From e1c9f6d0bb2cd2ecce7d354d1eb68b85e5786efd Mon Sep 17 00:00:00 2001 From: Navnit Chauhan Date: Thu, 9 Jul 2026 11:18:45 +0530 Subject: [PATCH 1/3] crowdstrike: add ECS categorization for new FDR events --- packages/crowdstrike/changelog.yml | 5 + .../test/pipeline/test-fdr.log-expected.json | 30 +- .../fdr/_dev/test/pipeline/test-linux.log | 8 + .../pipeline/test-linux.log-expected.json | 910 ++++++++++++++++++ .../fdr/_dev/test/pipeline/test-windows.log | 8 + .../pipeline/test-windows.log-expected.json | 847 +++++++++++++++- .../ingest_pipeline/categorize.yml | 535 ++++++++++ .../data_stream/fdr/fields/fields.yml | 100 ++ packages/crowdstrike/docs/README.md | 158 +++ packages/crowdstrike/manifest.yml | 2 +- 10 files changed, 2598 insertions(+), 5 deletions(-) diff --git a/packages/crowdstrike/changelog.yml b/packages/crowdstrike/changelog.yml index 19c3d44aa48..92c39abe26f 100644 --- a/packages/crowdstrike/changelog.yml +++ b/packages/crowdstrike/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "4.2.0" + changes: + - description: Add ECS categorization and field mappings for new FDR event types including IDP telemetry, Active Directory account changes, DBus/systemd events, network containment, host firewall, sensor diagnostics, and container activity. + type: enhancement + link: https://github.com/elastic/integrations/pull/1 - version: "4.1.0" changes: - description: >- diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json index 17b5d70e9cb..aa10617169d 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json @@ -1342,9 +1342,17 @@ }, "event": { "action": "ChannelVersionRequired", + "category": [ + "configuration" + ], "created": "2021-07-07T17:04:53.974Z", "id": "ffffffff-1111-11eb-b7e0-02332cdcc16d|ffffffff25b14d4aa96de99e24bad2fa|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1156120155\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"12\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV2\",\"id\":\"ffffffff-1111-11eb-b7e0-02332cdcc16d\",\"ErrorCode\":\"0\",\"aid\":\"ffffffff25b14d4aa96de99e24bad2fa\",\"timestamp\":\"1625677493974\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + "kind": "event", + "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1156120155\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"12\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV2\",\"id\":\"ffffffff-1111-11eb-b7e0-02332cdcc16d\",\"ErrorCode\":\"0\",\"aid\":\"ffffffff25b14d4aa96de99e24bad2fa\",\"timestamp\":\"1625677493974\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] }, "host": { "id": "ffffffff25b14d4aa96de99e24bad2fa", @@ -1490,9 +1498,17 @@ }, "event": { "action": "ChannelVersionRequired", + "category": [ + "configuration" + ], "created": "2021-07-07T17:04:40.455Z", "id": "ffffffff-1111-11eb-8cc5-02c6fb049dd3|ffffffff2d7b4778a73b2cf58d327e42|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1620585913\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.13\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"210\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ChannelVersionRequiredMacV2\",\"id\":\"ffffffff-1111-11eb-8cc5-02c6fb049dd3\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff2d7b4778a73b2cf58d327e42\",\"timestamp\":\"1625677480455\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + "kind": "event", + "original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1620585913\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.13\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"210\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ChannelVersionRequiredMacV2\",\"id\":\"ffffffff-1111-11eb-8cc5-02c6fb049dd3\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff2d7b4778a73b2cf58d327e42\",\"timestamp\":\"1625677480455\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] }, "host": { "id": "ffffffff2d7b4778a73b2cf58d327e42", @@ -3604,9 +3620,17 @@ }, "event": { "action": "ChannelVersionRequired", + "category": [ + "configuration" + ], "created": "2021-07-07T17:05:07.901Z", "id": "ffffffff-1111-11eb-b411-06baeacb7a63|ffffffff67d54f7daf3d998ffc74d48e|ffffffff15754bcfb5f9152ec7ac90ac", - "original": "{\"ChannelVersion\":\"25\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"3155796140\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"20\",\"ConfigBuild\":\"1007.8.0011110.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV1\",\"id\":\"ffffffff-1111-11eb-b411-06baeacb7a63\",\"aid\":\"ffffffff67d54f7daf3d998ffc74d48e\",\"timestamp\":\"1625677507901\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}" + "kind": "event", + "original": "{\"ChannelVersion\":\"25\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"3155796140\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"20\",\"ConfigBuild\":\"1007.8.0011110.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV1\",\"id\":\"ffffffff-1111-11eb-b411-06baeacb7a63\",\"aid\":\"ffffffff67d54f7daf3d998ffc74d48e\",\"timestamp\":\"1625677507901\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}", + "outcome": "unknown", + "type": [ + "info" + ] }, "host": { "id": "ffffffff67d54f7daf3d998ffc74d48e", diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log index 6ab6c2e5419..47d2b97a3a1 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log @@ -3,3 +3,11 @@ {"CapPrm":"3800192030037","ParentProcessId":"8081349242194000050","SourceProcessId":"8081349242194000050","aip":"81.2.69.192","SessionProcessId":"4102020000109002000","SyntheticPR2Flags":"4","event_platform":"Lin","ProcessEndTime":"1745972888.297","SVUID":"0","EventOrigin":"45","id":"fb9bd5f0314e46ce785f479aed8f3032fcd9","EffectiveTransmissionClass":"2","timestamp":"1743508799999","ProcessGroupId":"7001610480104066706","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"8905032","ContextTimeStamp":"1752350302.359","GID":"0","ConfigStateHash":"5001020160","SVGID":"0","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","CommandLine":"e7f8eac7d","TargetProcessId":"6059002040716020903","ImageFileName":"/501e","RGID":"0","SourceThreadId":"0","Entitlements":"56","name":"4f32166a22f49735247598b45006","ProcessStartTime":"1745953229.264","RUID":"0","aid":"8c687fb6b1e8231200c77ef5e3175d0e","cid":"4092825518eaf67377a6e4492ae44577"} {"event_simpleName":"TerminateProcess","RawProcessId":"1070050","ContextTimeStamp":"1751300030.984","ConfigStateHash":"8001020160","ContextProcessId":"9960000700989070560","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","TargetProcessId":"6960000700989070560","Entitlements":"36","name":"6b1c662a760f5ed9750d4","EventOrigin":"1","id":"3e71b26395f4386bcb6602ee6777bb5f3124","EffectiveTransmissionClass":"2","aid":"12111f24f25a2a99438b40765c236577","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"} {"ChangeTime":"1731329600.968","OciContainerId":"sw345tf5e3455r7dw32w23t6t7fde34ed345rfe45rf0ew4fd","CapPrm":"123438954321","ParentProcessId":"12347782548906","SourceProcessId":"12347782548906","aip":"89.160.20.128","SessionProcessId":"1234915117961","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1760406073.595","SVUID":"0","ParentBaseFileName":"runc","EventOrigin":"17","id":"1w23e4r-d03e-4003-bc75-71c6e819ca5f","EffectiveTransmissionClass":"2","Tags":"874, 17179870274, 12094627905582, 12094627906234, 212205744162400","timestamp":"1760406074201","ProcessGroupId":"1234915117961","LocalAddressIP4":"0.0.0.0","event_simpleName":"ProcessRollup2","RawProcessId":"1234","RootPath":"/","GID":"0","ConfigStateHash":"1026580567","UserName":"root","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"runc init","TargetProcessId":"12347783237538","ImageFileName":"/","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV12","RUID":"0","ProcessStartTime":"1760406073.568","ComputerName":"comp2","aid":"ffffffff62714a708030d494ca0a7e60","cid":"ffffffff15754bcfb5f9152ec7ac90ac"} +{"event_simpleName":"DNSRequestDetectInfo","ContextBaseFileName":"example","IP4Records":"192.0.2.30","TemplateInstanceId":"28184","aip":"192.0.2.3","QueryStatus":"0","event_platform":"Lin","SessionPatternIdList":"1001,1002,1003","PatternId":"30997","EventOrigin":"1","id":"a8762b4b-f927-4800-8631-ad275fd3e55a","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785494.176","ConfigStateHash":"4058413047","TemplateDisposition":"10","ContextProcessId":"1781784074817030518","DomainName":"api.example.com","ConfigBuild":"1007.8.0019004.15","Entitlements":"15","name":"DNSRequestDetectInfoLinV2","ComputerName":"LIN-HOST-01","aid":"0ce22396112f4f748024a6356ceee4de","cid":"2cc98db1a47b4c98b913c94d43bfab70","RequestType":"1"} +{"event_simpleName":"DBusMessage","DBusDestination":":1.100","aip":"192.0.2.3","DBusReplySerial":"0","DBusNumUnixFiles":"0","DBusSender":"","event_platform":"Lin","DBusSerial":"11","EventOrigin":"1","id":"05ad40d8-fd06-4f2e-91e6-99eb94a334b0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785754.694","DBusPayload":"[233]","ConfigStateHash":"4058413047","ContextProcessId":"1781785754634192743","DBusPath":"/","ConfigBuild":"1007.8.0019004.15","DBusMember":"SetFeatureFlags","DBusMessageFlags":"0","Entitlements":"15","name":"DBusMessageLinV1","DBusInterface":"org.example.service","ComputerName":"LIN-HOST-01","aid":"0ce22396112f4f748024a6356ceee4de","cid":"2cc98db1a47b4c98b913c94d43bfab70","DBusMessageKind":"method_call"} +{"event_simpleName":"CreateSocket","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785861.437","SocketType":"3","ConfigStateHash":"784305823","ContextProcessId":"106167322594972","ContextThreadId":"0","aip":"192.0.2.3","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","NetlinkFamily":"9","ImageFileName":"/usr/sbin/crond","Entitlements":"15","name":"CreateSocketLinV3","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"3a91a3a3-e739-4762-8169-7c7913f7601d","AddressFamily":"16","EffectiveTransmissionClass":"3","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"PacketFilterAttached","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781250697.368","ConfigStateHash":"1180378067","ContextProcessId":"1781250696892936591","aip":"192.0.2.2","FilterContent":"0102030405060708","SHA256HashData":"8f3aeb46f41e411b524118e77ca53995c6a273b12f98fc41d7b62cf907511a6c","FilterLength":"80","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","ImageFileName":"/usr/libexec/example/fwupd","Entitlements":"15","name":"PacketFilterAttachedLinV3","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"e6ed60ef-4c04-49c8-b426-92734a68d946","EffectiveTransmissionClass":"3","aid":"0ce22396112f4f748024a6356ceee4de","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"SystemdServiceCreated","SystemdUnitFileState":"static","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781747971.022","ConfigStateHash":"4058413047","aip":"192.0.2.3","SystemdUnitPath":"/usr/lib/systemd/system/example.service","ConfigBuild":"1007.8.0019004.15","SystemdUnitProperties":"{\"Type\":\"dbus\",\"Description\":\"Example Service\"}","event_platform":"Lin","SystemdUnitLoadState":"loaded","SystemdUnitName":"example.service","SystemdUnitActiveState":"active","Entitlements":"15","name":"SystemdServiceCreatedLinV2","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"d59230fa-4361-43a6-a6c9-9a12ac1492d5","EffectiveTransmissionClass":"3","aid":"0ce22396112f4f748024a6356ceee4de","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"SharedObjectLoaded","VirtualAddress":"140539515256832","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785861.426","ConfigStateHash":"784305823","ContextProcessId":"106167322594972","aip":"192.0.2.3","SHA256HashData":"bb7ae1c1c0c3cfd6a73a6839ff69d81d14d1386e24372084cd44a97c385ebc08","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","CommandLine":"/usr/sbin/crond -n","ImageFileName":"/usr/sbin/crond","Entitlements":"15","name":"SharedObjectLoadedLinV2","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"fc2c5063-1bea-4bf0-962d-7ab26a1a95b1","EffectiveTransmissionClass":"3","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70","TargetFileName":"/usr/lib64/security/pam_unix.so"} +{"event_simpleName":"OciContainerInfo","OciContainerId":"0370e0bae01215ab32fcb01fa5b21a4c7a07fe10a5a7032ccb2438fce25c6ba0","aip":"192.0.2.3","OciContainerStateOOMKilled":"0","OciContainerConfigLabels":"com.example.project:demo|com.example.service:agent","OciContainerConfigTty":"0","event_platform":"Lin","OciContainerHostConfigPublishAllPorts":"0","OciContainerMounts":"bind,/var/example/creds,/app/credentials,rw,true,rprivate","EventOrigin":"1","OciContainerName":"/example-agent","OciContainerNetworkSettingsIpAddress":"255.255.255.255","OciContainerAppName":"JAVA","id":"36bcd8e5-11d7-427b-beab-9a57c747f182","EffectiveTransmissionClass":"2","OciContainerInfoRetransmitted":"1","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ConfigStateHash":"4058413047","OciContainerStatePid":"2570469","OciContainerImageId":"be2069da187be6aa939626092187447b22d579d986cfaa065ff78408ddbb6c6c","ConfigBuild":"1007.8.0019004.15","OciContainerConfigImage":"example-agent","Entitlements":"15","name":"OciContainerInfoLinV10","ComputerName":"LIN-HOST-01","OciContainerAppVersion":"1.0.0","aid":"0ce22396112f4f748024a6356ceee4de","cid":"2cc98db1a47b4c98b913c94d43bfab70","OciContainerEngineType":"1"} +{"event_simpleName":"SensorTampering","ActionBlocked":"1","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781659012.171","SourceImageFileName":"/usr/lib/systemd/systemd","ConfigStateHash":"4058413047","ResourceName":"falcond","SourceProcessId":"1781139628182470889","SourceCommandLine":"/usr/lib/systemd/systemd --system","aip":"192.0.2.3","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","TargetProcessId":"1780602555935280240","Entitlements":"15","name":"SensorTamperingLinV1","EventOrigin":"1","ComputerName":"LIN-HOST-01","TamperingAction":"signal_process","id":"e02f29c4-344e-4d33-9cc0-2acb32a8d8ec","EffectiveTransmissionClass":"2","aid":"0ce22396112f4f748024a6356ceee4de","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json index 6e33576ee53..cbf87ce0343 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json @@ -551,6 +551,916 @@ "id": "0", "name": "root" } + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4058413047", + "ContextBaseFileName": "example", + "ContextProcessId": "1781784074817030518", + "ContextTimeStamp": "2026-06-18T12:24:54.176Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "1", + "IP4Records": "192.0.2.30", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "PatternId": "30997", + "QueryStatus": "0", + "RequestType": "1", + "SessionPatternIdList": "1001,1002,1003", + "TemplateDisposition": "10", + "TemplateInstanceId": "28184", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "DNSRequestDetectInfo", + "id": "a8762b4b-f927-4800-8631-ad275fd3e55a", + "name": "DNSRequestDetectInfoLinV2" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "DNSRequestDetectInfo", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "a8762b4b-f927-4800-8631-ad275fd3e55a|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"DNSRequestDetectInfo\",\"ContextBaseFileName\":\"example\",\"IP4Records\":\"192.0.2.30\",\"TemplateInstanceId\":\"28184\",\"aip\":\"192.0.2.3\",\"QueryStatus\":\"0\",\"event_platform\":\"Lin\",\"SessionPatternIdList\":\"1001,1002,1003\",\"PatternId\":\"30997\",\"EventOrigin\":\"1\",\"id\":\"a8762b4b-f927-4800-8631-ad275fd3e55a\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781785494.176\",\"ConfigStateHash\":\"4058413047\",\"TemplateDisposition\":\"10\",\"ContextProcessId\":\"1781784074817030518\",\"DomainName\":\"api.example.com\",\"ConfigBuild\":\"1007.8.0019004.15\",\"Entitlements\":\"15\",\"name\":\"DNSRequestDetectInfoLinV2\",\"ComputerName\":\"LIN-HOST-01\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"RequestType\":\"1\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "1781784074817030518", + "name": "example" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4058413047", + "ContextProcessId": "1781785754634192743", + "ContextTimeStamp": "2026-06-18T12:29:14.694Z", + "DBusDestination": ":1.100", + "DBusInterface": "org.example.service", + "DBusMember": "SetFeatureFlags", + "DBusMessageFlags": "0", + "DBusMessageKind": "method_call", + "DBusNumUnixFiles": "0", + "DBusPath": "/", + "DBusPayload": "[233]", + "DBusReplySerial": "0", + "DBusSerial": "11", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "DBusMessage", + "id": "05ad40d8-fd06-4f2e-91e6-99eb94a334b0", + "name": "DBusMessageLinV1" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "DBusMessage", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "05ad40d8-fd06-4f2e-91e6-99eb94a334b0|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"DBusMessage\",\"DBusDestination\":\":1.100\",\"aip\":\"192.0.2.3\",\"DBusReplySerial\":\"0\",\"DBusNumUnixFiles\":\"0\",\"DBusSender\":\"\",\"event_platform\":\"Lin\",\"DBusSerial\":\"11\",\"EventOrigin\":\"1\",\"id\":\"05ad40d8-fd06-4f2e-91e6-99eb94a334b0\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781785754.694\",\"DBusPayload\":\"[233]\",\"ConfigStateHash\":\"4058413047\",\"ContextProcessId\":\"1781785754634192743\",\"DBusPath\":\"/\",\"ConfigBuild\":\"1007.8.0019004.15\",\"DBusMember\":\"SetFeatureFlags\",\"DBusMessageFlags\":\"0\",\"Entitlements\":\"15\",\"name\":\"DBusMessageLinV1\",\"DBusInterface\":\"org.example.service\",\"ComputerName\":\"LIN-HOST-01\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"DBusMessageKind\":\"method_call\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "1781785754634192743" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AddressFamily": "16", + "ConfigStateHash": "784305823", + "ContextProcessId": "106167322594972", + "ContextTimeStamp": "2026-06-18T12:31:01.437Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "NetlinkFamily": "9", + "SocketType": "3", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "CreateSocket", + "id": "3a91a3a3-e739-4762-8169-7c7913f7601d", + "name": "CreateSocketLinV3" + }, + "device": { + "id": "2e3d9c94d9c34764860b1f3b444c6d4d" + }, + "event": { + "action": "CreateSocket", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "3a91a3a3-e739-4762-8169-7c7913f7601d|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"CreateSocket\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781785861.437\",\"SocketType\":\"3\",\"ConfigStateHash\":\"784305823\",\"ContextProcessId\":\"106167322594972\",\"ContextThreadId\":\"0\",\"aip\":\"192.0.2.3\",\"ConfigBuild\":\"1007.8.0019004.15\",\"event_platform\":\"Lin\",\"NetlinkFamily\":\"9\",\"ImageFileName\":\"/usr/sbin/crond\",\"Entitlements\":\"15\",\"name\":\"CreateSocketLinV3\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"id\":\"3a91a3a3-e739-4762-8169-7c7913f7601d\",\"AddressFamily\":\"16\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "start", + "connection" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "2e3d9c94d9c34764860b1f3b444c6d4d", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "106167322594972", + "executable": "/usr/sbin/crond", + "name": "crond", + "thread": { + "id": 0 + } + }, + "related": { + "hash": [ + "784305823" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "1180378067", + "ContextProcessId": "1781250696892936591", + "ContextTimeStamp": "2026-06-12T07:51:37.368Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "FilterContent": "0102030405060708", + "FilterLength": "80", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "SHA256HashData": "8f3aeb46f41e411b524118e77ca53995c6a273b12f98fc41d7b62cf907511a6c", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "PacketFilterAttached", + "id": "e6ed60ef-4c04-49c8-b426-92734a68d946", + "name": "PacketFilterAttachedLinV3" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "PacketFilterAttached", + "category": [ + "configuration", + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "e6ed60ef-4c04-49c8-b426-92734a68d946|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"PacketFilterAttached\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781250697.368\",\"ConfigStateHash\":\"1180378067\",\"ContextProcessId\":\"1781250696892936591\",\"aip\":\"192.0.2.2\",\"FilterContent\":\"0102030405060708\",\"SHA256HashData\":\"8f3aeb46f41e411b524118e77ca53995c6a273b12f98fc41d7b62cf907511a6c\",\"FilterLength\":\"80\",\"ConfigBuild\":\"1007.8.0019004.15\",\"event_platform\":\"Lin\",\"ImageFileName\":\"/usr/libexec/example/fwupd\",\"Entitlements\":\"15\",\"name\":\"PacketFilterAttachedLinV3\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"id\":\"e6ed60ef-4c04-49c8-b426-92734a68d946\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "change", + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "1781250696892936591", + "executable": "/usr/libexec/example/fwupd", + "name": "fwupd" + }, + "related": { + "hash": [ + "8f3aeb46f41e411b524118e77ca53995c6a273b12f98fc41d7b62cf907511a6c", + "1180378067" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4058413047", + "ContextTimeStamp": "2026-06-18T01:59:31.022Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "SystemdUnitActiveState": "active", + "SystemdUnitFileState": "static", + "SystemdUnitLoadState": "loaded", + "SystemdUnitName": "example.service", + "SystemdUnitPath": "/usr/lib/systemd/system/example.service", + "SystemdUnitProperties": "{\"Type\":\"dbus\",\"Description\":\"Example Service\"}", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "SystemdServiceCreated", + "id": "d59230fa-4361-43a6-a6c9-9a12ac1492d5", + "name": "SystemdServiceCreatedLinV2" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "SystemdServiceCreated", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "d59230fa-4361-43a6-a6c9-9a12ac1492d5|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"SystemdServiceCreated\",\"SystemdUnitFileState\":\"static\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781747971.022\",\"ConfigStateHash\":\"4058413047\",\"aip\":\"192.0.2.3\",\"SystemdUnitPath\":\"/usr/lib/systemd/system/example.service\",\"ConfigBuild\":\"1007.8.0019004.15\",\"SystemdUnitProperties\":\"{\\\"Type\\\":\\\"dbus\\\",\\\"Description\\\":\\\"Example Service\\\"}\",\"event_platform\":\"Lin\",\"SystemdUnitLoadState\":\"loaded\",\"SystemdUnitName\":\"example.service\",\"SystemdUnitActiveState\":\"active\",\"Entitlements\":\"15\",\"name\":\"SystemdServiceCreatedLinV2\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"id\":\"d59230fa-4361-43a6-a6c9-9a12ac1492d5\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "784305823", + "ContextProcessId": "106167322594972", + "ContextTimeStamp": "2026-06-18T12:31:01.426Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "ImageFileName": "/usr/sbin/crond", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "SHA256HashData": "bb7ae1c1c0c3cfd6a73a6839ff69d81d14d1386e24372084cd44a97c385ebc08", + "VirtualAddress": "140539515256832", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "SharedObjectLoaded", + "id": "fc2c5063-1bea-4bf0-962d-7ab26a1a95b1", + "name": "SharedObjectLoadedLinV2" + }, + "device": { + "id": "2e3d9c94d9c34764860b1f3b444c6d4d" + }, + "event": { + "action": "SharedObjectLoaded", + "category": [ + "library" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "fc2c5063-1bea-4bf0-962d-7ab26a1a95b1|2e3d9c94d9c34764860b1f3b444c6d4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"SharedObjectLoaded\",\"VirtualAddress\":\"140539515256832\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781785861.426\",\"ConfigStateHash\":\"784305823\",\"ContextProcessId\":\"106167322594972\",\"aip\":\"192.0.2.3\",\"SHA256HashData\":\"bb7ae1c1c0c3cfd6a73a6839ff69d81d14d1386e24372084cd44a97c385ebc08\",\"ConfigBuild\":\"1007.8.0019004.15\",\"event_platform\":\"Lin\",\"CommandLine\":\"/usr/sbin/crond -n\",\"ImageFileName\":\"/usr/sbin/crond\",\"Entitlements\":\"15\",\"name\":\"SharedObjectLoadedLinV2\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"id\":\"fc2c5063-1bea-4bf0-962d-7ab26a1a95b1\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"2e3d9c94d9c34764860b1f3b444c6d4d\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"TargetFileName\":\"/usr/lib64/security/pam_unix.so\"}", + "outcome": "success", + "type": [ + "start" + ] + }, + "file": { + "directory": "/usr/lib64/security", + "extension": "so", + "name": "pam_unix.so", + "path": "/usr/lib64/security/pam_unix.so", + "type": "file" + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "2e3d9c94d9c34764860b1f3b444c6d4d", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "2e3d9c94d9c34764860b1f3b444c6d4d", + "version": "1007.8.0019004.15" + }, + "process": { + "args": [ + "/usr/sbin/crond", + "-n" + ], + "args_count": 2, + "command_line": "/usr/sbin/crond -n", + "entity_id": "106167322594972" + }, + "related": { + "hash": [ + "bb7ae1c1c0c3cfd6a73a6839ff69d81d14d1386e24372084cd44a97c385ebc08", + "784305823" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4058413047", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "OciContainerAppName": "JAVA", + "OciContainerAppVersion": "1.0.0", + "OciContainerConfigImage": "example-agent", + "OciContainerConfigLabels": "com.example.project:demo|com.example.service:agent", + "OciContainerConfigTty": "0", + "OciContainerEngineType": "1", + "OciContainerHostConfigPublishAllPorts": 0, + "OciContainerId": "0370e0bae01215ab32fcb01fa5b21a4c7a07fe10a5a7032ccb2438fce25c6ba0", + "OciContainerImageId": "be2069da187be6aa939626092187447b22d579d986cfaa065ff78408ddbb6c6c", + "OciContainerInfoRetransmitted": "1", + "OciContainerMounts": "bind,/var/example/creds,/app/credentials,rw,true,rprivate", + "OciContainerName": "/example-agent", + "OciContainerNetworkSettingsIpAddress": "255.255.255.255", + "OciContainerStateOOMKilled": "0", + "OciContainerStatePid": "2570469", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "OciContainerInfo", + "id": "36bcd8e5-11d7-427b-beab-9a57c747f182", + "name": "OciContainerInfoLinV10" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "OciContainerInfo", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "36bcd8e5-11d7-427b-beab-9a57c747f182|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "state", + "original": "{\"event_simpleName\":\"OciContainerInfo\",\"OciContainerId\":\"0370e0bae01215ab32fcb01fa5b21a4c7a07fe10a5a7032ccb2438fce25c6ba0\",\"aip\":\"192.0.2.3\",\"OciContainerStateOOMKilled\":\"0\",\"OciContainerConfigLabels\":\"com.example.project:demo|com.example.service:agent\",\"OciContainerConfigTty\":\"0\",\"event_platform\":\"Lin\",\"OciContainerHostConfigPublishAllPorts\":\"0\",\"OciContainerMounts\":\"bind,/var/example/creds,/app/credentials,rw,true,rprivate\",\"EventOrigin\":\"1\",\"OciContainerName\":\"/example-agent\",\"OciContainerNetworkSettingsIpAddress\":\"255.255.255.255\",\"OciContainerAppName\":\"JAVA\",\"id\":\"36bcd8e5-11d7-427b-beab-9a57c747f182\",\"EffectiveTransmissionClass\":\"2\",\"OciContainerInfoRetransmitted\":\"1\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ConfigStateHash\":\"4058413047\",\"OciContainerStatePid\":\"2570469\",\"OciContainerImageId\":\"be2069da187be6aa939626092187447b22d579d986cfaa065ff78408ddbb6c6c\",\"ConfigBuild\":\"1007.8.0019004.15\",\"OciContainerConfigImage\":\"example-agent\",\"Entitlements\":\"15\",\"name\":\"OciContainerInfoLinV10\",\"ComputerName\":\"LIN-HOST-01\",\"OciContainerAppVersion\":\"1.0.0\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"OciContainerEngineType\":\"1\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ActionBlocked": "1", + "ConfigStateHash": "4058413047", + "ContextTimeStamp": "2026-06-17T01:16:52.171Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "ResourceName": "falcond", + "SourceCommandLine": "/usr/lib/systemd/systemd --system", + "SourceImageFileName": "/usr/lib/systemd/systemd", + "SourceProcessId": "1781139628182470889", + "TamperingAction": "signal_process", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "SensorTampering", + "id": "e02f29c4-344e-4d33-9cc0-2acb32a8d8ec", + "name": "SensorTamperingLinV1" + }, + "device": { + "id": "0ce22396112f4f748024a6356ceee4de" + }, + "event": { + "action": "SensorTampering", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "e02f29c4-344e-4d33-9cc0-2acb32a8d8ec|0ce22396112f4f748024a6356ceee4de|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"SensorTampering\",\"ActionBlocked\":\"1\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781659012.171\",\"SourceImageFileName\":\"/usr/lib/systemd/systemd\",\"ConfigStateHash\":\"4058413047\",\"ResourceName\":\"falcond\",\"SourceProcessId\":\"1781139628182470889\",\"SourceCommandLine\":\"/usr/lib/systemd/systemd --system\",\"aip\":\"192.0.2.3\",\"ConfigBuild\":\"1007.8.0019004.15\",\"event_platform\":\"Lin\",\"TargetProcessId\":\"1780602555935280240\",\"Entitlements\":\"15\",\"name\":\"SensorTamperingLinV1\",\"EventOrigin\":\"1\",\"ComputerName\":\"LIN-HOST-01\",\"TamperingAction\":\"signal_process\",\"id\":\"e02f29c4-344e-4d33-9cc0-2acb32a8d8ec\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"0ce22396112f4f748024a6356ceee4de\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "LIN-HOST-01", + "id": "0ce22396112f4f748024a6356ceee4de", + "name": "LIN-HOST-01", + "os": { + "type": "linux" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "0ce22396112f4f748024a6356ceee4de", + "version": "1007.8.0019004.15" + }, + "process": { + "entity_id": "1780602555935280240" + }, + "related": { + "hash": [ + "4058413047" + ], + "hosts": [ + "LIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] } ] } diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log index ee90ee5f35a..4f025a1ee9a 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log @@ -119,3 +119,11 @@ {"event_simpleName":"FileWrittenWithEntropyHigh","Size":"12216","ShannonEntropy":"932","BoundingLimitCount":"5","event_platform":"Win","EventOrigin":"1","id":"fc10d190-e98f-45fc-bb2a-ca60d3534a2a","EffectiveTransmissionClass":"3","timestamp":"1761811953235","ContextTimeStamp":"1761811952.620","ConfigStateHash":"1146505100","ContextProcessId":"111845303038","AuthenticationId":"999","ConfigBuild":"1007.3.0019907.15","FileEcpBitmask":"0","BoundingLimitDuration":"3600000","Entitlements":"15","name":"FileWrittenWithEntropyHighV2","ComputerName":"win10-qwe-3","Attacks":[{"Tactic":"Defense Evasion","Technique":"Obfuscated Files or Information"}],"aid":"bae5bafaeb93295d398bf55b8ba1cf01","TargetFileName":"\\Device\\HarddiskVolume4\\Windows\\Temp\\APPX.fb9inon0wlj06bji0gujvuvcd.tmp"} {"event_simpleName":"ReflectiveDotnetModuleLoad","AssemblyName":"vezhsq1h, Version\u003d0.0.0.0, Culture\u003dneutral, PublicKeyToken\u003dnull","ModuleNativePath":"","NativePdbBuildPath":"","event_platform":"Win","DotnetModuleFlags":"8","DotnetModuleId":"140707789195504","EventOrigin":"1","id":"b089f099-ffac-44fd-9efe-e1bc148214ee","EffectiveTransmissionClass":"3","timestamp":"1755638644187","ManagedPdbBuildPath":"","ContextTimeStamp":"1755638637.713","ConfigStateHash":"3064617115","ContextProcessId":"11708829302","AssemblyFlags":"0","EtwProviderType":"2","ConfigBuild":"1007.3.0019907.15","CommandLine":"\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Entitlements":"15","name":"ReflectiveDotnetModuleLoadV2","AssemblyId":"1825020243168","aid":"cdbfd7c3bab5478d935db9969b5886cc","ModuleILPath":"vezhsq1h"} {"event_simpleName":"SuspiciousPrivilegedProcessHandle","IntegrityLevel":"16384","ContextThreadId":"1217210494023","TargetIntegrityLevel":"16384","event_platform":"Win","SuspiciousHandleOpenReason":"2","EventOrigin":"1","id":"87902694-15af-4692-b1e2-bf7fba80b272","HandleCreated":"0","EffectiveTransmissionClass":"3","timestamp":"1757597618983","ContextTimeStamp":"1757597618.424","ConfigStateHash":"3591479077","ContextProcessId":"90332841484","AuthenticationId":"996","ConfigBuild":"1007.3.0019907.15","TargetProcessId":"90365065195","DesiredAccess":"2097151","Entitlements":"15","name":"SuspiciousPrivilegedProcessHandleV2","ComputerName":"win10-qwe-3","aid":"cdbfd7c3bab5478d935db9969b5886cc","TargetAuthenticationId":"996"} +{"event_simpleName":"IdpDcPerfReport","LocalAddressIP4":"192.0.2.10","ConfigStateHash":"3995347011","IdpPerfCounterPath":"\\Process(lsass)\\Working Set","aip":"192.0.2.1","IdpPerfSampleDuration":"2999997209","IdpPerfCounterMaximum":"95629312","IdpPerfSampleCount":"30","ConfigBuild":"1007.3.0021003.15","event_platform":"Win","IdpPerfCounterMinimum":"95531008","Entitlements":"15","name":"IdpDcPerfReportV1","EventOrigin":"17","ComputerName":"WIN-HOST-01","IdpPerfCounterSum":"2868150272","id":"11633f5f-6a9c-4a6a-a39b-f01bce8a2f37","EffectiveTransmissionClass":"2","aid":"3f4218d0c561464c9ef5d1c81000fc38","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"ActiveDirectoryAccountCreated","SamAccountName":"SVC-ACCT$","ContextTimeStamp":"1780575797.000","AccountDomain":"EXAMPLE.LOCAL","aip":"","event_platform":"Win","name":"ActiveDirectoryAccountCreatedV1","id":"d1972344-dae4-4cd5-910c-fbd6d71d4431","AccountObjectGuid":"82b2a1e4-585d-4d47-8f55-19b76b14a66f","aid":"","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70","AccountObjectSid":"S-1-5-21-000000000-000000000-000000000-1477"} +{"event_simpleName":"LogonBehaviorCompositionDetectInfo","TemplateInstanceId":"19717","aip":"192.0.2.2","LogonDomain":"WIN-HOST-01","RemoteAccount":"0","event_platform":"Win","PatternId":"10199","EventOrigin":"1","id":"34376fb6-4e59-4a1f-8fba-dac1fd55fe34","EffectiveTransmissionClass":"3","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ConfigStateHash":"318902667","TemplateDisposition":"10","ContextProcessId":"21475403566","LogonType":"2","AuthenticationId":"745263870","ConfigBuild":"1007.3.0020907.15","CommandLine":"System","ImageFileName":"System","Entitlements":"15","name":"LogonBehaviorCompositionDetectInfoV2","ComputerName":"WIN-HOST-01","PatternIdList":"7149,7212,8111","RemoteAddressIP4":"127.0.0.1","aid":"1a9dad0d78b44af9a1bee299862e7b4d","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"NetworkContainmentCompleted","Status":"0","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1780488158.763","ConfigStateHash":"2473141737","CloudRequestId":"201ba0eb-161d-4a37-99bd-4e0d8865b183","aip":"192.0.2.2","ConfigBuild":"1007.3.0020805.15","event_platform":"Win","Entitlements":"15","name":"NetworkContainmentCompletedV1","EventOrigin":"17","ComputerName":"WIN-HOST-01","id":"a3277aa2-a123-41d5-86bd-e6fad46f35a4","EffectiveTransmissionClass":"0","aid":"cbaab7c6e77c44099fd72d81073f9883","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"FirewallRuleIP4Matched","RuleAction":"1","aip":"192.0.2.2","RuleMatchCount":"1","event_platform":"Win","EventOrigin":"17","id":"23205a0d-b279-4527-9355-65506561b8ce","Protocol":"17","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"224.0.0.251","ContextTimeStamp":"1780377915.226","RuleMatchCountSinceLastReport":"16681","ConfigStateHash":"765810426","ContextProcessId":"13002244","RemotePort":"5353","HbfwRuleId":"3","NetworkInterfaceGuid":"00796106-8fee-442e-90ea-956af504c46d","ConfigBuild":"1007.3.0020907.15","NetworkProfile":"2","CommandLine":"C:\\Windows\\system32\\svchost.exe -k NetworkService -p","PolicyIdentifier":"f7ee517b-ff8f-4f51-ad8e-6f134f19f617","LocalPort":"5353","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe","Entitlements":"15","name":"FirewallRuleIP4MatchedV6","ComputerName":"WIN-HOST-01","HbfwRuleFlags":"7","aid":"460f573fda4744708f60437e2484a38c","RemoteAddressIP4":"192.0.2.20","ConnectionDirection":"1","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"ProvisioningStarted","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781348370.024","ConfigStateHash":"386343172","aip":"192.0.2.2","ConfigBuild":"0.3.0020907.15","event_platform":"Win","AgentLoadFlags":"17","Entitlements":"15","name":"ProvisioningStartedV1","ComputerName":"WIN-HOST-01","id":"3b430dcb-dcef-4a8d-b85a-42f9c49c66de","EffectiveTransmissionClass":"0","aid":"1a9dad0d78b44af9a1bee299862e7b4d","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"SensorSelfDiagnosticTelemetry","aip":"192.0.2.2","MigoTemplateInstanceVersion":"8","event_platform":"Win","MigoTemplateId":"307","EventOrigin":"1","id":"ececeff9-9999-45ea-8a62-c620f9475548","MigoTemplateInstanceId":"15724","EffectiveTransmissionClass":"3","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781758031.318","ConfigStateHash":"4108388545","DiagnosticRunId":"34207803-666a-f111-b253-8cc6813d0f30","DiagnosticResultContext":"24:PPU","DiagnosticTriggerContext":"Scheduled","ConfigBuild":"1007.3.0020907.15","DiagnosticRunType":"0","Entitlements":"15","name":"SensorSelfDiagnosticTelemetryV1","ComputerName":"WIN-HOST-01","aid":"6e3d57c5d4dc483dac3628aee2ca62a9","cid":"2cc98db1a47b4c98b913c94d43bfab70"} +{"event_simpleName":"XumdHookEvent","BaseModuleName":"samcli.dll","CommandLine":"C:\\Program Files\\Example\\app.exe","ComputerName":"WIN-HOST-01","ConfigBuild":"1007.3.0021003.15","ConfigStateHash":"3477107385","ContextProcessId":"160872222276","ContextTimeStamp":"1783594027.300","EffectiveTransmissionClass":"3","Entitlements":"15","EventOrigin":"1","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\Example\\app.exe","LocalAddressIP4":"192.0.2.10","ModuleExportName":"NetUserGetInfo","PatternId":"10448","PatternIdList":"446,7106,8111","TemplateInstanceId":"17594","aid":"9fa290eb9c64449490d17a85801c6ebf","aip":"192.0.2.3","cid":"2cc98db1a47b4c98b913c94d43bfab70","event_platform":"Win","id":"7e857013-5bc5-4d68-9e08-6f30b8b50ccc","name":"XumdHookEventV3","timestamp":"1743508799999"} diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json index be24e63f3ea..2c72f05d064 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json @@ -10875,7 +10875,12 @@ ], "created": "2025-08-18T18:31:22.619Z", "id": "9c458f-ddfe1293cd-56445b2c4-3d0a0ef4|bae5bafaeb93295d398bf55b8ba1cf01|4092825518eaf67377a6e4492ae44577", - "original": "{\"event_simpleName\":\"MotwWritten\",\"ConfigStateHash\":\"0222222222\",\"ContextProcessId\":\"1111111111\",\"aip\":\"89.160.20.128\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"HostUrl\":\"\",\"Entitlements\":\"15\",\"name\":\"MotwWrittenV2\",\"EventOrigin\":\"1\",\"ReferrerUrl\":\"\",\"id\":\"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"timestamp\":\"1755541882619\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\Device\\\\Local\\\\Default\\\\Files\\\\asdf-ghkl\"}" + "kind": "event", + "original": "{\"event_simpleName\":\"MotwWritten\",\"ConfigStateHash\":\"0222222222\",\"ContextProcessId\":\"1111111111\",\"aip\":\"89.160.20.128\",\"FileIdentifier\":\"9c3110248de4f0a68f2fe668e59ed821d7d987845cd51ed1\",\"ConfigBuild\":\"1007.3.0019907.15\",\"event_platform\":\"Win\",\"HostUrl\":\"\",\"Entitlements\":\"15\",\"name\":\"MotwWrittenV2\",\"EventOrigin\":\"1\",\"ReferrerUrl\":\"\",\"id\":\"9c458f-ddfe1293cd-56445b2c4-3d0a0ef4\",\"EffectiveTransmissionClass\":\"3\",\"aid\":\"bae5bafaeb93295d398bf55b8ba1cf01\",\"timestamp\":\"1755541882619\",\"cid\":\"4092825518eaf67377a6e4492ae44577\",\"TargetFileName\":\"\\\\Device\\\\Local\\\\Default\\\\Files\\\\asdf-ghkl\"}", + "outcome": "success", + "type": [ + "creation" + ] }, "file": { "directory": "\\Device\\Local\\Default\\Files", @@ -11696,6 +11701,846 @@ "tags": [ "preserve_original_event" ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "3995347011", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "17", + "IdpPerfCounterMaximum": 95629312, + "IdpPerfCounterMinimum": 95531008, + "IdpPerfCounterPath": "\\Process(lsass)\\Working Set", + "IdpPerfCounterSum": 2868150272, + "IdpPerfSampleCount": 30, + "IdpPerfSampleDuration": "2999997209", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "IdpDcPerfReport", + "id": "11633f5f-6a9c-4a6a-a39b-f01bce8a2f37", + "name": "IdpDcPerfReportV1" + }, + "device": { + "id": "3f4218d0c561464c9ef5d1c81000fc38" + }, + "event": { + "action": "IdpDcPerfReport", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "11633f5f-6a9c-4a6a-a39b-f01bce8a2f37|3f4218d0c561464c9ef5d1c81000fc38|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"IdpDcPerfReport\",\"LocalAddressIP4\":\"192.0.2.10\",\"ConfigStateHash\":\"3995347011\",\"IdpPerfCounterPath\":\"\\\\Process(lsass)\\\\Working Set\",\"aip\":\"192.0.2.1\",\"IdpPerfSampleDuration\":\"2999997209\",\"IdpPerfCounterMaximum\":\"95629312\",\"IdpPerfSampleCount\":\"30\",\"ConfigBuild\":\"1007.3.0021003.15\",\"event_platform\":\"Win\",\"IdpPerfCounterMinimum\":\"95531008\",\"Entitlements\":\"15\",\"name\":\"IdpDcPerfReportV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"WIN-HOST-01\",\"IdpPerfCounterSum\":\"2868150272\",\"id\":\"11633f5f-6a9c-4a6a-a39b-f01bce8a2f37\",\"EffectiveTransmissionClass\":\"2\",\"aid\":\"3f4218d0c561464c9ef5d1c81000fc38\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "3f4218d0c561464c9ef5d1c81000fc38", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.1" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.1" + ], + "serial_number": "3f4218d0c561464c9ef5d1c81000fc38", + "version": "1007.3.0021003.15" + }, + "related": { + "hash": [ + "3995347011" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.1", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AccountDomain": "EXAMPLE.LOCAL", + "AccountObjectGuid": "82b2a1e4-585d-4d47-8f55-19b76b14a66f", + "AccountObjectSid": "S-1-5-21-000000000-000000000-000000000-1477", + "ContextTimeStamp": "2026-06-04T12:23:17.000Z", + "SamAccountName": "SVC-ACCT$", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "ActiveDirectoryAccountCreated", + "id": "d1972344-dae4-4cd5-910c-fbd6d71d4431", + "name": "ActiveDirectoryAccountCreatedV1" + }, + "event": { + "action": "ActiveDirectoryAccountCreated", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "d1972344-dae4-4cd5-910c-fbd6d71d4431||2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"ActiveDirectoryAccountCreated\",\"SamAccountName\":\"SVC-ACCT$\",\"ContextTimeStamp\":\"1780575797.000\",\"AccountDomain\":\"EXAMPLE.LOCAL\",\"aip\":\"\",\"event_platform\":\"Win\",\"name\":\"ActiveDirectoryAccountCreatedV1\",\"id\":\"d1972344-dae4-4cd5-910c-fbd6d71d4431\",\"AccountObjectGuid\":\"82b2a1e4-585d-4d47-8f55-19b76b14a66f\",\"aid\":\"\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"AccountObjectSid\":\"S-1-5-21-000000000-000000000-000000000-1477\"}", + "outcome": "success", + "type": [ + "creation" + ] + }, + "host": { + "os": { + "type": "windows" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AuthenticationId": "745263870", + "ConfigStateHash": "318902667", + "ContextProcessId": "21475403566", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "LogonType": "2", + "PatternId": "10199", + "PatternIdList": [ + "7149", + "7212", + "8111" + ], + "RemoteAccount": "0", + "TemplateDisposition": "10", + "TemplateInstanceId": "19717", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "LogonBehaviorCompositionDetectInfo", + "id": "34376fb6-4e59-4a1f-8fba-dac1fd55fe34", + "name": "LogonBehaviorCompositionDetectInfoV2" + }, + "destination": { + "address": "127.0.0.1", + "ip": "127.0.0.1" + }, + "device": { + "id": "1a9dad0d78b44af9a1bee299862e7b4d" + }, + "event": { + "action": "LogonBehaviorCompositionDetectInfo", + "category": [ + "session" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "34376fb6-4e59-4a1f-8fba-dac1fd55fe34|1a9dad0d78b44af9a1bee299862e7b4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"LogonBehaviorCompositionDetectInfo\",\"TemplateInstanceId\":\"19717\",\"aip\":\"192.0.2.2\",\"LogonDomain\":\"WIN-HOST-01\",\"RemoteAccount\":\"0\",\"event_platform\":\"Win\",\"PatternId\":\"10199\",\"EventOrigin\":\"1\",\"id\":\"34376fb6-4e59-4a1f-8fba-dac1fd55fe34\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ConfigStateHash\":\"318902667\",\"TemplateDisposition\":\"10\",\"ContextProcessId\":\"21475403566\",\"LogonType\":\"2\",\"AuthenticationId\":\"745263870\",\"ConfigBuild\":\"1007.3.0020907.15\",\"CommandLine\":\"System\",\"ImageFileName\":\"System\",\"Entitlements\":\"15\",\"name\":\"LogonBehaviorCompositionDetectInfoV2\",\"ComputerName\":\"WIN-HOST-01\",\"PatternIdList\":\"7149,7212,8111\",\"RemoteAddressIP4\":\"127.0.0.1\",\"aid\":\"1a9dad0d78b44af9a1bee299862e7b4d\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "domain": "WIN-HOST-01", + "hostname": "WIN-HOST-01", + "id": "1a9dad0d78b44af9a1bee299862e7b4d", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "1a9dad0d78b44af9a1bee299862e7b4d", + "version": "1007.3.0020907.15" + }, + "process": { + "args": [ + "System" + ], + "args_count": 1, + "command_line": "System", + "entity_id": "21475403566", + "executable": "System", + "name": "System" + }, + "related": { + "hash": [ + "318902667" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10", + "127.0.0.1" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "CloudRequestId": "201ba0eb-161d-4a37-99bd-4e0d8865b183", + "ConfigStateHash": "2473141737", + "ContextTimeStamp": "2026-06-03T12:02:38.763Z", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "EventOrigin": "17", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "Status": "0", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "NetworkContainmentCompleted", + "id": "a3277aa2-a123-41d5-86bd-e6fad46f35a4", + "name": "NetworkContainmentCompletedV1" + }, + "device": { + "id": "cbaab7c6e77c44099fd72d81073f9883" + }, + "event": { + "action": "NetworkContainmentCompleted", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "a3277aa2-a123-41d5-86bd-e6fad46f35a4|cbaab7c6e77c44099fd72d81073f9883|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"NetworkContainmentCompleted\",\"Status\":\"0\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1780488158.763\",\"ConfigStateHash\":\"2473141737\",\"CloudRequestId\":\"201ba0eb-161d-4a37-99bd-4e0d8865b183\",\"aip\":\"192.0.2.2\",\"ConfigBuild\":\"1007.3.0020805.15\",\"event_platform\":\"Win\",\"Entitlements\":\"15\",\"name\":\"NetworkContainmentCompletedV1\",\"EventOrigin\":\"17\",\"ComputerName\":\"WIN-HOST-01\",\"id\":\"a3277aa2-a123-41d5-86bd-e6fad46f35a4\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"cbaab7c6e77c44099fd72d81073f9883\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "connection" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "cbaab7c6e77c44099fd72d81073f9883", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "cbaab7c6e77c44099fd72d81073f9883", + "version": "1007.3.0020805.15" + }, + "related": { + "hash": [ + "2473141737" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "765810426", + "ContextProcessId": "13002244", + "ContextTimeStamp": "2026-06-02T05:25:15.226Z", + "EffectiveTransmissionClass": "2", + "Entitlements": "15", + "EventOrigin": "17", + "HbfwRuleFlags": "7", + "HbfwRuleId": "3", + "LocalAddressIP4": [ + "224.0.0.251" + ], + "NetworkInterfaceGuid": "00796106-8fee-442e-90ea-956af504c46d", + "NetworkProfile": "2", + "PolicyIdentifier": "f7ee517b-ff8f-4f51-ad8e-6f134f19f617", + "RuleAction": "1", + "RuleMatchCount": 1, + "RuleMatchCountSinceLastReport": 16681, + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "FirewallRuleIP4Matched", + "id": "23205a0d-b279-4527-9355-65506561b8ce", + "name": "FirewallRuleIP4MatchedV6" + }, + "destination": { + "address": "224.0.0.251", + "ip": "224.0.0.251", + "port": 5353 + }, + "device": { + "id": "460f573fda4744708f60437e2484a38c" + }, + "event": { + "action": "FirewallRuleIP4Matched", + "category": [ + "network" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "23205a0d-b279-4527-9355-65506561b8ce|460f573fda4744708f60437e2484a38c|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"FirewallRuleIP4Matched\",\"RuleAction\":\"1\",\"aip\":\"192.0.2.2\",\"RuleMatchCount\":\"1\",\"event_platform\":\"Win\",\"EventOrigin\":\"17\",\"id\":\"23205a0d-b279-4527-9355-65506561b8ce\",\"Protocol\":\"17\",\"EffectiveTransmissionClass\":\"2\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"224.0.0.251\",\"ContextTimeStamp\":\"1780377915.226\",\"RuleMatchCountSinceLastReport\":\"16681\",\"ConfigStateHash\":\"765810426\",\"ContextProcessId\":\"13002244\",\"RemotePort\":\"5353\",\"HbfwRuleId\":\"3\",\"NetworkInterfaceGuid\":\"00796106-8fee-442e-90ea-956af504c46d\",\"ConfigBuild\":\"1007.3.0020907.15\",\"NetworkProfile\":\"2\",\"CommandLine\":\"C:\\\\Windows\\\\system32\\\\svchost.exe -k NetworkService -p\",\"PolicyIdentifier\":\"f7ee517b-ff8f-4f51-ad8e-6f134f19f617\",\"LocalPort\":\"5353\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\svchost.exe\",\"Entitlements\":\"15\",\"name\":\"FirewallRuleIP4MatchedV6\",\"ComputerName\":\"WIN-HOST-01\",\"HbfwRuleFlags\":\"7\",\"aid\":\"460f573fda4744708f60437e2484a38c\",\"RemoteAddressIP4\":\"192.0.2.20\",\"ConnectionDirection\":\"1\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "460f573fda4744708f60437e2484a38c", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "network": { + "community_id": "1:0AEopPSKSJS3LgYrhamC7npNkJc=", + "direction": "inbound", + "iana_number": "17", + "transport": "udp" + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "460f573fda4744708f60437e2484a38c", + "version": "1007.3.0020907.15" + }, + "process": { + "args": [ + "C:\\Windows\\system32\\svchost.exe", + "-k", + "NetworkService", + "-p" + ], + "args_count": 4, + "command_line": "C:\\Windows\\system32\\svchost.exe -k NetworkService -p", + "entity_id": "13002244", + "executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\svchost.exe", + "name": "svchost.exe" + }, + "related": { + "hash": [ + "765810426" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "224.0.0.251", + "192.0.2.20" + ] + }, + "source": { + "address": "192.0.2.20", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.20", + "port": 5353 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "AgentLoadFlags": "17", + "ConfigStateHash": "386343172", + "ContextTimeStamp": "2026-06-13T10:59:30.024Z", + "EffectiveTransmissionClass": "0", + "Entitlements": "15", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "ProvisioningStarted", + "id": "3b430dcb-dcef-4a8d-b85a-42f9c49c66de", + "name": "ProvisioningStartedV1" + }, + "device": { + "id": "1a9dad0d78b44af9a1bee299862e7b4d" + }, + "event": { + "action": "ProvisioningStarted", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "3b430dcb-dcef-4a8d-b85a-42f9c49c66de|1a9dad0d78b44af9a1bee299862e7b4d|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"ProvisioningStarted\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781348370.024\",\"ConfigStateHash\":\"386343172\",\"aip\":\"192.0.2.2\",\"ConfigBuild\":\"0.3.0020907.15\",\"event_platform\":\"Win\",\"AgentLoadFlags\":\"17\",\"Entitlements\":\"15\",\"name\":\"ProvisioningStartedV1\",\"ComputerName\":\"WIN-HOST-01\",\"id\":\"3b430dcb-dcef-4a8d-b85a-42f9c49c66de\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"1a9dad0d78b44af9a1bee299862e7b4d\",\"timestamp\":\"1743508799999\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "1a9dad0d78b44af9a1bee299862e7b4d", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "1a9dad0d78b44af9a1bee299862e7b4d", + "version": "0.3.0020907.15" + }, + "related": { + "hash": [ + "386343172" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "ConfigStateHash": "4108388545", + "ContextTimeStamp": "2026-06-18T04:47:11.318Z", + "DiagnosticResultContext": "24:PPU", + "DiagnosticRunId": "34207803-666a-f111-b253-8cc6813d0f30", + "DiagnosticRunType": "0", + "DiagnosticTriggerContext": "Scheduled", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "MigoTemplateId": "307", + "MigoTemplateInstanceId": "15724", + "MigoTemplateInstanceVersion": "8", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "SensorSelfDiagnosticTelemetry", + "id": "ececeff9-9999-45ea-8a62-c620f9475548", + "name": "SensorSelfDiagnosticTelemetryV1" + }, + "device": { + "id": "6e3d57c5d4dc483dac3628aee2ca62a9" + }, + "event": { + "action": "SensorSelfDiagnosticTelemetry", + "category": [ + "configuration" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "ececeff9-9999-45ea-8a62-c620f9475548|6e3d57c5d4dc483dac3628aee2ca62a9|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"SensorSelfDiagnosticTelemetry\",\"aip\":\"192.0.2.2\",\"MigoTemplateInstanceVersion\":\"8\",\"event_platform\":\"Win\",\"MigoTemplateId\":\"307\",\"EventOrigin\":\"1\",\"id\":\"ececeff9-9999-45ea-8a62-c620f9475548\",\"MigoTemplateInstanceId\":\"15724\",\"EffectiveTransmissionClass\":\"3\",\"timestamp\":\"1743508799999\",\"LocalAddressIP4\":\"192.0.2.10\",\"ContextTimeStamp\":\"1781758031.318\",\"ConfigStateHash\":\"4108388545\",\"DiagnosticRunId\":\"34207803-666a-f111-b253-8cc6813d0f30\",\"DiagnosticResultContext\":\"24:PPU\",\"DiagnosticTriggerContext\":\"Scheduled\",\"ConfigBuild\":\"1007.3.0020907.15\",\"DiagnosticRunType\":\"0\",\"Entitlements\":\"15\",\"name\":\"SensorSelfDiagnosticTelemetryV1\",\"ComputerName\":\"WIN-HOST-01\",\"aid\":\"6e3d57c5d4dc483dac3628aee2ca62a9\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "6e3d57c5d4dc483dac3628aee2ca62a9", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.2" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.2" + ], + "serial_number": "6e3d57c5d4dc483dac3628aee2ca62a9", + "version": "1007.3.0020907.15" + }, + "related": { + "hash": [ + "4108388545" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.2", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2025-04-01T11:59:59.999Z", + "crowdstrike": { + "BaseModuleName": "samcli.dll", + "ConfigStateHash": "3477107385", + "ContextProcessId": "160872222276", + "ContextTimeStamp": "2026-07-09T10:47:07.300Z", + "EffectiveTransmissionClass": "3", + "Entitlements": "15", + "EventOrigin": "1", + "LocalAddressIP4": [ + "192.0.2.10" + ], + "ModuleExportName": "NetUserGetInfo", + "PatternId": "10448", + "PatternIdList": [ + "446", + "7106", + "8111" + ], + "TemplateInstanceId": "17594", + "cid": "2cc98db1a47b4c98b913c94d43bfab70", + "event_simpleName": "XumdHookEvent", + "id": "7e857013-5bc5-4d68-9e08-6f30b8b50ccc", + "name": "XumdHookEventV3" + }, + "device": { + "id": "9fa290eb9c64449490d17a85801c6ebf" + }, + "event": { + "action": "XumdHookEvent", + "category": [ + "process" + ], + "created": "2025-04-01T11:59:59.999Z", + "id": "7e857013-5bc5-4d68-9e08-6f30b8b50ccc|9fa290eb9c64449490d17a85801c6ebf|2cc98db1a47b4c98b913c94d43bfab70", + "kind": "event", + "original": "{\"event_simpleName\":\"XumdHookEvent\",\"BaseModuleName\":\"samcli.dll\",\"CommandLine\":\"C:\\\\Program Files\\\\Example\\\\app.exe\",\"ComputerName\":\"WIN-HOST-01\",\"ConfigBuild\":\"1007.3.0021003.15\",\"ConfigStateHash\":\"3477107385\",\"ContextProcessId\":\"160872222276\",\"ContextTimeStamp\":\"1783594027.300\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"EventOrigin\":\"1\",\"ImageFileName\":\"\\\\Device\\\\HarddiskVolume3\\\\Program Files\\\\Example\\\\app.exe\",\"LocalAddressIP4\":\"192.0.2.10\",\"ModuleExportName\":\"NetUserGetInfo\",\"PatternId\":\"10448\",\"PatternIdList\":\"446,7106,8111\",\"TemplateInstanceId\":\"17594\",\"aid\":\"9fa290eb9c64449490d17a85801c6ebf\",\"aip\":\"192.0.2.3\",\"cid\":\"2cc98db1a47b4c98b913c94d43bfab70\",\"event_platform\":\"Win\",\"id\":\"7e857013-5bc5-4d68-9e08-6f30b8b50ccc\",\"name\":\"XumdHookEventV3\",\"timestamp\":\"1743508799999\"}", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "host": { + "hostname": "WIN-HOST-01", + "id": "9fa290eb9c64449490d17a85801c6ebf", + "name": "WIN-HOST-01", + "os": { + "type": "windows" + } + }, + "observer": { + "address": [ + "192.0.2.3" + ], + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": [ + "192.0.2.3" + ], + "serial_number": "9fa290eb9c64449490d17a85801c6ebf", + "version": "1007.3.0021003.15" + }, + "process": { + "args": [ + "C:\\Program", + "Files\\Example\\app.exe" + ], + "args_count": 2, + "command_line": "C:\\Program Files\\Example\\app.exe", + "entity_id": "160872222276", + "executable": "\\Device\\HarddiskVolume3\\Program Files\\Example\\app.exe", + "name": "app.exe" + }, + "related": { + "hash": [ + "3477107385" + ], + "hosts": [ + "WIN-HOST-01" + ], + "ip": [ + "192.0.2.3", + "192.0.2.10" + ] + }, + "source": { + "address": "192.0.2.10", + "as": { + "number": 64500, + "organization": { + "name": "Documentation ASN" + } + }, + "geo": { + "city_name": "Las Vegas", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 36.17497, + "lon": -115.13722 + }, + "region_iso_code": "US-NV", + "region_name": "Nevada" + }, + "ip": "192.0.2.10" + }, + "tags": [ + "preserve_original_event" + ] } ] } diff --git a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml index e4e109d3797..22b4039a365 100644 --- a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml +++ b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml @@ -25,6 +25,34 @@ processors: outcome: success type: - deletion + ActiveDirectoryAccountCreated: + category: + - configuration + kind: event + outcome: success + type: + - creation + ActiveDirectoryAccountDirectContainingGroupEntitiesUpdate: + category: + - configuration + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountFlattenedContainingGroupEntitiesUpdate: + category: + - configuration + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountPasswordUpdate: + category: + - configuration + kind: event + outcome: success + type: + - change ActiveDirectoryAuthentication: category: - authentication @@ -137,6 +165,13 @@ processors: outcome: success type: - creation + ArcFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation AsepFileChange: category: - file @@ -197,6 +232,14 @@ processors: type: - connection - creation + BPFCommandIssued: + category: + - process + - network + kind: event + outcome: success + type: + - info BZip2FileWritten: category: - file @@ -218,6 +261,13 @@ processors: outcome: unknown type: - info + BlfFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation BmpFileWritten: category: - file @@ -254,6 +304,13 @@ processors: outcome: unknown type: - info + ChannelVersionRequired: + category: + - configuration + kind: event + outcome: unknown + type: + - info ClassifiedModuleLoad: category: - library @@ -310,6 +367,21 @@ processors: outcome: success type: - change + CreateSocket: + category: + - network + kind: event + outcome: success + type: + - start + - connection + CreateThreadKernelNoStartImage: + category: + - process + kind: event + outcome: success + type: + - start CreateThreadNoStartImage: category: - process @@ -367,6 +439,13 @@ processors: outcome: unknown type: - info + DBusMessage: + category: + - configuration + kind: event + outcome: unknown + type: + - info DCSyncAttempted: category: - configuration @@ -375,6 +454,13 @@ processors: outcome: unknown type: - access + DNSRequestDetectInfo: + category: + - network + kind: event + outcome: unknown + type: + - info DataEgressEnriched: category: - file @@ -389,6 +475,27 @@ processors: outcome: unknown type: - start + DcBluetoothDeviceDisconnected: + category: + - driver + kind: event + outcome: unknown + type: + - end + DcBluetoothDeviceProperties: + category: + - driver + kind: state + outcome: unknown + type: + - info + DcIdentification: + category: + - host + kind: event + outcome: success + type: + - info DcOffline: category: - iam @@ -452,6 +559,13 @@ processors: outcome: unknown type: - info + DebFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation DeliverLocalFXToCloud: category: - file @@ -488,6 +602,13 @@ processors: outcome: unknown type: - info + DiskUtilization: + category: + - host + kind: state + outcome: unknown + type: + - info DllInjection: category: - process @@ -531,6 +652,13 @@ processors: outcome: success type: - start + DriverPreventionStatus: + category: + - driver + kind: state + outcome: unknown + type: + - info DwgFileWritten: category: - file @@ -573,6 +701,13 @@ processors: outcome: failure type: - info + EseFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation EtwComponentResponse: category: - host @@ -666,6 +801,14 @@ processors: outcome: success type: - change + FileSystemContainmentStatus: + category: + - file + - host + kind: state + outcome: unknown + type: + - info FileSystemOperationBlocked: category: - file @@ -748,6 +891,20 @@ processors: outcome: success type: - change + FirewallRuleIP4Matched: + category: + - network + kind: event + outcome: success + type: + - info + FirewallRuleIP6Matched: + category: + - network + kind: event + outcome: success + type: + - info FirewallSetRule: category: - configuration @@ -923,6 +1080,62 @@ processors: outcome: success type: - change + IdpCloudHealthCheck: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpCloudHealthStatus: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpDcPerfReport: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpDcTiConfiguration: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpPolicyAccessRuleMatch: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpTelemetryData: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogConfigurationsGetResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogConfigurationsSetResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info ImageHash: category: - library @@ -930,6 +1143,13 @@ processors: outcome: success type: - start + ImgExtensionFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation InjectedThread: category: - process @@ -1105,6 +1325,13 @@ processors: outcome: unknown type: - info + LnkFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation LocalIpAddressIP4: category: - configuration @@ -1152,6 +1379,13 @@ processors: outcome: unknown type: - creation + LogonBehaviorCompositionDetectInfo: + category: + - session + kind: event + outcome: unknown + type: + - info LsassHandleFromUnsignedModule: category: - process @@ -1218,6 +1452,21 @@ processors: type: - change - creation + MemoryProtectionChanged: + category: + - process + - configuration + kind: event + outcome: success + type: + - change + MemoryScanEnabled: + category: + - configuration + kind: state + outcome: success + type: + - info ModifyServiceBinary: category: - file @@ -1257,6 +1506,20 @@ processors: outcome: unknown type: - info + ModuleLoadV3DetectInfo: + category: + - library + kind: event + outcome: unknown + type: + - start + MotwWritten: + category: + - file + kind: event + outcome: success + type: + - creation MountedVolume: category: - file @@ -1264,6 +1527,13 @@ processors: outcome: success type: - info + MsiFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation MsiTransactionExecuted: category: - package @@ -1340,6 +1610,29 @@ processors: type: - start - connection + NetworkContainmentCompleted: + category: + - network + kind: event + outcome: success + type: + - connection + NetworkLinkConfigGetAddress: + category: + - network + - configuration + kind: event + outcome: success + type: + - info + NetworkLinkConfigGetLink: + category: + - network + - configuration + kind: event + outcome: success + type: + - info NetworkListenIP4: category: - network @@ -1372,6 +1665,13 @@ processors: - allowed - access - connection + NetworkUncontainmentCompleted: + category: + - network + kind: event + outcome: success + type: + - connection NewExecutableRenamed: category: - file @@ -1393,6 +1693,13 @@ processors: outcome: success type: - creation + OciContainerInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info OciContainerTelemetry: category: - host @@ -1453,6 +1760,13 @@ processors: outcome: success type: - info + PackageManagerDownloadComplete: + category: + - file + kind: event + outcome: success + type: + - creation PackedExecutableWritten: category: - file @@ -1460,6 +1774,15 @@ processors: outcome: success type: - creation + PacketFilterAttached: + category: + - configuration + - network + kind: event + outcome: success + type: + - change + - info PdfFileWritten: category: - file @@ -1569,6 +1892,13 @@ processors: outcome: success type: - end + ProcessSignal: + category: + - process + kind: event + outcome: unknown + type: + - info ProcessSubstituteUser: category: - iam @@ -1584,6 +1914,34 @@ processors: outcome: success type: - change + ProvisioningChannelVersionRequired: + category: + - configuration + kind: event + outcome: unknown + type: + - info + ProvisioningEnded: + category: + - configuration + kind: event + outcome: unknown + type: + - info + ProvisioningStarted: + category: + - configuration + kind: event + outcome: unknown + type: + - info + ProvisioningStatusUpdate: + category: + - configuration + kind: event + outcome: unknown + type: + - change PtActivationStatus: category: - host @@ -1591,6 +1949,13 @@ processors: outcome: unknown type: - info + PtyAttached: + category: + - process + kind: event + outcome: success + type: + - start PtyCreated: category: - file @@ -1598,6 +1963,20 @@ processors: outcome: success type: - creation + PtyDetached: + category: + - process + kind: event + outcome: success + type: + - end + PythonFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation QuarantineActionResult: category: - file @@ -1728,6 +2107,14 @@ processors: outcome: success type: - change + RegistryHiveFileWritten: + category: + - registry + - file + kind: event + outcome: success + type: + - creation RegistryOperationDetectInfo: category: - registry @@ -1743,6 +2130,13 @@ processors: outcome: success type: - info + RemoteCommandResponse: + category: + - host + kind: event + outcome: unknown + type: + - info RemovableDiskModuleLoadAttempt: category: - configuration @@ -1766,6 +2160,13 @@ processors: outcome: unknown type: - info + RootkitDetectionResponse: + category: + - process + kind: event + outcome: unknown + type: + - info RtfFileWritten: category: - file @@ -1834,6 +2235,13 @@ processors: outcome: unknown type: - info + ScriptControlDotNetMetadata: + category: + - process + kind: event + outcome: unknown + type: + - info ScriptControlErrorEvent: category: - malware @@ -1858,6 +2266,13 @@ processors: outcome: success type: - info + ScriptFileWrittenInfo: + category: + - file + kind: event + outcome: success + type: + - creation SensitiveWmiQuery: category: - process @@ -1878,12 +2293,33 @@ processors: outcome: success type: - info + SensorMetadataUpdate: + category: + - configuration + kind: event + outcome: unknown + type: + - change + SensorSelfDiagnosticTelemetry: + category: + - configuration + kind: event + outcome: unknown + type: + - info SensorSettingsUpdate: category: - configuration kind: event type: - change + SensorTampering: + category: + - configuration + kind: event + outcome: unknown + type: + - info ServiceStarted: category: - process @@ -1919,6 +2355,13 @@ processors: outcome: success type: - creation + SharedObjectLoaded: + category: + - library + kind: event + outcome: success + type: + - start SignInfoError: category: - file @@ -1986,6 +2429,27 @@ processors: outcome: success type: - change + SpotlightEntityBatch: + category: + - configuration + kind: event + outcome: unknown + type: + - info + SpotlightEntityBatchHeader: + category: + - configuration + kind: event + outcome: unknown + type: + - info + SpotlightEntitySystemState: + category: + - configuration + kind: event + outcome: unknown + type: + - info SudoCommandAttempt: category: - authentication @@ -2065,6 +2529,34 @@ processors: outcome: success type: - start + SyntheticSharedObjectLoaded: + category: + - library + kind: event + outcome: success + type: + - start + SyntheticSystemdServiceCreated: + category: + - configuration + kind: event + outcome: success + type: + - creation + SyntheticSystemdTimerCreated: + category: + - configuration + kind: event + outcome: success + type: + - creation + SyntheticVirtualMemoryArea: + category: + - process + kind: event + outcome: unknown + type: + - info SystemCapacity: category: - host @@ -2072,6 +2564,20 @@ processors: outcome: success type: - info + SystemdServiceCreated: + category: + - configuration + kind: event + outcome: success + type: + - creation + SystemdServiceDeleted: + category: + - configuration + kind: event + outcome: success + type: + - deletion TarFileWritten: category: - file @@ -2211,6 +2717,14 @@ processors: outcome: success type: - deletion + UserAccountRemovedFromGroup: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change UserExceptionDEP: category: - process @@ -2263,6 +2777,13 @@ processors: outcome: failure type: - start + VirtualMemoryArea: + category: + - process + kind: event + outcome: unknown + type: + - info VolumeSnapshotCreated: category: - file @@ -2277,6 +2798,13 @@ processors: outcome: success type: - deletion + WebScriptFileWritten: + category: + - file + kind: event + outcome: success + type: + - creation WfpFilterTamperingFilterAdded: category: - configuration @@ -2326,6 +2854,13 @@ processors: outcome: success type: - creation + XumdHookEvent: + category: + - process + kind: event + outcome: unknown + type: + - info XumdStatus: category: - host diff --git a/packages/crowdstrike/data_stream/fdr/fields/fields.yml b/packages/crowdstrike/data_stream/fdr/fields/fields.yml index 21b9ea0b0f0..cc583230925 100644 --- a/packages/crowdstrike/data_stream/fdr/fields/fields.yml +++ b/packages/crowdstrike/data_stream/fdr/fields/fields.yml @@ -3,6 +3,10 @@ - name: crowdstrike type: group fields: + - name: BaseModuleName + type: keyword + - name: ModuleExportName + type: keyword - name: __mv_LocalAddressIP4 type: keyword - name: __mv_aip @@ -2319,6 +2323,102 @@ type: keyword - name: XumdSuccessStatusString type: keyword + - name: ActionBlocked + type: keyword + - name: CloudRequestId + type: match_only_text + - name: DBusDestination + type: match_only_text + - name: DBusInterface + type: match_only_text + - name: DBusMember + type: match_only_text + - name: DBusMessageFlags + type: keyword + - name: DBusMessageKind + type: match_only_text + - name: DBusNumUnixFiles + type: keyword + - name: DBusPath + type: match_only_text + - name: DBusPayload + type: match_only_text + - name: DBusReplySerial + type: keyword + - name: DBusSerial + type: keyword + - name: DiagnosticResultContext + type: match_only_text + - name: DiagnosticRunId + type: keyword + - name: DiagnosticRunType + type: keyword + - name: DiagnosticTriggerContext + type: match_only_text + - name: FilterContent + type: match_only_text + - name: FilterLength + type: keyword + - name: HbfwRuleFlags + type: keyword + - name: HbfwRuleId + type: keyword + - name: IdpPerfCounterMaximum + type: long + - name: IdpPerfCounterMinimum + type: long + - name: IdpPerfCounterPath + type: match_only_text + - name: IdpPerfCounterSum + type: long + - name: IdpPerfSampleCount + type: long + - name: IdpPerfSampleDuration + type: keyword + - name: MigoTemplateId + type: keyword + - name: MigoTemplateInstanceId + type: keyword + - name: MigoTemplateInstanceVersion + type: keyword + - name: NetlinkFamily + type: keyword + - name: NetworkProfile + type: keyword + - name: PolicyIdentifier + type: match_only_text + - name: ResourceName + type: match_only_text + - name: RuleAction + type: keyword + - name: RuleMatchCount + type: long + - name: RuleMatchCountSinceLastReport + type: long + - name: SessionPatternIdList + type: match_only_text + - name: SocketType + type: keyword + - name: SourceCommandLine + type: match_only_text + - name: SourceImageFileName + type: match_only_text + - name: SystemdUnitActiveState + type: match_only_text + - name: SystemdUnitFileState + type: match_only_text + - name: SystemdUnitLoadState + type: match_only_text + - name: SystemdUnitName + type: match_only_text + - name: SystemdUnitPath + type: match_only_text + - name: SystemdUnitProperties + type: match_only_text + - name: TamperingAction + type: match_only_text + - name: VirtualAddress + type: keyword - name: dll.Ext.size type: long description: Size of DLL. diff --git a/packages/crowdstrike/docs/README.md b/packages/crowdstrike/docs/README.md index 6d0a7d51246..c0eddc50c78 100644 --- a/packages/crowdstrike/docs/README.md +++ b/packages/crowdstrike/docs/README.md @@ -1810,8 +1810,11 @@ An example event for `fdr` looks as following: | crowdstrike.AccountObjectGuid | | match_only_text | | crowdstrike.AccountObjectSid | | match_only_text | | crowdstrike.AccountType | | keyword | +| crowdstrike.ActionBlocked | | keyword | | crowdstrike.ActiveCpuCount | | long | | crowdstrike.ActiveDirectoryAuthenticationMethod | | keyword | +| crowdstrike.ActiveDirectoryDirectGroupObjectGuidsBuffer | | match_only_text | +| crowdstrike.ActiveDirectoryFlattenedGroupObjectGuidsBuffer | | match_only_text | | crowdstrike.ActivityId | | keyword | | crowdstrike.AddressFamily | | keyword | | crowdstrike.AdminStatus | | keyword | @@ -1852,6 +1855,11 @@ An example event for `fdr` looks as following: | crowdstrike.AvailableDiskSpace | | keyword | | crowdstrike.AverageCpuUsage | | keyword | | crowdstrike.AverageUsedRam | | keyword | +| crowdstrike.BPFCmd | | keyword | +| crowdstrike.BPFProgAttachBtfId | | keyword | +| crowdstrike.BPFProgLicense | | match_only_text | +| crowdstrike.BPFProgName | | match_only_text | +| crowdstrike.BPFProgType | | keyword | | crowdstrike.BaseFileName | | keyword | | crowdstrike.BaseReachableTime | | keyword | | crowdstrike.BatchDataNumber | | keyword | @@ -1913,10 +1921,12 @@ An example event for `fdr` looks as following: | crowdstrike.CertificateSignatureHashAlgorithm | | keyword | | crowdstrike.ChangeId | | keyword | | crowdstrike.ChangeTime | | date | +| crowdstrike.ChangeTimeNs | | keyword | | crowdstrike.ChangedPcrBitmap | | match_only_text | | crowdstrike.ChannelDiffStatus | | keyword | | crowdstrike.ChannelId | | keyword | | crowdstrike.ChannelVersion | | keyword | +| crowdstrike.ChannelVersionAttempted | | keyword | | crowdstrike.ChannelVersionRequired | | keyword | | crowdstrike.ChasisManufacturer | | keyword | | crowdstrike.ChassisType | | keyword | @@ -1925,6 +1935,7 @@ An example event for `fdr` looks as following: | crowdstrike.ClientProcessStartKey | | keyword | | crowdstrike.CloudErrorCode | | keyword | | crowdstrike.CloudIndicator | | boolean | +| crowdstrike.CloudRequestId | | match_only_text | | crowdstrike.CommandCount | | match_only_text | | crowdstrike.CommandCountMax | | match_only_text | | crowdstrike.CommandHistory | | keyword | @@ -1973,7 +1984,18 @@ An example event for `fdr` looks as following: | crowdstrike.CurrentFunctionalityLevel | | keyword | | crowdstrike.CurrentLocalIP | | ip | | crowdstrike.CustomerIdString | | keyword | +| crowdstrike.CvrFlags | | keyword | | crowdstrike.CycleTime | | long | +| crowdstrike.DBusDestination | | match_only_text | +| crowdstrike.DBusInterface | | match_only_text | +| crowdstrike.DBusMember | | match_only_text | +| crowdstrike.DBusMessageFlags | | keyword | +| crowdstrike.DBusMessageKind | | match_only_text | +| crowdstrike.DBusNumUnixFiles | | keyword | +| crowdstrike.DBusPath | | match_only_text | +| crowdstrike.DBusPayload | | match_only_text | +| crowdstrike.DBusReplySerial | | keyword | +| crowdstrike.DBusSerial | | keyword | | crowdstrike.DadState | | keyword | | crowdstrike.DadTransmits | | keyword | | crowdstrike.Data1 | | keyword | @@ -2015,6 +2037,10 @@ An example event for `fdr` looks as following: | crowdstrike.DeviceUsbVersion | | keyword | | crowdstrike.DeviceVendorId | | keyword | | crowdstrike.DeviceVersion | | keyword | +| crowdstrike.DiagnosticResultContext | | match_only_text | +| crowdstrike.DiagnosticRunId | | keyword | +| crowdstrike.DiagnosticRunType | | keyword | +| crowdstrike.DiagnosticTriggerContext | | match_only_text | | crowdstrike.DirectionType | | keyword | | crowdstrike.DirectoryCreatedCount | | long | | crowdstrike.DirectoryEnumeratedCount | | long | @@ -2030,6 +2056,7 @@ An example event for `fdr` looks as following: | crowdstrike.DownloadPort | | long | | crowdstrike.DownloadServer | | keyword | | crowdstrike.DriverLoadFlags | | keyword | +| crowdstrike.DriverPreventionStatusFlags | | keyword | | crowdstrike.DualRequest | | keyword | | crowdstrike.DylibPath | | match_only_text | | crowdstrike.ELFSubType | | keyword | @@ -2109,8 +2136,13 @@ An example event for `fdr` looks as following: | crowdstrike.FileObject | | keyword | | crowdstrike.FileOperatorSid | | keyword | | crowdstrike.FilePath | | keyword | +| crowdstrike.FileSerialNumber | | keyword | | crowdstrike.FileSigningTime | | keyword | | crowdstrike.FileSubType | | keyword | +| crowdstrike.FileSystemContainmentBlockPolicy | | keyword | +| crowdstrike.FileSystemContainmentBlockSource | | keyword | +| crowdstrike.FileSystemContainmentBlockState | | keyword | +| crowdstrike.FileSystemContainmentBlockStatus | | keyword | | crowdstrike.FileSystemOperationType | | keyword | | crowdstrike.FileType.Type.CategoryID | | keyword | | crowdstrike.FileType.Type.CategoryName | | keyword | @@ -2127,6 +2159,8 @@ An example event for `fdr` looks as following: | crowdstrike.FilesWritten.FileName | | keyword | | crowdstrike.FilesWritten.FilePath | | keyword | | crowdstrike.FilesWritten.Timestamp | | date | +| crowdstrike.FilterContent | | match_only_text | +| crowdstrike.FilterLength | | keyword | | crowdstrike.FirewallAction | | keyword | | crowdstrike.FirewallOption | | keyword | | crowdstrike.FirewallOptionNumericValue | | keyword | @@ -2151,6 +2185,7 @@ An example event for `fdr` looks as following: | crowdstrike.FontFileCount | | long | | crowdstrike.FontFileName | | keyword | | crowdstrike.FontLoadOperation | | keyword | +| crowdstrike.FsMagic | | keyword | | crowdstrike.FsOperationClassification | | keyword | | crowdstrike.FsOperationClassificationFlags | | keyword | | crowdstrike.FullExceptionRecord | | keyword | @@ -2172,6 +2207,8 @@ An example event for `fdr` looks as following: | crowdstrike.HandleCreated | | keyword | | crowdstrike.HandleOperationType | | keyword | | crowdstrike.HashAlgorithm | | keyword | +| crowdstrike.HbfwRuleFlags | | keyword | +| crowdstrike.HbfwRuleId | | keyword | | crowdstrike.HostGroups | | keyword | | crowdstrike.HostHiddenStatus | | keyword | | crowdstrike.HostProcessType | | keyword | @@ -2192,6 +2229,69 @@ An example event for `fdr` looks as following: | crowdstrike.IcmpCode | | keyword | | crowdstrike.IcmpType | | keyword | | crowdstrike.Id | | keyword | +| crowdstrike.IdpCloudConnectivityState | | keyword | +| crowdstrike.IdpDcerpcOverSmbProtocolConfigurationMode | | keyword | +| crowdstrike.IdpEntityId | | match_only_text | +| crowdstrike.IdpFeaturesToggleReason | | keyword | +| crowdstrike.IdpKerberosProtocolConfigurationMode | | keyword | +| crowdstrike.IdpLdapProtocolConfigurationMode | | keyword | +| crowdstrike.IdpLdapsProtocolConfigurationMode | | keyword | +| crowdstrike.IdpNtlmProtocolConfigurationMode | | keyword | +| crowdstrike.IdpPerfCounterMaximum | | keyword | +| crowdstrike.IdpPerfCounterMinimum | | keyword | +| crowdstrike.IdpPerfCounterPath | | match_only_text | +| crowdstrike.IdpPerfCounterSum | | keyword | +| crowdstrike.IdpPerfSampleCount | | long | +| crowdstrike.IdpPerfSampleDuration | | keyword | +| crowdstrike.IdpPolicyMode | | keyword | +| crowdstrike.IdpPolicyRuleAction | | keyword | +| crowdstrike.IdpPolicyRuleActionStatus | | keyword | +| crowdstrike.IdpPolicyRuleId | | match_only_text | +| crowdstrike.IdpPolicyRuleName | | match_only_text | +| crowdstrike.IdpRdpProtocolConfigurationMode | | keyword | +| crowdstrike.IdpSmbProtocolConfigurationMode | | keyword | +| crowdstrike.IdpTelemetryCollectionLast | | keyword | +| crowdstrike.IdpTelemetryCollectionPopulateTime | | keyword | +| crowdstrike.IdpTelemetryCollectionSequenceNumber | | keyword | +| crowdstrike.IdpTelemetryCollectionStartTime | | keyword | +| crowdstrike.IdpTrafficInspectionMode | | keyword | +| crowdstrike.IdpWatchdogConfigurationEnabled | | keyword | +| crowdstrike.IdpWatchdogMonitorConnectivityCountToEnableTrafficInspection | | long | +| crowdstrike.IdpWatchdogMonitorConnectivityDisabledTrafficInspectionThreshold | | keyword | +| crowdstrike.IdpWatchdogMonitorConnectivityEnabled | | keyword | +| crowdstrike.IdpWatchdogMonitorConnectivityPollingIntervalMs | | keyword | +| crowdstrike.IdpWatchdogMonitorCpuDuration | | keyword | +| crowdstrike.IdpWatchdogMonitorCpuPollingInterval | | keyword | +| crowdstrike.IdpWatchdogMonitorCpuRevertDuration | | keyword | +| crowdstrike.IdpWatchdogMonitorCpuRevertThreshold | | keyword | +| crowdstrike.IdpWatchdogMonitorCpuThreshold | | keyword | +| crowdstrike.IdpWatchdogMonitorMemoryEnabled | | keyword | +| crowdstrike.IdpWatchdogMonitorMemoryPollingIntervalMs | | keyword | +| crowdstrike.IdpWatchdogMonitorMemoryThreshold | | keyword | +| crowdstrike.IdpWatchdogMonitorNetStatisticsE2EHistogramIndex | | keyword | +| crowdstrike.IdpWatchdogMonitorNetStatisticsEnableRemediationMode | | keyword | +| crowdstrike.IdpWatchdogMonitorNetStatisticsEnabled | | keyword | +| crowdstrike.IdpWatchdogMonitorNetStatisticsNetCountThreshold | | long | +| crowdstrike.IdpWatchdogMonitorNetStatisticsNumberOfAllowedThresholdBreaches | | keyword | +| crowdstrike.IdpWatchdogMonitorNetStatisticsNumberOfPollingToRevertRemediationSteps | | keyword | +| crowdstrike.IdpWatchdogMonitorNetStatisticsPollingIntervalMs | | keyword | +| crowdstrike.IdpWatchdogMonitorNetStatisticsRevertThreshold | | keyword | +| crowdstrike.IdpWatchdogMonitorNetStatisticsThreshold | | keyword | +| crowdstrike.IdpWatchdogMonitorNetStatisticsWarmupTimeMs | | keyword | +| crowdstrike.IdpWatchdogMonitorNumberOfAllowedThresholdBreaches | | keyword | +| crowdstrike.IdpWatchdogMonitorNumberOfAllowedThresholdBreachesProtocols | | keyword | +| crowdstrike.IdpWatchdogMonitorNumberOfPollingToRevertProtocolsRemediationSteps | | keyword | +| crowdstrike.IdpWatchdogMonitorNumberOfPollingToRevertRemediationSteps | | keyword | +| crowdstrike.IdpWatchdogMonitorProtocolEndToEndEnabled | | keyword | +| crowdstrike.IdpWatchdogMonitorProtocolsPollingIntervalMs | | keyword | +| crowdstrike.IdpWatchdogMonitorProtocolsThresholdMs | | keyword | +| crowdstrike.IdpWatchdogMonitorServiceMemoryEnabled | | keyword | +| crowdstrike.IdpWatchdogMonitorServiceMemoryPollingIntervalMs | | keyword | +| crowdstrike.IdpWatchdogMonitorServiceMemoryThreshold | | keyword | +| crowdstrike.IdpWatchdogMonitorServiceNumberOfAllowedThresholdBreaches | | keyword | +| crowdstrike.IdpWatchdogMonitorServiceNumberOfPollingToRevertRemediationSteps | | keyword | +| crowdstrike.IdpWatchdogMonitorSystemCpuEnabled | | keyword | +| crowdstrike.IdpWatchdogNumberOfContainerRestarts | | keyword | | crowdstrike.IfType | | keyword | | crowdstrike.ImageBaseName | | keyword | | crowdstrike.ImageCheckSum | | keyword | @@ -2242,6 +2342,10 @@ An example event for `fdr` looks as following: | crowdstrike.IsEBPF | | keyword | | crowdstrike.IsFromDifferentMountNamespace | | keyword | | crowdstrike.IsHosted | | keyword | +| crowdstrike.IsIdpCloudHealthy | | keyword | +| crowdstrike.IsIdpEnabled | | keyword | +| crowdstrike.IsLateContainerEvent | | keyword | +| crowdstrike.IsNewEnforcementMode | | keyword | | crowdstrike.IsOnNetwork | | keyword | | crowdstrike.IsOnRemovableDisk | | keyword | | crowdstrike.IsProcessInitializing | | keyword | @@ -2261,12 +2365,15 @@ An example event for `fdr` looks as following: | crowdstrike.LdapSearchFilterSample | | match_only_text | | crowdstrike.LeadId | | keyword | | crowdstrike.LeadType | | keyword | +| crowdstrike.Length | | keyword | +| crowdstrike.LfoError | | keyword | | crowdstrike.LfoUploadFlags | | keyword | | crowdstrike.LightningLatencyState | | keyword | | crowdstrike.LightningResponseStatus | | keyword | | crowdstrike.Line | | keyword | | crowdstrike.LinkLocalAddressBehavior | | keyword | | crowdstrike.LinkLocalAddressTimeout | | keyword | +| crowdstrike.LinuxSensorBackend | | keyword | | crowdstrike.LocalAddressIP4 | | ip | | crowdstrike.LocalAddressIP6 | | ip | | crowdstrike.LocalAddressMaskIP4 | | keyword | @@ -2307,13 +2414,18 @@ An example event for `fdr` looks as following: | crowdstrike.MediaConnectState | | keyword | | crowdstrike.MediaType | | keyword | | crowdstrike.MemoryAvailable | | match_only_text | +| crowdstrike.MemoryProtectionFlags | | keyword | | crowdstrike.MemoryTotal | | keyword | | crowdstrike.Metric | | keyword | | crowdstrike.MicrocodeSignature | | keyword | +| crowdstrike.MigoTemplateId | | keyword | +| crowdstrike.MigoTemplateInstanceId | | keyword | +| crowdstrike.MigoTemplateInstanceVersion | | keyword | | crowdstrike.MillisecondsToReadFirmware | | keyword | | crowdstrike.MinRouterAdvertisementInterval | | keyword | | crowdstrike.MinorFunction | | keyword | | crowdstrike.MinorVersion | | keyword | +| crowdstrike.MmapFlags | | keyword | | crowdstrike.MmioDataGenPmconB | | match_only_text | | crowdstrike.MmioDataSmiEn | | match_only_text | | crowdstrike.MmioDataTco1Cnt | | match_only_text | @@ -2323,8 +2435,10 @@ An example event for `fdr` looks as following: | crowdstrike.ModuleCharacteristics | | keyword | | crowdstrike.ModuleILPath | | keyword | | crowdstrike.ModuleLoadCount | | long | +| crowdstrike.ModuleLoadStatus | | keyword | | crowdstrike.ModuleLoadTelemetryClassification | | keyword | | crowdstrike.ModuleSize | | keyword | +| crowdstrike.MountNamespaceUniqueId | | keyword | | crowdstrike.MountedVolumeAction | | keyword | | crowdstrike.MsiProductCode | | keyword | | crowdstrike.MsiTransactionEndTimeStamp | | keyword | @@ -2338,6 +2452,7 @@ An example event for `fdr` looks as following: | crowdstrike.NeighborList | | keyword | | crowdstrike.NeighborName | | keyword | | crowdstrike.NetLuidIndex | | long | +| crowdstrike.NetlinkFamily | | keyword | | crowdstrike.NetworkAccesses.AccessTimestamp | | keyword | | crowdstrike.NetworkAccesses.AccessType | | keyword | | crowdstrike.NetworkAccesses.ConnectionDirection | | keyword | @@ -2357,6 +2472,7 @@ An example event for `fdr` looks as following: | crowdstrike.NetworkInterfaceGuid | | keyword | | crowdstrike.NetworkListenCount | | long | | crowdstrike.NetworkModuleLoadCount | | long | +| crowdstrike.NetworkProfile | | keyword | | crowdstrike.NetworkRecvAcceptCount | | long | | crowdstrike.NewExecutableWrittenCount | | long | | crowdstrike.NewFileAttributesLinux | | keyword | @@ -2366,6 +2482,12 @@ An example event for `fdr` looks as following: | crowdstrike.NewUsername | | keyword | | crowdstrike.NlMtu | | keyword | | crowdstrike.Nonce | | unsigned_long | +| crowdstrike.NumDenyFile | | keyword | +| crowdstrike.NumDenyFolder | | keyword | +| crowdstrike.NumDenyUnknown | | keyword | +| crowdstrike.NumDowngradeFile | | keyword | +| crowdstrike.NumDowngradeFolder | | keyword | +| crowdstrike.NumDowngradeUnknown | | keyword | | crowdstrike.NumberOfDiskDrives | | keyword | | crowdstrike.NumberOfMeasurements | | keyword | | crowdstrike.ODAccountType | | keyword | @@ -2443,6 +2565,7 @@ An example event for `fdr` looks as following: | crowdstrike.ParentHubPort | | long | | crowdstrike.ParentImageFileName | | keyword | | crowdstrike.ParentImageFilePath | | keyword | +| crowdstrike.ParentOfContextProcessId | | keyword | | crowdstrike.ParentProcessPatternIdList | | keyword | | crowdstrike.ParentSHA256HashData | | keyword | | crowdstrike.PasswordLastSet | | keyword | @@ -2507,11 +2630,14 @@ An example event for `fdr` looks as following: | crowdstrike.PointerSize | | keyword | | crowdstrike.Policy.ID | | keyword | | crowdstrike.Policy.Name | | keyword | +| crowdstrike.PolicyIdentifier | | match_only_text | | crowdstrike.PolicyRuleSeverity | | long | | crowdstrike.PreferredLifetime | | keyword | | crowdstrike.PrefixLength | | keyword | | crowdstrike.PrefixOrigin | | keyword | | crowdstrike.Prevalence.Key | | keyword | +| crowdstrike.PreviousActiveDirectoryDirectGroupObjectGuidsBuffer | | match_only_text | +| crowdstrike.PreviousActiveDirectoryFlattenedGroupObjectGuidsBuffer | | match_only_text | | crowdstrike.PreviousConnectTime | | date | | crowdstrike.PreviousFileAttributesLinux | | keyword | | crowdstrike.PreviousUnixPermissions | | keyword | @@ -2539,6 +2665,7 @@ An example event for `fdr` looks as following: | crowdstrike.ProfileUUID | | keyword | | crowdstrike.ProtectVirtualMemoryCount | | long | | crowdstrike.ProvisionState | | keyword | +| crowdstrike.ProvisioningDuration | | keyword | | crowdstrike.PtCompatibilityFlags | | keyword | | crowdstrike.PtStatusFlags | | keyword | | crowdstrike.PublicKeys | | keyword | @@ -2549,6 +2676,7 @@ An example event for `fdr` looks as following: | crowdstrike.QuarantinedFileState | | match_only_text | | crowdstrike.QueryStatus | | integer | | crowdstrike.QueueApcCount | | long | +| crowdstrike.RFMReason | | keyword | | crowdstrike.RFMState | | keyword | | crowdstrike.RGID | | keyword | | crowdstrike.RPath | | match_only_text | @@ -2590,6 +2718,7 @@ An example event for `fdr` looks as following: | crowdstrike.ResourceCreateTime | | date | | crowdstrike.ResourceId | | keyword | | crowdstrike.ResourceIdType | | keyword | +| crowdstrike.ResourceName | | match_only_text | | crowdstrike.RespondingDnsServer | | keyword | | crowdstrike.ResponseAction | | keyword | | crowdstrike.ResponsiblePid | | keyword | @@ -2605,8 +2734,12 @@ An example event for `fdr` looks as following: | crowdstrike.RpcNestingLevel | | keyword | | crowdstrike.RpcOpClassification | | match_only_text | | crowdstrike.RpcOpNum | | keyword | +| crowdstrike.RuleAction | | keyword | | crowdstrike.RuleId | | keyword | +| crowdstrike.RuleMatchCount | | long | +| crowdstrike.RuleMatchCountSinceLastReport | | long | | crowdstrike.RunDllInvocationCount | | long | +| crowdstrike.SFMState | | keyword | | crowdstrike.SHA1HashData | | keyword | | crowdstrike.SHA1String | | keyword | | crowdstrike.SHA256HashData | | keyword | @@ -2630,6 +2763,7 @@ An example event for `fdr` looks as following: | crowdstrike.SecurityInformationLinux | | keyword | | crowdstrike.SensorGroupingTags | | keyword | | crowdstrike.SensorId | | keyword | +| crowdstrike.SensorRequestId | | match_only_text | | crowdstrike.SensorStateBitMap | | keyword | | crowdstrike.ServiceAccessPropertiesEtw | | match_only_text | | crowdstrike.ServiceCurrentState | | keyword | @@ -2646,6 +2780,7 @@ An example event for `fdr` looks as following: | crowdstrike.ServiceStart | | keyword | | crowdstrike.ServiceType | | keyword | | crowdstrike.SessionId | | keyword | +| crowdstrike.SessionPatternIdList | | match_only_text | | crowdstrike.SessionProcessId | | keyword | | crowdstrike.SetThreadContextCount | | long | | crowdstrike.Severity | | integer | @@ -2657,10 +2792,12 @@ An example event for `fdr` looks as following: | crowdstrike.ShareSecuritySddl | | keyword | | crowdstrike.SignInfoFlags | | keyword | | crowdstrike.SignalEndTimestamp | | date | +| crowdstrike.SignalNumber | | keyword | | crowdstrike.SignalStartTimestamp | | date | | crowdstrike.SignalUpdatedTimestamp | | date | | crowdstrike.SignatureErrorState | | keyword | | crowdstrike.SignatureState | | keyword | +| crowdstrike.SimulationMode | | keyword | | crowdstrike.SiteName | | keyword | | crowdstrike.SitePrefixLength | | keyword | | crowdstrike.Size | | long | @@ -2668,10 +2805,14 @@ An example event for `fdr` looks as following: | crowdstrike.SmbClientName | | keyword | | crowdstrike.SmbShareName | | keyword | | crowdstrike.SnapshotFileOpenCount | | long | +| crowdstrike.SocketType | | keyword | | crowdstrike.SourceAccountDomain | | keyword | | crowdstrike.SourceAccountObjectGuid | | keyword | | crowdstrike.SourceAccountObjectSid | | keyword | | crowdstrike.SourceAccountSamAccountName | | keyword | +| crowdstrike.SourceAccountType | | keyword | +| crowdstrike.SourceAccountUserName | | match_only_text | +| crowdstrike.SourceCommandLine | | match_only_text | | crowdstrike.SourceEndpointAccountObjectGuid | | keyword | | crowdstrike.SourceEndpointAccountObjectSid | | keyword | | crowdstrike.SourceEndpointAddressIP4 | | keyword | @@ -2680,6 +2821,7 @@ An example event for `fdr` looks as following: | crowdstrike.SourceEndpointNetworkType | | keyword | | crowdstrike.SourceEventUniqueId | | keyword | | crowdstrike.SourceFileName | | keyword | +| crowdstrike.SourceImageFileName | | match_only_text | | crowdstrike.SourceProcessId | | keyword | | crowdstrike.SourceProducts | | keyword | | crowdstrike.SourceThreadId | | keyword | @@ -2722,17 +2864,31 @@ An example event for `fdr` looks as following: | crowdstrike.SystemSerialNumber | | keyword | | crowdstrike.SystemSku | | keyword | | crowdstrike.SystemTableIndex | | long | +| crowdstrike.SystemdUnitActiveState | | match_only_text | +| crowdstrike.SystemdUnitFileState | | match_only_text | +| crowdstrike.SystemdUnitLoadState | | match_only_text | +| crowdstrike.SystemdUnitName | | match_only_text | +| crowdstrike.SystemdUnitPath | | match_only_text | +| crowdstrike.SystemdUnitProperties | | match_only_text | | crowdstrike.Tactic | | keyword | | crowdstrike.Tags | | keyword | +| crowdstrike.TamperingAction | | match_only_text | +| crowdstrike.TargetAccountObjectGuid | | match_only_text | +| crowdstrike.TargetAccountObjectSid | | match_only_text | +| crowdstrike.TargetAccountType | | keyword | +| crowdstrike.TargetAddress | | keyword | | crowdstrike.TargetAuthenticationId | | keyword | | crowdstrike.TargetCommandLineParameters | | keyword | | crowdstrike.TargetDomainControllerObjectGuid | | keyword | | crowdstrike.TargetDomainControllerObjectSid | | keyword | | crowdstrike.TargetFileName | | keyword | +| crowdstrike.TargetImageFileName | | match_only_text | | crowdstrike.TargetIntegrityLevel | | keyword | | crowdstrike.TargetProcessCommandLine | | keyword | | crowdstrike.TargetProcessImageFileName | | keyword | | crowdstrike.TargetSHA256HashData | | keyword | +| crowdstrike.TargetServiceAccessClassification | | keyword | +| crowdstrike.TargetServiceAccessIdentifier | | match_only_text | | crowdstrike.TargetThreadId | | keyword | | crowdstrike.TargetThreadModule | | keyword | | crowdstrike.TaskAuthor | | keyword | @@ -2764,6 +2920,7 @@ An example event for `fdr` looks as following: | crowdstrike.TotalDiskSpace | | keyword | | crowdstrike.TransmitLinkSpeed | | keyword | | crowdstrike.TreeId | | keyword | +| crowdstrike.TtyName | | match_only_text | | crowdstrike.TunnelType | | keyword | | crowdstrike.Type | The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection). | keyword | | crowdstrike.USN | | keyword | @@ -2796,6 +2953,7 @@ An example event for `fdr` looks as following: | crowdstrike.ValidLifetime | | keyword | | crowdstrike.VerifiedCertificate | | keyword | | crowdstrike.VersionInfo | | match_only_text | +| crowdstrike.VirtualAddress | | keyword | | crowdstrike.VnodeModificationType | | keyword | | crowdstrike.VnodeType | | keyword | | crowdstrike.VolumeAppearanceTime | | keyword | diff --git a/packages/crowdstrike/manifest.yml b/packages/crowdstrike/manifest.yml index d11d80fa452..0b0c90c3204 100644 --- a/packages/crowdstrike/manifest.yml +++ b/packages/crowdstrike/manifest.yml @@ -1,6 +1,6 @@ name: crowdstrike title: CrowdStrike -version: "4.1.0" +version: "4.2.0" description: Collect logs from Crowdstrike with Elastic Agent. type: integration format_version: "3.4.0" From 6bf58cf76a3c624809dd16a721f59e7227f39c93 Mon Sep 17 00:00:00 2001 From: Navnit Chauhan Date: Fri, 10 Jul 2026 13:43:55 +0530 Subject: [PATCH 2/3] add additional event types --- packages/crowdstrike/changelog.yml | 2 +- .../ingest_pipeline/categorize.yml | 717 +++++++++++++++++- 2 files changed, 713 insertions(+), 6 deletions(-) diff --git a/packages/crowdstrike/changelog.yml b/packages/crowdstrike/changelog.yml index 19557b18e21..b3d3d384524 100644 --- a/packages/crowdstrike/changelog.yml +++ b/packages/crowdstrike/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Add ECS categorization and field mappings for new FDR event types including IDP telemetry, Active Directory account changes, DBus/systemd events, network containment, host firewall, sensor diagnostics, and container activity. type: enhancement - link: https://github.com/elastic/integrations/pull/1 + link: https://github.com/elastic/integrations/pull/20079 - version: "4.2.0" changes: - description: Add support for OverwatchGenericDetectionSummaryEvent in the Falcon data stream. diff --git a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml index e7acb8dfdd3..935588402dd 100644 --- a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml +++ b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml @@ -11,6 +11,13 @@ processors: description: Categorize events. tag: categorize_events_6b04e496 params: + AbnormalTerminationNotification: + category: + - process + kind: event + outcome: success + type: + - end AcUninstallConfirmation: category: - package @@ -32,6 +39,13 @@ processors: outcome: success type: - creation + ActiveDirectoryAccountDepartmentUpdate: + category: + - iam + kind: event + outcome: success + type: + - change ActiveDirectoryAccountDirectContainingGroupEntitiesUpdate: category: - iam @@ -40,6 +54,20 @@ processors: type: - change - group + ActiveDirectoryAccountDisabled: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountEnabled: + category: + - iam + kind: event + outcome: success + type: + - change ActiveDirectoryAccountFlattenedContainingGroupEntitiesUpdate: category: - iam @@ -48,6 +76,27 @@ processors: type: - change - group + ActiveDirectoryAccountLocked: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountNameUpdate: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAccountOuUpdate: + category: + - iam + kind: event + outcome: success + type: + - change ActiveDirectoryAccountPasswordUpdate: category: - iam @@ -55,6 +104,56 @@ processors: outcome: success type: - change + ActiveDirectoryAccountUnlocked: + category: + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAuditGpoModified: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change + ActiveDirectoryAuditGroupMemberModified: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change + - group + ActiveDirectoryAuditGroupModified: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change + - group + ActiveDirectoryAuditPasswordModificationAttempt: + category: + - authentication + - iam + kind: event + outcome: unknown + type: + - info + ActiveDirectoryAuditUserModified: + category: + - configuration + - iam + kind: event + outcome: success + type: + - change + - user ActiveDirectoryAuthentication: category: - authentication @@ -347,6 +446,13 @@ processors: outcome: unknown type: - change + ConfigurationProvisioningState: + category: + - configuration + kind: event + outcome: unknown + type: + - info CrashNotification: category: - host @@ -469,6 +575,20 @@ processors: outcome: unknown type: - info + DcBluetoothAuthorizationStatus: + category: + - driver + kind: event + outcome: unknown + type: + - info + DcBluetoothDeviceBlocked: + category: + - driver + kind: event + outcome: unknown + type: + - info DcBluetoothDeviceConnected: category: - driver @@ -476,6 +596,13 @@ processors: outcome: unknown type: - start + DcBluetoothDeviceConnectedDetails: + category: + - driver + kind: event + outcome: unknown + type: + - info DcBluetoothDeviceDisconnected: category: - driver @@ -483,6 +610,13 @@ processors: outcome: unknown type: - end + DcBluetoothDevicePolicyViolation: + category: + - driver + kind: event + outcome: unknown + type: + - info DcBluetoothDeviceProperties: category: - driver @@ -511,6 +645,34 @@ processors: outcome: success type: - info + DcRemovableStorageDeviceBlocked: + category: + - driver + kind: event + outcome: unknown + type: + - info + DcRemovableStorageDeviceConnected: + category: + - driver + kind: event + outcome: unknown + type: + - start + DcRemovableStorageDeviceDisconnected: + category: + - driver + kind: event + outcome: unknown + type: + - end + DcRemovableStorageDevicePolicyViolation: + category: + - driver + kind: event + outcome: unknown + type: + - info DcStatus: category: - iam @@ -525,6 +687,13 @@ processors: outcome: unknown type: - info + DcUsbDeviceBlocked: + category: + - driver + kind: event + outcome: unknown + type: + - info DcUsbDeviceConnected: category: - driver @@ -539,6 +708,20 @@ processors: outcome: unknown type: - end + DcUsbDevicePolicyViolation: + category: + - driver + kind: event + outcome: unknown + type: + - info + DcUsbDeviceWhitelisted: + category: + - driver + kind: event + outcome: unknown + type: + - change DcUsbEndpointDescriptor: category: - driver @@ -653,6 +836,20 @@ processors: outcome: success type: - start + DriverLoadBlocked: + category: + - driver + kind: event + outcome: unknown + type: + - info + DriverPreventFailed: + category: + - driver + kind: event + outcome: failure + type: + - info DriverPreventionStatus: category: - driver @@ -891,6 +1088,14 @@ processors: outcome: success type: - change + FirewallRuleApplicationFailed: + category: + - network + - configuration + kind: event + outcome: failure + type: + - info FirewallRuleIP4Matched: category: - network @@ -1087,6 +1292,20 @@ processors: outcome: unknown type: - info + IdpCloudHealthConfigurationsGetResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpCloudHealthConfigurationsSetResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info IdpCloudHealthStatus: category: - configuration @@ -1094,6 +1313,20 @@ processors: outcome: unknown type: - info + IdpConnectionsOverloadNotification: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpContainerRestarted: + category: + - configuration + kind: event + outcome: unknown + type: + - info IdpDcPerfReport: category: - configuration @@ -1108,6 +1341,27 @@ processors: outcome: unknown type: - info + IdpIdaasCorrelate: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpPacketDiversionConnectionsOverloadNotification: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpPacketDiversionLdapsConnectionsOverloadNotification: + category: + - configuration + kind: event + outcome: unknown + type: + - info IdpPolicyAccessRuleMatch: category: - configuration @@ -1136,6 +1390,41 @@ processors: outcome: unknown type: - info + IdpWatchdogReEnabled: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogRemediationActionRequest: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogRemediationActionTaken: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogRemediationActionTakenForCpu: + category: + - configuration + kind: event + outcome: unknown + type: + - info + IdpWatchdogRemediationActionTakenForMemory: + category: + - configuration + kind: event + outcome: unknown + type: + - info ImageHash: category: - library @@ -1452,15 +1741,44 @@ processors: type: - change - creation - MemoryProtectionChanged: + MemoryAdvise: category: - process - - configuration kind: event - outcome: success + outcome: unknown type: - - change - MemoryScanEnabled: + - info + MemoryLocked: + category: + - process + kind: event + outcome: unknown + type: + - info + MemoryMapped: + category: + - process + kind: event + outcome: unknown + type: + - info + MemoryProtectionChanged: + category: + - process + - configuration + kind: event + outcome: success + type: + - change + MemoryProtectionUpdated: + category: + - process + - configuration + kind: event + outcome: success + type: + - change + MemoryScanEnabled: category: - configuration kind: state @@ -1693,6 +2011,27 @@ processors: outcome: success type: - creation + OciContainerComplianceInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciContainerEngineInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciContainerHeartbeat: + category: + - configuration + kind: state + outcome: unknown + type: + - info OciContainerInfo: category: - configuration @@ -1700,6 +2039,27 @@ processors: outcome: unknown type: - info + OciContainerPlumbingSummary: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciContainerStarted: + category: + - configuration + kind: event + outcome: success + type: + - creation + OciContainerStopped: + category: + - configuration + kind: event + outcome: success + type: + - deletion OciContainerTelemetry: category: - host @@ -1707,6 +2067,20 @@ processors: outcome: unknown type: - info + OciImageHeartbeat: + category: + - configuration + kind: state + outcome: unknown + type: + - info + OciImageInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info OleFileWritten: category: - file @@ -1774,6 +2148,13 @@ processors: outcome: success type: - creation + PacketDiversionConnectionsOverloadConfigurationResponse: + category: + - configuration + kind: event + outcome: unknown + type: + - info PacketFilterAttached: category: - configuration @@ -1818,6 +2199,20 @@ processors: outcome: success type: - creation + PodInfo: + category: + - configuration + kind: state + outcome: unknown + type: + - info + PodProductConfig: + category: + - configuration + kind: state + outcome: unknown + type: + - info PrivilegedProcessHandleFromUnsignedModule: category: - process @@ -1907,6 +2302,13 @@ processors: outcome: unknown type: - change + ProcessTrace: + category: + - process + kind: event + outcome: unknown + type: + - info PromiscuousBindIP4: category: - host @@ -2049,6 +2451,132 @@ processors: type: - start - connection + RecoveryActionDeleteFilesComplete: + category: + - file + kind: event + outcome: unknown + type: + - deletion + RecoveryActionDeleteFilesReply: + category: + - file + kind: event + outcome: unknown + type: + - deletion + RecoveryActionGetModuleTableRecordComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info + RecoveryActionGetRuntimeSystemTagsComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info + RecoveryActionGetSystemTagsComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info + RecoveryActionKillProcessesComplete: + category: + - process + kind: event + outcome: unknown + type: + - end + RecoveryActionKillProcessesReply: + category: + - process + kind: event + outcome: unknown + type: + - end + RecoveryActionManipulateModuleTableComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - change + RecoveryActionRegistryCreateKeyComplete: + category: + - registry + kind: event + outcome: unknown + type: + - creation + RecoveryActionRegistryCreateKeyReply: + category: + - registry + kind: event + outcome: unknown + type: + - creation + RecoveryActionRegistryDeleteKeyComplete: + category: + - registry + kind: event + outcome: unknown + type: + - deletion + RecoveryActionRegistryDeleteKeyReply: + category: + - registry + kind: event + outcome: unknown + type: + - deletion + RecoveryActionRegistryDeleteValueKeyComplete: + category: + - registry + kind: event + outcome: unknown + type: + - deletion + RecoveryActionRegistryDeleteValueKeyReply: + category: + - registry + kind: event + outcome: unknown + type: + - deletion + RecoveryActionRegistrySetValueKeyComplete: + category: + - registry + kind: event + outcome: unknown + type: + - change + RecoveryActionRegistrySetValueKeyReply: + category: + - registry + kind: event + outcome: unknown + type: + - change + RecoveryActionSetRuntimeSystemTagsComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info + RecoveryActionSetSystemTagsComplete: + category: + - configuration + kind: event + outcome: unknown + type: + - info ReflectiveDllOpenProcess: category: - process @@ -2122,6 +2650,104 @@ processors: outcome: success type: - info + RemediationActionKillIP4Connection: + category: + - network + kind: event + outcome: unknown + type: + - end + RemediationActionKillIP6Connection: + category: + - network + kind: event + outcome: unknown + type: + - end + RemediationActionKillProcess: + category: + - process + kind: event + outcome: unknown + type: + - end + RemediationActionQuarantineFile: + category: + - file + kind: event + outcome: unknown + type: + - deletion + RemediationActionQuarantineMacroFile: + category: + - file + kind: event + outcome: unknown + type: + - deletion + RemediationActionQuarantineOfficeMacroFile: + category: + - file + kind: event + outcome: unknown + type: + - deletion + RemediationActionRegistryRemoval: + category: + - registry + kind: event + outcome: unknown + type: + - deletion + RemediationActionScheduledTaskRemoval: + category: + - configuration + kind: event + outcome: unknown + type: + - deletion + RemediationActionServiceRemoval: + category: + - configuration + kind: event + outcome: unknown + type: + - deletion + RemediationMonitorKillProcess: + category: + - process + kind: event + outcome: unknown + type: + - info + RemediationMonitorQuarantineFile: + category: + - file + kind: event + outcome: unknown + type: + - info + RemediationMonitorRegistryRemoval: + category: + - registry + kind: event + outcome: unknown + type: + - info + RemediationMonitorScheduledTaskRemoval: + category: + - configuration + kind: event + outcome: unknown + type: + - info + RemediationMonitorServiceRemoval: + category: + - configuration + kind: event + outcome: unknown + type: + - info RemoteBruteForceDetectInfo: category: - malware @@ -2286,6 +2912,20 @@ processors: kind: state type: - info + SensorEnteredSafemode: + category: + - configuration + kind: event + outcome: unknown + type: + - info + SensorGroupingTagsUpdate: + category: + - configuration + kind: event + outcome: success + type: + - change SensorHeartbeat: category: - package @@ -2300,6 +2940,13 @@ processors: outcome: unknown type: - change + SensorSelfDiagnosticAlert: + category: + - configuration + kind: event + outcome: unknown + type: + - info SensorSelfDiagnosticTelemetry: category: - configuration @@ -2362,6 +3009,13 @@ processors: outcome: success type: - start + ShellCommandLineInfo: + category: + - process + kind: event + outcome: unknown + type: + - info SignInfoError: category: - file @@ -2529,6 +3183,13 @@ processors: outcome: success type: - start + SyntheticProcessTrace: + category: + - process + kind: event + outcome: unknown + type: + - info SyntheticSharedObjectLoaded: category: - library @@ -2578,6 +3239,34 @@ processors: outcome: success type: - deletion + SystemdServicePropertiesChanged: + category: + - configuration + kind: event + outcome: success + type: + - change + SystemdTimerCreated: + category: + - configuration + kind: event + outcome: success + type: + - creation + SystemdTimerDeleted: + category: + - configuration + kind: event + outcome: success + type: + - deletion + SystemdTimerPropertiesChanged: + category: + - configuration + kind: event + outcome: success + type: + - change TarFileWritten: category: - file @@ -2740,6 +3429,24 @@ processors: outcome: success type: - change + UserGroupCreated: + category: + - configuration + - iam + kind: event + outcome: success + type: + - creation + - group + UserGroupDeleted: + category: + - configuration + - iam + kind: event + outcome: success + type: + - deletion + - group UserIdentity: category: - authentication From 5f9248dc4bacbe79ba4d0f8a888e14af9e768901 Mon Sep 17 00:00:00 2001 From: Navnit Chauhan Date: Fri, 10 Jul 2026 14:29:57 +0530 Subject: [PATCH 3/3] Add user.* ECS mappings and DNS enrichment --- packages/crowdstrike/changelog.yml | 3 ++ .../pipeline/test-linux.log-expected.json | 14 ++++++++- .../pipeline/test-windows.log-expected.json | 13 +++++++- .../elasticsearch/ingest_pipeline/default.yml | 30 +++++++++++++++---- 4 files changed, 52 insertions(+), 8 deletions(-) diff --git a/packages/crowdstrike/changelog.yml b/packages/crowdstrike/changelog.yml index b3d3d384524..cfcd4566037 100644 --- a/packages/crowdstrike/changelog.yml +++ b/packages/crowdstrike/changelog.yml @@ -4,6 +4,9 @@ - description: Add ECS categorization and field mappings for new FDR event types including IDP telemetry, Active Directory account changes, DBus/systemd events, network containment, host firewall, sensor diagnostics, and container activity. type: enhancement link: https://github.com/elastic/integrations/pull/20079 + - description: Map Active Directory events to ECS user fields from SamAccountName, AccountObjectSid, and AccountDomain, and add DNS enrichment for DNSRequestDetectInfo events. + type: enhancement + link: https://github.com/elastic/integrations/pull/20079 - version: "4.2.0" changes: - description: Add support for OverwatchGenericDetectionSummaryEvent in the Falcon data stream. diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json index 34110b13c21..25f0bb3f742 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log-expected.json @@ -568,7 +568,6 @@ ], "PatternId": "30997", "QueryStatus": "0", - "RequestType": "1", "SessionPatternIdList": [ "1001", "1002", @@ -584,6 +583,16 @@ "device": { "id": "0ce22396112f4f748024a6356ceee4de" }, + "dns": { + "question": { + "name": "api.example.com", + "registered_domain": "example.com", + "subdomain": "api", + "top_level_domain": "com", + "type": "A" + }, + "type": "query" + }, "event": { "action": "DNSRequestDetectInfo", "category": [ @@ -606,6 +615,9 @@ "type": "linux" } }, + "network": { + "protocol": "dns" + }, "observer": { "address": [ "192.0.2.3" diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json index 89fc0a1b2db..6725d257f3c 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-windows.log-expected.json @@ -11840,9 +11840,20 @@ "type": "windows" } }, + "related": { + "user": [ + "SVC-ACCT$", + "S-1-5-21-000000000-000000000-000000000-1477" + ] + }, "tags": [ "preserve_original_event" - ] + ], + "user": { + "domain": "EXAMPLE.LOCAL", + "id": "S-1-5-21-000000000-000000000-000000000-1477", + "name": "SVC-ACCT$" + } }, { "@timestamp": "2025-04-01T11:59:59.999Z", diff --git a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml index fca1fd5e1ab..34d0686ff49 100644 --- a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml +++ b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml @@ -1600,6 +1600,24 @@ processors: field: user.domain copy_from: crowdstrike.SourceAccountDomain ignore_empty_value: true + - set: + tag: set_user_name_0d315d08 + if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') && ctx.user?.name == null + field: user.name + copy_from: crowdstrike.SamAccountName + ignore_empty_value: true + - set: + tag: set_user_id_0da27179 + if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') && ctx.user?.id == null + field: user.id + copy_from: crowdstrike.AccountObjectSid + ignore_empty_value: true + - set: + tag: set_user_domain_bc24f2dc + if: ctx.event?.action instanceof String && ctx.event.action.startsWith('ActiveDirectory') && ctx.user?.domain == null + field: user.domain + copy_from: crowdstrike.AccountDomain + ignore_empty_value: true - set: tag: set_user_name_d3e6a828 if: ctx.event?.action == 'TokenImpersonated' @@ -1971,36 +1989,36 @@ processors: # DNS fields. - set: tag: set_dns_type_2198a4ce - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.event.action.toLowerCase().contains('dnsrequest') field: dns.type value: query - set: tag: set_network_protocol_6995faae - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.event.action.toLowerCase().contains('dnsrequest') field: network.protocol value: dns - registered_domain: tag: registered_domain_crowdstrike_DomainName_into_dns_question_8498515b - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.event.action.toLowerCase().contains('dnsrequest') field: crowdstrike.DomainName target_field: dns.question ignore_missing: true - rename: tag: rename_dns_question_domain_to_dns_question_name_699a0f98 - if: ctx.event?.action != null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.event.action.toLowerCase().contains('dnsrequest') field: dns.question.domain target_field: dns.question.name ignore_missing: true - rename: tag: rename_crowdstrike_DomainName_to_dns_question_name_5cc610bf - if: ctx.event?.action != null && ctx.dns?.question?.name == null && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.dns?.question?.name == null && ctx.event.action.toLowerCase().contains('dnsrequest') field: crowdstrike.DomainName target_field: dns.question.name ignore_missing: true - script: description: Map decimal DNS request type to its name. tag: dns_request_type_to_name_d668973b - if: ctx.event?.action != null && ctx.crowdstrike?.RequestType != null && !ctx.crowdstrike.RequestType.isEmpty() && ctx.event.action.contains("DnsRequest") + if: ctx.event?.action != null && ctx.crowdstrike?.RequestType != null && !ctx.crowdstrike.RequestType.isEmpty() && ctx.event.action.toLowerCase().contains('dnsrequest') params: "1": A "2": NS