Skip to content

crowdstrike: add ECS categorization and fields for new FDR event types #20079

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
navnit-elastic wants to merge 4 commits into
base: main
Choose a base branch
from
Open

crowdstrike: add ECS categorization and fields for new FDR event types #20079

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e1c9f6d
crowdstrike: add ECS categorization for new FDR events
navnit-elastic Jul 9, 2026
be552c0
Merge branch 'main' into crowdstrike-15341
navnit-elastic Jul 9, 2026
6bf58cf
add additional event types
navnit-elastic Jul 10, 2026
5f9248d
Add user.* ECS mappings and DNS enrichment
navnit-elastic Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions packages/crowdstrike/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,12 @@
# newer versions go on top
- version: "4.3.0"
changes:
- description: Add ECS categorization and field mappings for new FDR event types including IDP telemetry, Active Directory account changes, DBus/systemd events, network containment, host firewall, sensor diagnostics, and container activity.
type: enhancement
link: https://github.com/elastic/integrations/pull/20079
- description: Map Active Directory events to ECS user fields from SamAccountName, AccountObjectSid, and AccountDomain, and add DNS enrichment for DNSRequestDetectInfo events.
type: enhancement
link: https://github.com/elastic/integrations/pull/20079
- version: "4.2.0"
changes:
- description: Add support for OverwatchGenericDetectionSummaryEvent in the Falcon data stream.
Expand Down
30 changes: 27 additions & 3 deletions packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1342,9 +1342,17 @@
},
"event": {
"action": "ChannelVersionRequired",
"category": [
"configuration"
],
"created": "2021-07-07T17:04:53.974Z",
"id": "ffffffff-1111-11eb-b7e0-02332cdcc16d|ffffffff25b14d4aa96de99e24bad2fa|ffffffff15754bcfb5f9152ec7ac90ac",
"original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1156120155\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"12\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV2\",\"id\":\"ffffffff-1111-11eb-b7e0-02332cdcc16d\",\"ErrorCode\":\"0\",\"aid\":\"ffffffff25b14d4aa96de99e24bad2fa\",\"timestamp\":\"1625677493974\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}"
"kind": "event",
"original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1156120155\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"12\",\"ConfigBuild\":\"1007.8.0011611.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV2\",\"id\":\"ffffffff-1111-11eb-b7e0-02332cdcc16d\",\"ErrorCode\":\"0\",\"aid\":\"ffffffff25b14d4aa96de99e24bad2fa\",\"timestamp\":\"1625677493974\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}",
"outcome": "unknown",
"type": [
"info"
]
},
"host": {
"id": "ffffffff25b14d4aa96de99e24bad2fa",
Expand Down Expand Up @@ -1490,9 +1498,17 @@
},
"event": {
"action": "ChannelVersionRequired",
"category": [
"configuration"
],
"created": "2021-07-07T17:04:40.455Z",
"id": "ffffffff-1111-11eb-8cc5-02c6fb049dd3|ffffffff2d7b4778a73b2cf58d327e42|ffffffff15754bcfb5f9152ec7ac90ac",
"original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1620585913\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.13\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"210\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ChannelVersionRequiredMacV2\",\"id\":\"ffffffff-1111-11eb-8cc5-02c6fb049dd3\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff2d7b4778a73b2cf58d327e42\",\"timestamp\":\"1625677480455\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}"
"kind": "event",
