Sysmon - Ip field

[Sagatjkeee]

Helloy guys!
We have sysmon v14.11.
I noticed that source.ip field have name is text, but destination.ip have ip adress field.
I think its not ok..
can u pls tell me how to fix this?

[dougburks]

I just checked a deployment with sysmon logs and both the source.ip and destination.ip address fields are defined as IP addresses correctly.

How are you transporting your sysmon logs to your Security Onion deployment?

[hieronymusthebosch]

@dougburks, I'm also having what seems to be a similar/the same issue as @Sagatjkeee. Hopefully, I can shed some additional light on it.

I have a number of Windows servers that I've installed the Wazuh on, downloaded from the SOC on my version 2.3.182 grid. I also have the latest version of Sysmon installed on the Windows servers and used the default config from @SwiftOnSecurity (https://github.com/SwiftOnSecurity/sysmon-config).

In the ossec ingest pipeline, there is a rename for the data.srcip field to a source_ip text field. All other src/dst IP renames are _something_.ip.

As such, when looking at a list of events in Elastic, the source.ip field is empty and can't be used to filter, sort, etc.

However, when opening the document, there is no entry for source.ip, just for source_ip that is a text field. This source_ip field does have the correct IP address pulled from the log message.

I attempted to rectify at least the part of the source.ip fields being empty by modifying the ossec ingest pipeline, however that doesn't appear to have made any differences. I'm not the most familiar with how ingestion and parsing works though, so I'm not sure that is actually part of the solution. Also, that wouldn't fix the document itself still using the source_ip field instead of the source.ip field as in my third screenshot.

Thanks!

[dougburks]

I don't have any Wazuh agents handy right now, but if you're up for trying a different endpoint agent I believe that IP address fields should be preserved correctly when using either Winlogbeat or osquery:
https://docs.securityonion.net/en/2.3/host.html