\"IdpPerfSampleCount\":\"30\",\"ConfigBuild\":\"1007.3.0021003.15\",\"event_platform\":\"Win\",\"IdpPerfCounterMinimum\":\"95531008\",\"Entitlements\":\"15\",\"name\":\"IdpDcPerfReportV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"WIN-HOST-01\",\"IdpPerfCounterSum\":\"2868150272\",\"id\":\"11633f5f-6a9c-4a6a-a39b-f01bce8a2f37\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"3f4218d0c561464c9ef5d1c81000fc38\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "3f4218d0c561464c9ef5d1c81000fc38", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.1" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.1" + ], + "serial_number": "3f4218d0c561464c9ef5d1c81000fc38", + "version": "1007.3.0021003.15" + }, + "related": { + "hash": [ + "3995347011" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.1", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AccountDomain": "EXAMPLE.LOCAL", + "AccountObjectGuid": "82b2a1e4-585d-4d47-8f55-19b76b14a66f", + "AccountObjectSid": "S-1-5-21-000000000-000000000-000000000-1477", + "ContextTimeStamp": "2026-06-04T12:23:17.000Z", + "SamAccountName": "SVC-ACCT$", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "ActiveDirectoryAccountCreated", + "id": "d1972344-dae4-4cd5-910c-fbd6d71d4431", + "name": "ActiveDirectoryAccountCreatedV1" + }, + "event": { + "action": "ActiveDirectoryAccountCreated", + "category": [ + "iam" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "d1972344-dae4-4cd5-910c-fbd6d71d4431||2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"ActiveDirectoryAccountCreated\",\"SamAccountName\":\"SVC-ACCT$\",\"ContextTimeStamp\":\"1780575797.000\",\"AccountDomain\":\"EXAMPLE.LOCAL\",\"aip\":\"\",\"event_platform\":\"Win\",\"name\":\"ActiveDirectoryAccountCreatedV1\",\"id\":\"d1972344-dae4-4cd5-910c-fbd6d71d4431\",\"AccountObjectGuid\":\"82b2a1e4-585d-4d47-8f55-19b76b14a66f\",\"aid\":\"\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"AccountObjectSid\":\"S-1-5-21-000000000-000000000-000000000-1477\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "host": { + "os": { + "type": "windows" + } + }, + "related": { + "user": [ + "SVC-ACCT$", + "S-1-5-21-000000000-000000000-000000000-1477" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "EXAMPLE.LOCAL", + "id": "S-1-5-21-000000000-000000000-000000000-1477", + "name": "SVC-ACCT$" + } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "745263870", + "ConfigStateHash": "318902667", + "ContextProcessId": "21475403566", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "LogonType": "2", + "PatternId": "10199", + "PatternIdList": [ + "7149", + "7212", + "8111" + ], + "RemoteAccount": "0", + "TemplateDisposition": "10", + "TemplateInstanceId": "19717", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "LogonBehaviorCompositionDetectInfo", + "id": "34376fb6-4e59-4a1f-8fba-dac1fd55fe34", + "name": "LogonBehaviorCompositionDetectInfoV2" + }, + "destination": { + "address": "127.0.0.1", + "ip": "127.0.0.1" + }, + "device": { + "id": "1a9dad0d78b44af9a1bee299862e7b4d" + }, + "event": { + "action": "LogonBehaviorCompositionDetectInfo", + "category": [ + "session" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "34376fb6-4e59-4a1f-8fba-dac1fd55fe34|1a9dad0d78b44af9a1bee299862e7b4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"LogonBehaviorCompositionDetectInfo\",\"TemplateInstanceId\":\"19717\",\"aip\":\"192.0.2.2\",\"LogonDomain\":\"WIN-HOST-01\",\"RemoteAccount\":\"0\",\"event_platform\":\"Win\",\"PatternId\":\"10199\",\"EventOrigin\":\"1\",\"id\":\"34376fb6-4e59-4a1f-8fba-dac1fd55fe34\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ConfigStateHash\":\"318902667\",\"TemplateDisposition\":\"10\",\"ContextProcessId\":\"21475403566\",\"LogonType\":\"2\",\"AuthenticationId\":\"745263870\",\"ConfigBuild\":\"1007.3.0020907.15\",\"CommandLine\":\"System\",\"ImageFileName\":\"System\",\"Entitlements\":\"15\",\"name\":\"LogonBehaviorCompositionDetectInfoV2\",\"ComputerName\":\"WIN-HOST-01\",\"PatternIdList\":\"7149,7212,8111\",\"RemoteAddressIP4\":\"127.0.0.1\",\"aid\":\"1a9dad0d78b44af9a1bee299862e7b4d\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "domain": "WIN-HOST-01", + "hostname": "WIN-HOST-01", + "id": "1a9dad0d78b44af9a1bee299862e7b4d", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "1a9dad0d78b44af9a1bee299862e7b4d", + "version": "1007.3.0020907.15" + }, + "process": { + "args": [ + "System" + ], + "args_count": 1, + "command_line": "System", + "entity_id": "21475403566", + "executable": "System", + "name": "System" + }, + "related": { + "hash": [ + "318902667" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10", + "127.0.0.1" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "CloudRequestId": "201ba0eb-161d-4a37-99bd-4e0d8865b183", + "ConfigStateHash": "2473141737", + "ContextTimeStamp": "2026-06-03T12:02:38.763Z", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "EventOrigin": "17", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "Status": "0", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "NetworkContainmentCompleted", + "id": "a3277aa2-a123-41d5-86bd-e6fad46f35a4", + "name": "NetworkContainmentCompletedV1" + }, + "device": { + "id": "cbaab7c6e77c44099fd72d81073f9883" + }, + "event": { + "action": "NetworkContainmentCompleted", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "a3277aa2-a123-41d5-86bd-e6fad46f35a4|cbaab7c6e77c44099fd72d81073f9883|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"NetworkContainmentCompleted\",\"Status\":\"0\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1780488158.763\",\"ConfigStateHash\":\"2473141737\",\"CloudRequestId\":\"201ba0eb-161d-4a37-99bd-4e0d8865b183\",\"aip\":\"192.0.2.2\",\"ConfigBuild\":\"1007.3.0020805.15\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"NetworkContainmentCompletedV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"WIN-HOST-01\",\"id\":\"a3277aa2-a123-41d5-86bd-e6fad46f35a4\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"cbaab7c6e77c44099fd72d81073f9883\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "connection" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "cbaab7c6e77c44099fd72d81073f9883", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "cbaab7c6e77c44099fd72d81073f9883", + "version": "1007.3.0020805.15" + }, + "related": { + "hash": [ + "2473141737" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "765810426", + "ContextProcessId": "13002244", + "ContextTimeStamp": "2026-06-02T05:25:15.226Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "17", + "HbfwRuleFlags": "7", + "HbfwRuleId": "3", + "LocalAddressIP4": [ + "224.0.0.251" + ], + "NetworkInterfaceGuid": "00796106-8fee-442e-90ea-956af504c46d", + "NetworkProfile": "2", + "PolicyIdentifier": "f7ee517b-ff8f-4f51-ad8e-6f134f19f617", + "RuleAction": "1", + "RuleMatchCount": 1, + "RuleMatchCountSinceLastReport": 