"original": "{\"ChannelVersion\":\"0\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"1620585913\",\"ChannelDiffStatus\":\"1\",\"aip\":\"67.43.156.13\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"210\",\"ConfigBuild\":\"1007.4.0013701.1\",\"event_platform\":\"Mac\",\"Entitlements\":\"15\",\"name\":\"ChannelVersionRequiredMacV2\",\"id\":\"ffffffff-1111-11eb-8cc5-02c6fb049dd3\",\"ErrorCode\":\"0\",\"EffectiveTransmissionClass\":\"0\",\"aid\":\"ffffffff2d7b4778a73b2cf58d327e42\",\"timestamp\":\"1625677480455\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}",
"outcome": "unknown",
"type": [
"info"
]
},
"host": {
"id": "ffffffff2d7b4778a73b2cf58d327e42",
Expand Down Expand Up @@ -3604,9 +3620,17 @@
},
"event": {
"action": "ChannelVersionRequired",
"category": [
"configuration"
],
"created": "2021-07-07T17:05:07.901Z",
"id": "ffffffff-1111-11eb-b411-06baeacb7a63|ffffffff67d54f7daf3d998ffc74d48e|ffffffff15754bcfb5f9152ec7ac90ac",
"original": "{\"ChannelVersion\":\"25\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"3155796140\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"20\",\"ConfigBuild\":\"1007.8.0011110.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV1\",\"id\":\"ffffffff-1111-11eb-b411-06baeacb7a63\",\"aid\":\"ffffffff67d54f7daf3d998ffc74d48e\",\"timestamp\":\"1625677507901\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}"
"kind": "event",
"original": "{\"ChannelVersion\":\"25\",\"event_simpleName\":\"ChannelVersionRequired\",\"ConfigStateHash\":\"3155796140\",\"aip\":\"67.43.156.14\",\"ChannelVersionRequired\":\"0\",\"ChannelId\":\"20\",\"ConfigBuild\":\"1007.8.0011110.1\",\"event_platform\":\"Lin\",\"name\":\"ChannelVersionRequiredLinV1\",\"id\":\"ffffffff-1111-11eb-b411-06baeacb7a63\",\"aid\":\"ffffffff67d54f7daf3d998ffc74d48e\",\"timestamp\":\"1625677507901\",\"cid\":\"ffffffff15754bcfb5f9152ec7ac90ac\"}",
"outcome": "unknown",
"type": [
"info"
]
},
"host": {
"id": "ffffffff67d54f7daf3d998ffc74d48e",
Expand Down
8 changes: 8 additions & 0 deletions packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-linux.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,11 @@
{"CapPrm":"3800192030037","ParentProcessId":"8081349242194000050","SourceProcessId":"8081349242194000050","aip":"81.2.69.192","SessionProcessId":"4102020000109002000","SyntheticPR2Flags":"4","event_platform":"Lin","ProcessEndTime":"1745972888.297","SVUID":"0","EventOrigin":"45","id":"fb9bd5f0314e46ce785f479aed8f3032fcd9","EffectiveTransmissionClass":"2","timestamp":"1743508799999","ProcessGroupId":"7001610480104066706","event_simpleName":"SyntheticProcessRollup2","RawProcessId":"8905032","ContextTimeStamp":"1752350302.359","GID":"0","ConfigStateHash":"5001020160","SVGID":"0","ConfigBuild":"2c8b.2.3366c72.4f","UID":"0","CommandLine":"e7f8eac7d","TargetProcessId":"6059002040716020903","ImageFileName":"/501e","RGID":"0","SourceThreadId":"0","Entitlements":"56","name":"4f32166a22f49735247598b45006","ProcessStartTime":"1745953229.264","RUID":"0","aid":"8c687fb6b1e8231200c77ef5e3175d0e","cid":"4092825518eaf67377a6e4492ae44577"}
{"event_simpleName":"TerminateProcess","RawProcessId":"1070050","ContextTimeStamp":"1751300030.984","ConfigStateHash":"8001020160","ContextProcessId":"9960000700989070560","ContextThreadId":"0","aip":"89.160.20.128","ConfigBuild":"2c8b.2.3366c72.4f","event_platform":"Lin","TargetProcessId":"6960000700989070560","Entitlements":"36","name":"6b1c662a760f5ed9750d4","EventOrigin":"1","id":"3e71b26395f4386bcb6602ee6777bb5f3124","EffectiveTransmissionClass":"2","aid":"12111f24f25a2a99438b40765c236577","timestamp":"1743508799999","cid":"4092825518eaf67377a6e4492ae44577"}
{"ChangeTime":"1731329600.968","OciContainerId":"sw345tf5e3455r7dw32w23t6t7fde34ed345rfe45rf0ew4fd","CapPrm":"123438954321","ParentProcessId":"12347782548906","SourceProcessId":"12347782548906","aip":"89.160.20.128","SessionProcessId":"1234915117961","SHA1HashData":"0000000000000000000000000000000000000000","event_platform":"Lin","ProcessEndTime":"1760406073.595","SVUID":"0","ParentBaseFileName":"runc","EventOrigin":"17","id":"1w23e4r-d03e-4003-bc75-71c6e819ca5f","EffectiveTransmissionClass":"2","Tags":"874, 17179870274, 12094627905582, 12094627906234, 212205744162400","timestamp":"1760406074201","ProcessGroupId":"1234915117961","LocalAddressIP4":"0.0.0.0","event_simpleName":"ProcessRollup2","RawProcessId":"1234","RootPath":"/","GID":"0","ConfigStateHash":"1026580567","UserName":"root","SVGID":"0","MD5HashData":"88922d50263b059696c2af5a99906562","SHA256HashData":"d4ff1c438e330777002332a305fcf965cfaa7d0dbeb899293d347298cbf6d4b6","ConfigBuild":"1007.4.0013701.1","UID":"0","CommandLine":"runc init","TargetProcessId":"12347783237538","ImageFileName":"/","RGID":"0","SourceThreadId":"0","Entitlements":"15","name":"ProcessRollup2LinV12","RUID":"0","ProcessStartTime":"1760406073.568","ComputerName":"comp2","aid":"ffffffff62714a708030d494ca0a7e60","cid":"ffffffff15754bcfb5f9152ec7ac90ac"}
{"event_simpleName":"DNSRequestDetectInfo","ContextBaseFileName":"example","IP4Records":"192.0.2.30","TemplateInstanceId":"28184","aip":"192.0.2.3","QueryStatus":"0","event_platform":"Lin","SessionPatternIdList":"1001,1002,1003","PatternId":"30997","EventOrigin":"1","id":"a8762b4b-f927-4800-8631-ad275fd3e55a","EffectiveTransmissionClass":"2","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785494.176","ConfigStateHash":"4058413047","TemplateDisposition":"10","ContextProcessId":"1781784074817030518","DomainName":"api.example.com","ConfigBuild":"1007.8.0019004.15","Entitlements":"15","name":"DNSRequestDetectInfoLinV2","ComputerName":"LIN-HOST-01","aid":"0ce22396112f4f748024a6356ceee4de","cid":"2cc98db1a47b4c98b913c94d43bfab70","RequestType":"1"}
{"event_simpleName":"DBusMessage","DBusDestination":":1.100","aip":"192.0.2.3","DBusReplySerial":"0","DBusNumUnixFiles":"0","DBusSender":"","event_platform":"Lin","DBusSerial":"11","EventOrigin":"1","id":"05ad40d8-fd06-4f2e-91e6-99eb94a334b0","EffectiveTransmissionClass":"3","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785754.694","DBusPayload":"[233]","ConfigStateHash":"4058413047","ContextProcessId":"1781785754634192743","DBusPath":"/","ConfigBuild":"1007.8.0019004.15","DBusMember":"SetFeatureFlags","DBusMessageFlags":"0","Entitlements":"15","name":"DBusMessageLinV1","DBusInterface":"org.example.service","ComputerName":"LIN-HOST-01","aid":"0ce22396112f4f748024a6356ceee4de","cid":"2cc98db1a47b4c98b913c94d43bfab70","DBusMessageKind":"method_call"}
{"event_simpleName":"CreateSocket","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785861.437","SocketType":"3","ConfigStateHash":"784305823","ContextProcessId":"106167322594972","ContextThreadId":"0","aip":"192.0.2.3","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","NetlinkFamily":"9","ImageFileName":"/usr/sbin/crond","Entitlements":"15","name":"CreateSocketLinV3","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"3a91a3a3-e739-4762-8169-7c7913f7601d","AddressFamily":"16","EffectiveTransmissionClass":"3","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"}
{"event_simpleName":"PacketFilterAttached","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781250697.368","ConfigStateHash":"1180378067","ContextProcessId":"1781250696892936591","aip":"192.0.2.2","FilterContent":"0102030405060708","SHA256HashData":"8f3aeb46f41e411b524118e77ca53995c6a273b12f98fc41d7b62cf907511a6c","FilterLength":"80","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","ImageFileName":"/usr/libexec/example/fwupd","Entitlements":"15","name":"PacketFilterAttachedLinV3","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"e6ed60ef-4c04-49c8-b426-92734a68d946","EffectiveTransmissionClass":"3","aid":"0ce22396112f4f748024a6356ceee4de","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"}