16681, + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "FirewallRuleIP4Matched", + "id": "23205a0d-b279-4527-9355-65506561b8ce", + "name": "FirewallRuleIP4MatchedV6" + }, + "destination": { + "address": "224.0.0.251", + "ip": "224.0.0.251", + "port": 5353 + }, + "device": { + "id": "460f573fda4744708f60437e2484a38c" + }, + "event": { + "action": "FirewallRuleIP4Matched", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "23205a0d-b279-4527-9355-65506561b8ce|460f573fda4744708f60437e2484a38c|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"FirewallRuleIP4Matched\",\"RuleAction\":\"1\",\"aip\":\"192.0.2.2\",\"RuleMatchCount\":\"1\",\"event_platform\":\"Win\",\"EventOrigin\":\"17\",\"id\":\"23205a0d-b279-4527-9355-65506561b8ce\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"224.0.0.251\",\"ContextTimeStamp\":\"1780377915.226\",\"RuleMatchCountSinceLastReport\":\"16681\",\"ConfigStateHash\":\"765810426\",\"ContextProcessId\":\"13002244\",\"RemotePort\":\"5353\",\"HbfwRuleId\":\"3\",\"NetworkInterfaceGuid\":\"00796106-8fee-442e-90ea-956af504c46d\",\"ConfigBuild\":\"1007.3.0020907.15\",\"NetworkProfile\":\"2\",\"CommandLine\":\"C:\\\\Windows\\\\system32\\\\svchost.exe -k NetworkService -p\",\"PolicyIdentifier\":\"f7ee517b-ff8f-4f51-ad8e-6f134f19f617\",\"LocalPort\":\"5353\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\svchost.exe\",\"Entitlements\":\"15\",\"name\":\"FirewallRuleIP4MatchedV6\",\"ComputerName\":\"WIN-HOST-01\",\"HbfwRuleFlags\":\"7\",\"aid\":\"460f573fda4744708f60437e2484a38c\",\"RemoteAddressIP4\":\"192.0.2.20\",\"ConnectionDirection\":\"1\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "460f573fda4744708f60437e2484a38c", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "network": { + "community_id": "1:0AEopPSKSJS3LgYrhamC7npNkJc=", + "direction": "inbound", + "iana_number": "17", + "transport": "udp" + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "460f573fda4744708f60437e2484a38c", + "version": "1007.3.0020907.15" + }, + "process": { + "args": [ + "C:\\Windows\\system32\\svchost.exe", + "-k", + "NetworkService", + "-p" + ], + "args_count": 4, + "command_line": "C:\\Windows\\system32\\svchost.exe -k NetworkService -p", + "entity_id": "13002244", + "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe", + "name": "svchost.exe" + }, + "related": { + "hash": [ + "765810426" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "224.0.0.251", + "192.0.2.20" + ] + }, + "source": { + "address": "192.0.2.20", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.20", + "port": 5353 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AgentLoadFlags": "17", + "ConfigStateHash": "386343172", + "ContextTimeStamp": "2026-06-13T10:59:30.024Z", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "ProvisioningStarted", + "id": "3b430dcb-dcef-4a8d-b85a-42f9c49c66de", + "name": "ProvisioningStartedV1" + }, + "device": { + "id": "1a9dad0d78b44af9a1bee299862e7b4d" + }, + "event": { + "action": "ProvisioningStarted", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "3b430dcb-dcef-4a8d-b85a-42f9c49c66de|1a9dad0d78b44af9a1bee299862e7b4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"ProvisioningStarted\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781348370.024\",\"ConfigStateHash\":\"386343172\",\"aip\":\"192.0.2.2\",\"ConfigBuild\":\"0.3.0020907.15\",\"event_platform\":\"Win\",\"AgentLoadFlags\":\"17\",\"Entitlements\":\"15\",\"name\":\"ProvisioningStartedV1\",\"ComputerName\":\"WIN-HOST-01\",\"id\":\"3b430dcb-dcef-4a8d-b85a-42f9c49c66de\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"1a9dad0d78b44af9a1bee299862e7b4d\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "1a9dad0d78b44af9a1bee299862e7b4d", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "1a9dad0d78b44af9a1bee299862e7b4d", + "version": "0.3.0020907.15" + }, + "related": { + "hash": [ + "386343172" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4108388545", + "ContextTimeStamp": "2026-06-18T04:47:11.318Z", + "DiagnosticResultContext": "24:PPU", + "DiagnosticRunId": "34207803-666a-f111-b253-8cc6813d0f30", + "DiagnosticRunType": "0", + "DiagnosticTriggerContext": "Scheduled", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "MigoTemplateId": "307", + "MigoTemplateInstanceId": "15724", + "MigoTemplateInstanceVersion": "8", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "SensorSelfDiagnosticTelemetry", + "id": "ececeff9-9999-45ea-8a62-c620f9475548", + "name": "SensorSelfDiagnosticTelemetryV1" + }, + "device": { + "id": "6e3d57c5d4dc483dac3628aee2ca62a9" + }, + "event": { + "action": "SensorSelfDiagnosticTelemetry", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "ececeff9-9999-45ea-8a62-c620f9475548|6e3d57c5d4dc483dac3628aee2ca62a9|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"SensorSelfDiagnosticTelemetry\",\"aip\":\"192.0.2.2\",\"MigoTemplateInstanceVersion\":\"8\",\"event_platform\":\"Win\",\"MigoTemplateId\":\"307\",\"EventOrigin\":\"1\",\"id\":\"ececeff9-9999-45ea-8a62-c620f9475548\",\"MigoTemplateInstanceId\":\"15724\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781758031.318\",\"ConfigStateHash\":\"4108388545\",\"DiagnosticRunId\":\"34207803-666a-f111-b253-8cc6813d0f30\",\"DiagnosticResultContext\":\"24:PPU\",\"DiagnosticTriggerContext\":\"Scheduled\",\"ConfigBuild\":\"1007.3.0020907.15\",\"DiagnosticRunType\":\"0\",\"Entitlements\":\"15\",\"name\":\"SensorSelfDiagnosticTelemetryV1\",\"ComputerName\":\"WIN-HOST-01\",\"aid\":\"6e3d57c5d4dc483dac3628aee2ca62a9\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "6e3d57c5d4dc483dac3628aee2ca62a9", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "6e3d57c5d4dc483dac3628aee2ca62a9", + "version": "1007.3.0020907.15" + }, + "related": { + "hash": [ + "4108388545" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "BaseModuleName": "samcli.dll", + "ConfigStateHash": "3477107385", + "ContextProcessId": "160872222276", + "ContextTimeStamp": "2026-07-09T10:47:07.300Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "ModuleExportName": "NetUserGetInfo", + "PatternId": "10448", + "PatternIdList": [ + "446", + "7106", + "8111" + ], + "TemplateInstanceId": "17594", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "XumdHookEvent", + "id": "7e857013-5bc5-4d68-9e08-6f30b8b50ccc", + "name": "XumdHookEventV3" + }, + "device": { + "id": "9fa290eb9c64449490d17a85801c6ebf" + }, + "event": { + "action": "XumdHookEvent", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "7e857013-5bc5-4d68-9e08-6f30b8b50ccc|9fa290eb9c64449490d17a85801c6ebf|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"XumdHookEvent\",\"BaseModuleName\":\"samcli.dll\",\"CommandLine\":\"C:\\\\Program