{"event_simpleName":"SystemdServiceCreated","SystemdUnitFileState":"static","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781747971.022","ConfigStateHash":"4058413047","aip":"192.0.2.3","SystemdUnitPath":"/usr/lib/systemd/system/example.service","ConfigBuild":"1007.8.0019004.15","SystemdUnitProperties":"{\"Type\":\"dbus\",\"Description\":\"Example Service\"}","event_platform":"Lin","SystemdUnitLoadState":"loaded","SystemdUnitName":"example.service","SystemdUnitActiveState":"active","Entitlements":"15","name":"SystemdServiceCreatedLinV2","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"d59230fa-4361-43a6-a6c9-9a12ac1492d5","EffectiveTransmissionClass":"3","aid":"0ce22396112f4f748024a6356ceee4de","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"}
{"event_simpleName":"SharedObjectLoaded","VirtualAddress":"140539515256832","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781785861.426","ConfigStateHash":"784305823","ContextProcessId":"106167322594972","aip":"192.0.2.3","SHA256HashData":"bb7ae1c1c0c3cfd6a73a6839ff69d81d14d1386e24372084cd44a97c385ebc08","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","CommandLine":"/usr/sbin/crond -n","ImageFileName":"/usr/sbin/crond","Entitlements":"15","name":"SharedObjectLoadedLinV2","EventOrigin":"1","ComputerName":"LIN-HOST-01","id":"fc2c5063-1bea-4bf0-962d-7ab26a1a95b1","EffectiveTransmissionClass":"3","aid":"2e3d9c94d9c34764860b1f3b444c6d4d","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70","TargetFileName":"/usr/lib64/security/pam_unix.so"}
{"event_simpleName":"OciContainerInfo","OciContainerId":"0370e0bae01215ab32fcb01fa5b21a4c7a07fe10a5a7032ccb2438fce25c6ba0","aip":"192.0.2.3","OciContainerStateOOMKilled":"0","OciContainerConfigLabels":"com.example.project:demo|com.example.service:agent","OciContainerConfigTty":"0","event_platform":"Lin","OciContainerHostConfigPublishAllPorts":"0","OciContainerMounts":"bind,/var/example/creds,/app/credentials,rw,true,rprivate","EventOrigin":"1","OciContainerName":"/example-agent","OciContainerNetworkSettingsIpAddress":"255.255.255.255","OciContainerAppName":"JAVA","id":"36bcd8e5-11d7-427b-beab-9a57c747f182","EffectiveTransmissionClass":"2","OciContainerInfoRetransmitted":"1","timestamp":"1743508799999","LocalAddressIP4":"192.0.2.10","ConfigStateHash":"4058413047","OciContainerStatePid":"2570469","OciContainerImageId":"be2069da187be6aa939626092187447b22d579d986cfaa065ff78408ddbb6c6c","ConfigBuild":"1007.8.0019004.15","OciContainerConfigImage":"example-agent","Entitlements":"15","name":"OciContainerInfoLinV10","ComputerName":"LIN-HOST-01","OciContainerAppVersion":"1.0.0","aid":"0ce22396112f4f748024a6356ceee4de","cid":"2cc98db1a47b4c98b913c94d43bfab70","OciContainerEngineType":"1"}
{"event_simpleName":"SensorTampering","ActionBlocked":"1","LocalAddressIP4":"192.0.2.10","ContextTimeStamp":"1781659012.171","SourceImageFileName":"/usr/lib/systemd/systemd","ConfigStateHash":"4058413047","ResourceName":"falcond","SourceProcessId":"1781139628182470889","SourceCommandLine":"/usr/lib/systemd/systemd --system","aip":"192.0.2.3","ConfigBuild":"1007.8.0019004.15","event_platform":"Lin","TargetProcessId":"1780602555935280240","Entitlements":"15","name":"SensorTamperingLinV1","EventOrigin":"1","ComputerName":"LIN-HOST-01","TamperingAction":"signal_process","id":"e02f29c4-344e-4d33-9cc0-2acb32a8d8ec","EffectiveTransmissionClass":"2","aid":"0ce22396112f4f748024a6356ceee4de","timestamp":"1743508799999","cid":"2cc98db1a47b4c98b913c94d43bfab70"}
Loading
Loading