Files\\\\Example\\\\app.exe\",\"ComputerName\":\"WIN-HOST-01\",\"ConfigBuild\":\"1007.3.0021003.15\",\"ConfigStateHash\":\"3477107385\",\"ContextProcessId\":\"160872222276\",\"ContextTimeStamp\":\"1783594027.300\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\Example\\\\app.exe\",\"LocalAddressIP4\":\"192.0.2.10\",\"ModuleExportName\":\"NetUserGetInfo\",\"PatternId\":\"10448\",\"PatternIdList\":\"446,7106,8111\",\"TemplateInstanceId\":\"17594\",\"aid\":\"9fa290eb9c64449490d17a85801c6ebf\",\"aip\":\"192.0.2.3\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Win\",\"id\":\"7e857013-5bc5-4d68-9e08-6f30b8b50ccc\",\"name\":\"XumdHookEventV3\",\"timestamp\":\"1743508799999\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "9fa290eb9c64449490d17a85801c6ebf", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "9fa290eb9c64449490d17a85801c6ebf", + "version": "1007.3.0021003.15" + }, + "process": { + "args": [ + "C:\\Program", + "Files\\Example\\app.exe" + ], + "args_count": 2, + "command_line": "C:\\Program Files\\Example\\app.exe", + "entity_id": "160872222276", + "executable": "\\Device\\HarddiskVolume3\\Program Files\\Example\\app.exe", + "name": "app.exe" + }, + "related": { + "hash": [ + "3477107385" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] } ] } diff --git a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml index e4e109d3797..935588402dd 100644 --- a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml +++ b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml @@ -11,6 +11,13 @@ processors: description: Categorize events. tag: categorize_events_6b04e496 params: + AbnormalTerminationNotification: + category: + - process + kind: event + outcome: success + type: + - end AcUninstallConfirmation: category: - package @@ -25,6 +32,128 @@ processors: outcome: success type: - deletion + ActiveDirectoryAccountCreated: + category: + - iam + kind: event + outcome: success + type: + - creation + ActiveDirectoryAccountDepartmentUpdate: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountDirectContainingGroupEntitiesUpdate: + category: + - iam + kind: event + outcome: success + type: + - change + - group + ActiveDirectoryAccountDisabled: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountEnabled: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountFlattenedContainingGroupEntitiesUpdate: + category: + - iam + kind: event + outcome: success + type: + - change + - group + ActiveDirectoryAccountLocked: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountNameUpdate: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountOuUpdate: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountPasswordUpdate: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountUnlocked: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAuditGpoModified: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAuditGroupMemberModified: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change + - group + ActiveDirectoryAuditGroupModified: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change + - group + ActiveDirectoryAuditPasswordModificationAttempt: + category: + - authentication + - iam + kind: event + outcome: unknown + type: + - info + ActiveDirectoryAuditUserModified: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change + - user ActiveDirectoryAuthentication: category: - authentication @@ -137,6 +266,13 @@ processors: outcome: success type: - creation + ArcFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation AsepFileChange: category: - file @@ -197,6 +333,13 @@ processors: type: - connection - creation + BPFCommandIssued: + category: + - process + kind: event + outcome: success + type: + - info BZip2FileWritten: category: - file @@ -218,6 +361,13 @@ processors: outcome: unknown type: - info + BlfFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation BmpFileWritten: category: - file @@ -254,6 +404,13 @@ processors: outcome: unknown type: - info + ChannelVersionRequired: + category: + - configuration + kind: event + outcome: unknown + type: + - info ClassifiedModuleLoad: category: - library @@ -289,6 +446,13 @@ processors: outcome: unknown type: - change + ConfigurationProvisioningState: + category: + - configuration + kind: event + outcome: unknown + type: + - info CrashNotification: category: - host @@ -310,6 +474,21 @@ processors: outcome: success type: - change + CreateSocket: + category: + - network + kind: event + outcome: success + type: + - start + - connection + CreateThreadKernelNoStartImage: + category: + - process + kind: event + outcome: success + type: + - start CreateThreadNoStartImage: category: - process @@ -367,6 +546,13 @@ processors: outcome: unknown type: - info + DBusMessage: + category: + - configuration + kind: event + outcome: unknown + type: + - info DCSyncAttempted: category: - configuration @@ -375,6 +561,13 @@ processors: outcome: unknown type: - access + DNSRequestDetectInfo: + category: + - network + kind: event + outcome: unknown + type: + - info DataEgressEnriched: category: - file @@ -382,6 +575,20 @@ processors: outcome: unknown type: - info + DcBluetoothAuthorizationStatus: + category: + - driver + kind: event + outcome: unknown + type: + - info + DcBluetoothDeviceBlocked: + category: + - driver + kind: event + outcome: unknown + type: + - info DcBluetoothDeviceConnected: category: - driver @@ -389,6 +596,41 @@ processors: outcome: unknown type: - start + DcBluetoothDeviceConnectedDetails: + category: + - driver + kind: event + outcome: unknown + type: + - info + DcBluetoothDeviceDisconnected: + category: + - driver + kind: event + outcome: unknown + type: + - end + DcBluetoothDevicePolicyViolation: + category: + - driver + kind: event + outcome: unknown + type: + - info + DcBluetoothDeviceProperties: + category: + - driver + kind: state + outcome: unknown + type: + - info + DcIdentification: + category: + - driver + kind: event + outcome: success + type: + - info DcOffline: category: - iam @@ -403,6 +645,34 @@ processors: outcome: success type: - info + DcRemovableStorageDeviceBlocked: + category: + - driver + kind: event + outcome: unknown + type: + - info + DcRemovableStorageDeviceConnected: + category: + - driver + kind: event + outcome: unknown + type: + - start + DcRemovableStorageDeviceDisconnected: + category: + - driver + kind: event + outcome: unknown + type: + - end + DcRemovableStorageDevicePolicyViolation: + category: + - driver + kind: event + outcome: unknown + type: + - info DcStatus: category: - iam @@ -417,6 +687,13 @@ processors: outcome: unknown type: - info + DcUsbDeviceBlocked: + category: + - driver + kind: event + outcome: unknown + type: + - info DcUsbDeviceConnected: category: - driver @@ -431,6 +708,20 @@ processors: outcome: unknown type: - end + DcUsbDevicePolicyViolation: + category: + - driver + kind: event + outcome: unknown + type: + - info + DcUsbDeviceWhitelisted: + category: + - driver + kind: event + outcome: unknown + type: + - change DcUsbEndpointDescriptor: category: - driver @@ -452,14 +743,21 @@ processors: outcome: unknown type: - info - DeliverLocalFXToCloud: + DebFileWritten: category: - file kind: event - outcome: unknown + outcome: success type: - - info - DetectAnalysis: + - creation + DeliverLocalFXToCloud: + category: + - file + kind: event + outcome: unknown + type: + - info + DetectAnalysis: category: - malware kind: alert @@ -488,6 +786,13 @@ processors: outcome: unknown type: - info + DiskUtilization: + category: + - host + kind: state + outcome: unknown + type: + - info DllInjection: category: - process @@ -531,6 +836,27 @@ processors: outcome: success type: - start + DriverLoadBlocked: + category: + - driver + kind: event + outcome: unknown + type: + - info + DriverPreventFailed: + category: + - driver + kind: event + outcome: failure + type: + - info + DriverPreventionStatus: + category: + - driver + kind: state + outcome: unknown + type: + - info DwgFileWritten: category: - file @@ -573,6 +899,13 @@ processors: outcome: failure type: - info + EseFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation EtwComponentResponse: category: - host @@ -666,6 +999,13 @@ processors: outcome: success type: - change + FileSystemContainmentStatus: + category: + - file + kind: state + outcome: unknown + type: + - info FileSystemOperationBlocked: category: - file @@ -748,6 +1088,28 @@ processors: outcome: success type: - change + FirewallRuleApplicationFailed: + category: + - network + - configuration + kind: event + outcome: failure + type: + - info + FirewallRuleIP4Matched: + category: + - network + kind: event + outcome: success + type: + - info + FirewallRuleIP6Matched: + category: + - network + kind: event + outcome: success + type: + - info FirewallSetRule: category: - configuration @@ -923,6 +1285,146 @@ processors: outcome: success type: - change + IdpCloudHealthCheck: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpCloudHealthConfigurationsGetResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpCloudHealthConfigurationsSetResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpCloudHealthStatus: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpConnectionsOverloadNotification: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpContainerRestarted: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpDcPerfReport: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpDcTiConfiguration: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpIdaasCorrelate: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpPacketDiversionConnectionsOverloadNotification: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpPacketDiversionLdapsConnectionsOverloadNotification: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpPolicyAccessRuleMatch: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpTelemetryData: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogConfigurationsGetResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogConfigurationsSetResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogReEnabled: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogRemediationActionRequest: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogRemediationActionTaken: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogRemediationActionTakenForCpu: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogRemediationActionTakenForMemory: + category: + - configuration + kind: event + outcome: unknown + type: + - info ImageHash: category: - library @@ -930,6 +1432,13 @@ processors: outcome: success type: - start + ImgExtensionFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation InjectedThread: category: - process @@ -1105,6 +1614,13 @@ processors: outcome: unknown type: - info + LnkFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation LocalIpAddressIP4: category: - configuration @@ -1152,6 +1668,13 @@ processors: outcome: unknown type: - creation + LogonBehaviorCompositionDetectInfo: + category: + - session + kind: event + outcome: unknown + type: + - info LsassHandleFromUnsignedModule: category: - process @@ -1218,6 +1741,50 @@ processors: type: - change - creation + MemoryAdvise: + category: + - process + kind: event + outcome: unknown + type: + - info + MemoryLocked: + category: + - process + kind: event + outcome: unknown + type: + - info + MemoryMapped: + category: + - process + kind: event + outcome: unknown + type: + - info + MemoryProtectionChanged: + category: + - process + - configuration + kind: event + outcome: success + type: + - change + MemoryProtectionUpdated: + category: + - process + - configuration + kind: event + outcome: success + type: + - change + MemoryScanEnabled: + category: + - configuration + kind: state + outcome: success + type: + - info ModifyServiceBinary: category: - file @@ -1257,6 +1824,20 @@ processors: outcome: unknown type: - info + ModuleLoadV3DetectInfo: + category: + - library + kind: event + outcome: unknown + type: + - start + MotwWritten: + category: + - file + kind: event + outcome: success + type: + - creation MountedVolume: category: - file @@ -1264,11 +1845,18 @@ processors: outcome: success type: - info - MsiTransactionExecuted: + MsiFileWritten: category: - - package + - file kind: event - outcome: unknown + outcome: success + type: + - creation + MsiTransactionExecuted: + category: + - package + kind: event + outcome: unknown type: - installation NeighborListIP4: @@ -1340,6 +1928,29 @@ processors: type: - start - connection + NetworkContainmentCompleted: + category: + - network + kind: event + outcome: success + type: + - connection + NetworkLinkConfigGetAddress: + category: + - network + - configuration + kind: event + outcome: success + type: + - info + NetworkLinkConfigGetLink: + category: + - network + - configuration + kind: event + outcome: success + type: + - info NetworkListenIP4: category: - network @@ -1372,6 +1983,13 @@ processors: - allowed - access - connection + NetworkUncontainmentCompleted: + category: + - network + kind: event + outcome: success + type: + - connection NewExecutableRenamed: category: - file @@ -1393,6 +2011,55 @@ processors: outcome: success type: - creation + OciContainerComplianceInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciContainerEngineInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciContainerHeartbeat: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciContainerInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciContainerPlumbingSummary: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciContainerStarted: + category: + - configuration + kind: event + outcome: success + type: + - creation + OciContainerStopped: + category: + - configuration + kind: event + outcome: success + type: + - deletion OciContainerTelemetry: category: - host @@ -1400,6 +2067,20 @@ processors: outcome: unknown type: - info + OciImageHeartbeat: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciImageInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info OleFileWritten: category: - file @@ -1453,6 +2134,13 @@ processors: outcome: success type: - info + PackageManagerDownloadComplete: + category: + - file + kind: event + outcome: success + type: + - creation PackedExecutableWritten: category: - file @@ -1460,6 +2148,22 @@ processors: outcome: success type: - creation + PacketDiversionConnectionsOverloadConfigurationResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info + PacketFilterAttached: + category: + - configuration + - network + kind: event + outcome: success + type: + - change + - info PdfFileWritten: category: - file @@ -1495,6 +2199,20 @@ processors: outcome: success type: - creation + PodInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info + PodProductConfig: + category: + - configuration + kind: state + outcome: unknown + type: + - info PrivilegedProcessHandleFromUnsignedModule: category: - process @@ -1569,6 +2287,13 @@ processors: outcome: success type: - end + ProcessSignal: + category: + - process + kind: event + outcome: unknown + type: + - info ProcessSubstituteUser: category: - iam @@ -1577,6 +2302,13 @@ processors: outcome: unknown type: - change + ProcessTrace: + category: + - process + kind: event + outcome: unknown + type: + - info PromiscuousBindIP4: category: - host @@ -1584,6 +2316,34 @@ processors: outcome: success type: - change + ProvisioningChannelVersionRequired: + category: + - configuration + kind: event + outcome: unknown + type: + - info + ProvisioningEnded: + category: + - configuration + kind: event + outcome: unknown + type: + - info + ProvisioningStarted: + category: + - configuration + kind: event + outcome: unknown + type: + - info + ProvisioningStatusUpdate: + category: + - configuration + kind: event + outcome: unknown + type: + - change PtActivationStatus: category: - host @@ -1591,6 +2351,13 @@ processors: outcome: unknown type: - info + PtyAttached: + category: + - process + kind: event + outcome: success + type: + - start PtyCreated: category: - file @@ -1598,6 +2365,20 @@ processors: outcome: success type: - creation + PtyDetached: + category: + - process + kind: event + outcome: success + type: + - end + PythonFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation QuarantineActionResult: category: - file @@ -1670,6 +2451,132 @@ processors: type: - start - connection + RecoveryActionDeleteFilesComplete: + category: + - file + kind: event + outcome: unknown + type: + - deletion + RecoveryActionDeleteFilesReply: + category: + - file + kind: event + outcome: unknown + type: + - deletion + RecoveryActionGetModuleTableRecordComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info + RecoveryActionGetRuntimeSystemTagsComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info + RecoveryActionGetSystemTagsComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info + RecoveryActionKillProcessesComplete: + category: + - process + kind: event + outcome: unknown + type: + - end + RecoveryActionKillProcessesReply: + category: + - process + kind: event + outcome: unknown + type: + - end + RecoveryActionManipulateModuleTableComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - change + RecoveryActionRegistryCreateKeyComplete: + category: + - registry + kind: event + outcome: unknown + type: + - creation + RecoveryActionRegistryCreateKeyReply: + category: + - registry + kind: event + outcome: unknown + type: + - creation + RecoveryActionRegistryDeleteKeyComplete: + category: + - registry + kind: event + outcome: unknown + type: + - deletion + RecoveryActionRegistryDeleteKeyReply: + category: + - registry + kind: event + outcome: unknown + type: + - deletion + RecoveryActionRegistryDeleteValueKeyComplete: + category: + - registry + kind: event + outcome: unknown + type: + - deletion + RecoveryActionRegistryDeleteValueKeyReply: + category: + - registry + kind: event + outcome: unknown + type: + - deletion + RecoveryActionRegistrySetValueKeyComplete: + category: + - registry + kind: event + outcome: unknown + type: + - change + RecoveryActionRegistrySetValueKeyReply: + category: + - registry + kind: event + outcome: unknown + type: + - change + RecoveryActionSetRuntimeSystemTagsComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info + RecoveryActionSetSystemTagsComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info ReflectiveDllOpenProcess: category: - process @@ -1679,60 +2586,166 @@ processors: - access ReflectiveDotnetModuleLoad: category: - - library + - library + kind: event + type: + - start + RegCrowdstrikeKeyUpdate: + category: + - registry + kind: event + outcome: success + type: + - change + RegCrowdstrikeValueUpdate: + category: + - registry + kind: event + outcome: success + type: + - change + RegGenericValueUpdate: + category: + - registry + kind: event + outcome: success + type: + - change + RegSystemConfigKeyUpdate: + category: + - registry + kind: event + outcome: success + type: + - change + RegSystemConfigValueUpdate: + category: + - registry + - host + - configuration + kind: event + outcome: success + type: + - change + RegisterRawInputDevicesEtw: + category: + - host + - configuration + kind: event + outcome: success + type: + - change + RegistryHiveFileWritten: + category: + - registry + - file + kind: event + outcome: success + type: + - creation + RegistryOperationDetectInfo: + category: + - registry + kind: alert + outcome: success + type: + - info + RemediationActionKillIP4Connection: + category: + - network + kind: event + outcome: unknown + type: + - end + RemediationActionKillIP6Connection: + category: + - network + kind: event + outcome: unknown + type: + - end + RemediationActionKillProcess: + category: + - process + kind: event + outcome: unknown + type: + - end + RemediationActionQuarantineFile: + category: + - file + kind: event + outcome: unknown + type: + - deletion + RemediationActionQuarantineMacroFile: + category: + - file + kind: event + outcome: unknown + type: + - deletion + RemediationActionQuarantineOfficeMacroFile: + category: + - file kind: event + outcome: unknown type: - - start - RegCrowdstrikeKeyUpdate: + - deletion + RemediationActionRegistryRemoval: category: - registry kind: event - outcome: success + outcome: unknown type: - - change - RegCrowdstrikeValueUpdate: + - deletion + RemediationActionScheduledTaskRemoval: category: - - registry + - configuration kind: event - outcome: success + outcome: unknown type: - - change - RegGenericValueUpdate: + - deletion + RemediationActionServiceRemoval: category: - - registry + - configuration kind: event - outcome: success + outcome: unknown type: - - change - RegSystemConfigKeyUpdate: + - deletion + RemediationMonitorKillProcess: category: - - registry + - process kind: event - outcome: success + outcome: unknown type: - - change - RegSystemConfigValueUpdate: + - info + RemediationMonitorQuarantineFile: + category: + - file + kind: event + outcome: unknown + type: + - info + RemediationMonitorRegistryRemoval: category: - registry - - host - - configuration kind: event - outcome: success + outcome: unknown type: - - change - RegisterRawInputDevicesEtw: + - info + RemediationMonitorScheduledTaskRemoval: category: - - host - configuration kind: event - outcome: success + outcome: unknown type: - - change - RegistryOperationDetectInfo: + - info + RemediationMonitorServiceRemoval: category: - - registry - kind: alert - outcome: success + - configuration + kind: event + outcome: unknown type: - info RemoteBruteForceDetectInfo: @@ -1743,6 +2756,13 @@ processors: outcome: success type: - info + RemoteCommandResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info RemovableDiskModuleLoadAttempt: category: - configuration @@ -1766,6 +2786,13 @@ processors: outcome: unknown type: - info + RootkitDetectionResponse: + category: + - process + kind: event + outcome: unknown + type: + - info RtfFileWritten: category: - file @@ -1834,6 +2861,13 @@ processors: outcome: unknown type: - info + ScriptControlDotNetMetadata: + category: + - process + kind: event + outcome: unknown + type: + - info ScriptControlErrorEvent: category: - malware @@ -1858,6 +2892,13 @@ processors: outcome: success type: - info + ScriptFileWrittenInfo: + category: + - file + kind: event + outcome: success + type: + - creation SensitiveWmiQuery: category: - process @@ -1871,6 +2912,20 @@ processors: kind: state type: - info + SensorEnteredSafemode: + category: + - configuration + kind: event + outcome: unknown + type: + - info + SensorGroupingTagsUpdate: + category: + - configuration + kind: event + outcome: success + type: + - change SensorHeartbeat: category: - package @@ -1878,12 +2933,40 @@ processors: outcome: success type: - info + SensorMetadataUpdate: + category: + - configuration + kind: event + outcome: unknown + type: + - change + SensorSelfDiagnosticAlert: + category: + - configuration + kind: event + outcome: unknown + type: + - info + SensorSelfDiagnosticTelemetry: + category: + - configuration + kind: event + outcome: unknown + type: + - info SensorSettingsUpdate: category: - configuration kind: event type: - change + SensorTampering: + category: + - configuration + kind: event + outcome: unknown + type: + - info ServiceStarted: category: - process @@ -1919,6 +3002,20 @@ processors: outcome: success type: - creation + SharedObjectLoaded: + category: + - library + kind: event + outcome: success + type: + - start + ShellCommandLineInfo: + category: + - process + kind: event + outcome: unknown + type: + - info SignInfoError: category: - file @@ -1986,6 +3083,27 @@ processors: outcome: success type: - change + SpotlightEntityBatch: + category: + - configuration + kind: event + outcome: unknown + type: + - info + SpotlightEntityBatchHeader: + category: + - configuration + kind: event + outcome: unknown + type: + - info + SpotlightEntitySystemState: + category: + - configuration + kind: event + outcome: unknown + type: + - info SudoCommandAttempt: category: - authentication @@ -2065,6 +3183,41 @@ processors: outcome: success type: - start + SyntheticProcessTrace: + category: + - process + kind: event + outcome: unknown + type: + - info + SyntheticSharedObjectLoaded: + category: + - library + kind: event + outcome: success + type: + - start + SyntheticSystemdServiceCreated: + category: + - configuration + kind: event + outcome: success + type: + - creation + SyntheticSystemdTimerCreated: + category: + - configuration + kind: event + outcome: success + type: + - creation + SyntheticVirtualMemoryArea: + category: + - process + kind: event + outcome: unknown + type: + - info SystemCapacity: category: - host @@ -2072,6 +3225,48 @@ processors: outcome: success type: - info + SystemdServiceCreated: + category: + - configuration + kind: event + outcome: success + type: + - creation + SystemdServiceDeleted: + category: + - configuration + kind: event + outcome: success + type: + - deletion + SystemdServicePropertiesChanged: + category: + - configuration + kind: event + outcome: success + type: + - change + SystemdTimerCreated: + category: + - configuration + kind: event + outcome: success + type: + - creation + SystemdTimerDeleted: + category: + - configuration + kind: event + outcome: success + type: + - deletion + SystemdTimerPropertiesChanged: + category: + - configuration + kind: event + outcome: success + type: + - change TarFileWritten: category: - file @@ -2211,6 +3406,14 @@ processors: outcome: success type: - deletion + UserAccountRemovedFromGroup: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change UserExceptionDEP: category: - process @@ -2226,6 +3429,24 @@ processors: outcome: success type: - change + UserGroupCreated: + category: + - configuration + - iam + kind: event + outcome: success + type: + - creation + - group + UserGroupDeleted: + category: + - configuration + - iam + kind: event + outcome: success + type: + - deletion + - group UserIdentity: category: - authentication @@ -2263,6 +3484,13 @@ processors: outcome: failure type: - start + VirtualMemoryArea: + category: + - process + kind: event + outcome: unknown + type: + - info VolumeSnapshotCreated: category: - file @@ -2277,6 +3505,13 @@ processors: outcome: success type: - deletion + WebScriptFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation WfpFilterTamperingFilterAdded: category: - configuration @@ -2326,6 +3561,13 @@ processors: outcome: success type: - creation + XumdHookEvent: + category: + - process + kind: event + outcome: unknown + type: + - info XumdStatus: category: - host diff --git a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml index 78049e5661a..34d0686ff49 100644 --- a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml +++ b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml @@ -1600,6 +1600,24 @@ processors: field: user.domain copy_from: crowdstrike.SourceAccountDomain ignore_empty_value: true + - set: + tag: set_user_name_0d315d08 + if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') && ctx.user?.name == null + field: user.name + copy_from: crowdstrike.SamAccountName + ignore_empty_value: true + - set: + tag: set_user_id_0da27179 + if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') && ctx.user?.id == null + field: user.id + copy_from: crowdstrike.AccountObjectSid + ignore_empty_value: true + - set: + tag: set_user_domain_bc24f2dc + if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') && ctx.user?.domain == null + field: user.domain + copy_from: crowdstrike.AccountDomain + ignore_empty_value: true - set: tag: set_user_name_d3e6a828 if: ctx.event?.action == 'TokenImpersonated' @@ -1971,36 +1989,36 @@ processors: # DNS fields. - set: tag: set_dns_type_2198a4ce - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.event.action.toLowerCase().contains('dnsrequest') field: dns.type value: query - set: tag: set_network_protocol_6995faae - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.event.action.toLowerCase().contains('dnsrequest') field: network.protocol value: dns - registered_domain: tag: registered_domain_crowdstrike_DomainName_into_dns_question_8498515b - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.event.action.toLowerCase().contains('dnsrequest') field: crowdstrike.DomainName target_field: dns.question ignore_missing: true - rename: tag: rename_dns_question_domain_to_dns_question_name_699a0f98 - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.event.action.toLowerCase().contains('dnsrequest') field: dns.question.domain target_field: dns.question.name ignore_missing: true - rename: tag: rename_crowdstrike_DomainName_to_dns_question_name_5cc610bf - if: ctx.event?.action != null && ctx.dns?.question?.name == null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.dns?.question?.name == null && ctx.event.action.toLowerCase().contains('dnsrequest') field: crowdstrike.DomainName target_field: dns.question.name ignore_missing: true - script: description: Map decimal DNS request type to its name. tag: dns_request_type_to_name_d668973b - if: ctx.event?.action != null && ctx.crowdstrike?.RequestType != null && !ctx.crowdstrike.RequestType.isEmpty() && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.crowdstrike?.RequestType != null && !ctx.crowdstrike.RequestType.isEmpty() && ctx.event.action.toLowerCase().contains('dnsrequest') params: "1": A "2": NS @@ -2371,6 +2389,11 @@ processors: field: crowdstrike.GrandparentProcessPatternIdList separator: ',' ignore_missing: true + - split: + tag: split_crowdstrike_SessionPatternIdList_526a5d25 + field: crowdstrike.SessionPatternIdList + separator: ',' + ignore_missing: true - script: tag: set_browser_extension_install_method_value_ac2ab447 if: ctx.crowdstrike?.BrowserExtensionInstallMethod != null diff --git a/packages/crowdstrike/data_stream/fdr/fields/fields.yml b/packages/crowdstrike/data_stream/fdr/fields/fields.yml index 21b9ea0b0f0..d62e9b00703 100644 --- a/packages/crowdstrike/data_stream/fdr/fields/fields.yml +++ b/packages/crowdstrike/data_stream/fdr/fields/fields.yml @@ -2319,6 +2319,106 @@ type: keyword - name: XumdSuccessStatusString type: keyword + - name: ActionBlocked + type: keyword + - name: BaseModuleName + type: keyword + - name: CloudRequestId + type: keyword + - name: DBusDestination + type: keyword + - name: DBusInterface + type: keyword + - name: DBusMember + type: keyword + - name: DBusMessageFlags + type: keyword + - name: DBusMessageKind + type: keyword + - name: DBusNumUnixFiles + type: keyword + - name: DBusPath + type: keyword + - name: DBusPayload + type: keyword + - name: DBusReplySerial + type: keyword + - name: DBusSerial + type: keyword + - name: DiagnosticResultContext + type: keyword + - name: DiagnosticRunId + type: keyword + - name: DiagnosticRunType + type: keyword + - name: DiagnosticTriggerContext + type: keyword + - name: FilterContent + type: keyword + - name: FilterLength + type: keyword + - name: HbfwRuleFlags + type: keyword + - name: HbfwRuleId + type: keyword + - name: IdpPerfCounterMaximum + type: long + - name: IdpPerfCounterMinimum + type: long + - name: IdpPerfCounterPath + type: keyword + - name: IdpPerfCounterSum + type: long + - name: IdpPerfSampleCount + type: long + - name: IdpPerfSampleDuration + type: keyword + - name: MigoTemplateId + type: keyword + - name: MigoTemplateInstanceId + type: keyword + - name: MigoTemplateInstanceVersion + type: keyword + - name: ModuleExportName + type: keyword + - name: NetlinkFamily + type: keyword + - name: NetworkProfile + type: keyword + - name: PolicyIdentifier + type: keyword + - name: ResourceName + type: keyword + - name: RuleAction + type: keyword + - name: RuleMatchCount + type: long + - name: RuleMatchCountSinceLastReport + type: long + - name: SessionPatternIdList + type: keyword + - name: SocketType + type: keyword + - name: SourceCommandLine + type: wildcard + - name: SourceImageFileName + type: keyword + - name: SystemdUnitActiveState + type: keyword + - name: SystemdUnitFileState + type: keyword + - name: SystemdUnitLoadState + type: keyword + - name: SystemdUnitName + type: keyword + - name: SystemdUnitPath + type: keyword + - name: SystemdUnitProperties + type: wildcard + - name: TamperingAction + type: keyword + - name: VirtualAddress + type: keyword - name: dll.Ext.size type: long description: Size of DLL. diff --git a/packages/crowdstrike/docs/README.md b/packages/crowdstrike/docs/README.md index d337bd5dc1f..8c24e376846 100644 --- a/packages/crowdstrike/docs/README.md +++ b/packages/crowdstrike/docs/README.md @@ -1812,6 +1812,7 @@ An example event for `fdr` looks as following: | crowdstrike.AccountObjectGuid | | match_only_text | | crowdstrike.AccountObjectSid | | match_only_text | | crowdstrike.AccountType | | keyword | +| crowdstrike.ActionBlocked | | keyword | | crowdstrike.ActiveCpuCount | | long | | crowdstrike.ActiveDirectoryAuthenticationMethod | | keyword | | crowdstrike.ActivityId | | keyword | @@ -1855,6 +1856,7 @@ An example event for `fdr` looks as following: | crowdstrike.AverageCpuUsage | | keyword | | crowdstrike.AverageUsedRam | | keyword | | crowdstrike.BaseFileName | | keyword | +| crowdstrike.BaseModuleName | | keyword | | crowdstrike.BaseReachableTime | | keyword | | crowdstrike.BatchDataNumber | | keyword | | crowdstrike.BatchDataTotal | | keyword | @@ -1927,6 +1929,7 @@ An example event for `fdr` looks as following: | crowdstrike.ClientProcessStartKey | | keyword | | crowdstrike.CloudErrorCode | | keyword | | crowdstrike.CloudIndicator | | boolean | +| crowdstrike.CloudRequestId | | keyword | | crowdstrike.CommandCount | | match_only_text | | crowdstrike.CommandCountMax | | match_only_text | | crowdstrike.CommandHistory | | keyword | @@ -1976,6 +1979,16 @@ An example event for `fdr` looks as following: | crowdstrike.CurrentLocalIP | | ip | | crowdstrike.CustomerIdString | | keyword | | crowdstrike.CycleTime | | long | +| crowdstrike.DBusDestination | | keyword | +| crowdstrike.DBusInterface | | keyword | +| crowdstrike.DBusMember | | keyword | +| crowdstrike.DBusMessageFlags | | keyword | +| crowdstrike.DBusMessageKind | | keyword | +| crowdstrike.DBusNumUnixFiles | | keyword | +| crowdstrike.DBusPath | | keyword | +| crowdstrike.DBusPayload | | keyword | +| crowdstrike.DBusReplySerial | | keyword | +| crowdstrike.DBusSerial | | keyword | | crowdstrike.DadState | | keyword | | crowdstrike.DadTransmits | | keyword | | crowdstrike.Data1 | | keyword | @@ -2017,6 +2030,10 @@ An example event for `fdr` looks as following: | crowdstrike.DeviceUsbVersion | | keyword | | crowdstrike.DeviceVendorId | | keyword | | crowdstrike.DeviceVersion | | keyword | +| crowdstrike.DiagnosticResultContext | | keyword | +| crowdstrike.DiagnosticRunId | | keyword | +| crowdstrike.DiagnosticRunType | | keyword | +| crowdstrike.DiagnosticTriggerContext | | keyword | | crowdstrike.DirectionType | | keyword | | crowdstrike.DirectoryCreatedCount | | long | | crowdstrike.DirectoryEnumeratedCount | | long | @@ -2129,6 +2146,8 @@ An example event for `fdr` looks as following: | crowdstrike.FilesWritten.FileName | | keyword | | crowdstrike.FilesWritten.FilePath | | keyword | | crowdstrike.FilesWritten.Timestamp | | date | +| crowdstrike.FilterContent | | keyword | +| crowdstrike.FilterLength | | keyword | | crowdstrike.FirewallAction | | keyword | | crowdstrike.FirewallOption | | keyword | | crowdstrike.FirewallOptionNumericValue | | keyword | @@ -2174,6 +2193,8 @@ An example event for `fdr` looks as following: | crowdstrike.HandleCreated | | keyword | | crowdstrike.HandleOperationType | | keyword | | crowdstrike.HashAlgorithm | | keyword | +| crowdstrike.HbfwRuleFlags | | keyword | +| crowdstrike.HbfwRuleId | | keyword | | crowdstrike.HostGroups | | keyword | | crowdstrike.HostHiddenStatus | | keyword | | crowdstrike.HostProcessType | | keyword | @@ -2194,6 +2215,12 @@ An example event for `fdr` looks as following: | crowdstrike.IcmpCode | | keyword | | crowdstrike.IcmpType | | keyword | | crowdstrike.Id | | keyword | +| crowdstrike.IdpPerfCounterMaximum | | long | +| crowdstrike.IdpPerfCounterMinimum | | long | +| crowdstrike.IdpPerfCounterPath | | keyword | +| crowdstrike.IdpPerfCounterSum | | long | +| crowdstrike.IdpPerfSampleCount | | long | +| crowdstrike.IdpPerfSampleDuration | | keyword | | crowdstrike.IfType | | keyword | | crowdstrike.ImageBaseName | | keyword | | crowdstrike.ImageCheckSum | | keyword | @@ -2312,6 +2339,9 @@ An example event for `fdr` looks as following: | crowdstrike.MemoryTotal | | keyword | | crowdstrike.Metric | | keyword | | crowdstrike.MicrocodeSignature | | keyword | +| crowdstrike.MigoTemplateId | | keyword | +| crowdstrike.MigoTemplateInstanceId | | keyword | +| crowdstrike.MigoTemplateInstanceVersion | | keyword | | crowdstrike.MillisecondsToReadFirmware | | keyword | | crowdstrike.MinRouterAdvertisementInterval | | keyword | | crowdstrike.MinorFunction | | keyword | @@ -2323,6 +2353,7 @@ An example event for `fdr` looks as following: | crowdstrike.MoboProductName | | keyword | | crowdstrike.ModelPrediction | | keyword | | crowdstrike.ModuleCharacteristics | | keyword | +| crowdstrike.ModuleExportName | | keyword | | crowdstrike.ModuleILPath | | keyword | | crowdstrike.ModuleLoadCount | | long | | crowdstrike.ModuleLoadTelemetryClassification | | keyword | @@ -2340,6 +2371,7 @@ An example event for `fdr` looks as following: | crowdstrike.NeighborList | | keyword | | crowdstrike.NeighborName | | keyword | | crowdstrike.NetLuidIndex | | long | +| crowdstrike.NetlinkFamily | | keyword | | crowdstrike.NetworkAccesses.AccessTimestamp | | keyword | | crowdstrike.NetworkAccesses.AccessType | | keyword | | crowdstrike.NetworkAccesses.ConnectionDirection | | keyword | @@ -2359,6 +2391,7 @@ An example event for `fdr` looks as following: | crowdstrike.NetworkInterfaceGuid | | keyword | | crowdstrike.NetworkListenCount | | long | | crowdstrike.NetworkModuleLoadCount | | long | +| crowdstrike.NetworkProfile | | keyword | | crowdstrike.NetworkRecvAcceptCount | | long | | crowdstrike.NewExecutableWrittenCount | | long | | crowdstrike.NewFileAttributesLinux | | keyword | @@ -2509,6 +2542,7 @@ An example event for `fdr` looks as following: | crowdstrike.PointerSize | | keyword | | crowdstrike.Policy.ID | | keyword | | crowdstrike.Policy.Name | | keyword | +| crowdstrike.PolicyIdentifier | | keyword | | crowdstrike.PolicyRuleSeverity | | long | | crowdstrike.PreferredLifetime | | keyword | | crowdstrike.PrefixLength | | keyword | @@ -2592,6 +2626,7 @@ An example event for `fdr` looks as following: | crowdstrike.ResourceCreateTime | | date | | crowdstrike.ResourceId | | keyword | | crowdstrike.ResourceIdType | | keyword | +| crowdstrike.ResourceName | | keyword | | crowdstrike.RespondingDnsServer | | keyword | | crowdstrike.ResponseAction | | keyword | | crowdstrike.ResponsiblePid | | keyword | @@ -2607,7 +2642,10 @@ An example event for `fdr` looks as following: | crowdstrike.RpcNestingLevel | | keyword | | crowdstrike.RpcOpClassification | | match_only_text | | crowdstrike.RpcOpNum | | keyword | +| crowdstrike.RuleAction | | keyword | | crowdstrike.RuleId | | keyword | +| crowdstrike.RuleMatchCount | | long | +| crowdstrike.RuleMatchCountSinceLastReport | | long | | crowdstrike.RunDllInvocationCount | | long | | crowdstrike.SHA1HashData | | keyword | | crowdstrike.SHA1String | | keyword | @@ -2648,6 +2686,7 @@ An example event for `fdr` looks as following: | crowdstrike.ServiceStart | | keyword | | crowdstrike.ServiceType | | keyword | | crowdstrike.SessionId | | keyword | +| crowdstrike.SessionPatternIdList | | keyword | | crowdstrike.SessionProcessId | | keyword | | crowdstrike.SetThreadContextCount | | long | | crowdstrike.Severity | | integer | @@ -2670,10 +2709,12 @@ An example event for `fdr` looks as following: | crowdstrike.SmbClientName | | keyword | | crowdstrike.SmbShareName | | keyword | | crowdstrike.SnapshotFileOpenCount | | long | +| crowdstrike.SocketType | | keyword | | crowdstrike.SourceAccountDomain | | keyword | | crowdstrike.SourceAccountObjectGuid | | keyword | | crowdstrike.SourceAccountObjectSid | | keyword | | crowdstrike.SourceAccountSamAccountName | | keyword | +| crowdstrike.SourceCommandLine | | wildcard | | crowdstrike.SourceEndpointAccountObjectGuid | | keyword | | crowdstrike.SourceEndpointAccountObjectSid | | keyword | | crowdstrike.SourceEndpointAddressIP4 | | keyword | @@ -2682,6 +2723,7 @@ An example event for `fdr` looks as following: | crowdstrike.SourceEndpointNetworkType | | keyword | | crowdstrike.SourceEventUniqueId | | keyword | | crowdstrike.SourceFileName | | keyword | +| crowdstrike.SourceImageFileName | | keyword | | crowdstrike.SourceProcessId | | keyword | | crowdstrike.SourceProducts | | keyword | | crowdstrike.SourceThreadId | | keyword | @@ -2724,8 +2766,15 @@ An example event for `fdr` looks as following: | crowdstrike.SystemSerialNumber | | keyword | | crowdstrike.SystemSku | | keyword | | crowdstrike.SystemTableIndex | | long | +| crowdstrike.SystemdUnitActiveState | | keyword | +| crowdstrike.SystemdUnitFileState | | keyword | +| crowdstrike.SystemdUnitLoadState | | keyword | +| crowdstrike.SystemdUnitName | | keyword | +| crowdstrike.SystemdUnitPath | | keyword | +| crowdstrike.SystemdUnitProperties | | wildcard | | crowdstrike.Tactic | | keyword | | crowdstrike.Tags | | keyword | +| crowdstrike.TamperingAction | | keyword | | crowdstrike.TargetAuthenticationId | | keyword | | crowdstrike.TargetCommandLineParameters | | keyword | | crowdstrike.TargetDomainControllerObjectGuid | | keyword | @@ -2798,6 +2847,7 @@ An example event for `fdr` looks as following: | crowdstrike.ValidLifetime | | keyword | | crowdstrike.VerifiedCertificate | | keyword | | crowdstrike.VersionInfo | | match_only_text | +| crowdstrike.VirtualAddress | | keyword | | crowdstrike.VnodeModificationType | | keyword | | crowdstrike.VnodeType | | keyword | | crowdstrike.VolumeAppearanceTime | | keyword | diff --git a/packages/crowdstrike/manifest.yml b/packages/crowdstrike/manifest.yml index 0b0c90c3204..e522488ce92 100644 --- a/packages/crowdstrike/manifest.yml +++ b/packages/crowdstrike/manifest.yml @@ -1,6 +1,6 @@ name: crowdstrike title: CrowdStrike -version: "4.2.0" +version: "4.3.0" description: Collect logs from Crowdstrike with Elastic Agent. type: integration format_version: "3.4.0"