Skip to content

Commit 5e265c4

Browse files
kcreddyanupratharamachandran
kcreddy
authored and
anupratharamachandran
committed
ti_crowdstrike.intel: Fix mapping of vulnerability field (elastic#14010)
ti_crowdstrike.intel: Copy vulnerabilities into vulnerability.id instead of vulnerability.category. The raw data and API documentation indicates vulnerabilities field contains an array of "CVE-" numbers. It is incorrectly mapped to vulnerability.category. Fix the mapping by copying vulnerabilities field into vulnerability.id instead. Updated pipeline and system test sample logs accordingly.
1 parent 679101c commit 5e265c4

File tree

8 files changed

+194
-55
lines changed

8 files changed

+194
-55
lines changed

‎packages/ti_crowdstrike/_dev/deploy/docker/files/config.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,8 @@ rules:
115115
"InformationStealer"
116116
],
117117
"vulnerabilities": [
118-
"vuln"
118+
"CVE-2020-14882",
119+
"CVE-2021-41773"
119120
]
120121
}
121122
]
@@ -217,7 +218,8 @@ rules:
217218
"CredentialHarvesting"
218219
],
219220
"vulnerabilities": [
220-
"vuln"
221+
"CVE-2020-14882",
222+
"CVE-2021-41773"
221223
]
222224
}
223225
]

‎packages/ti_crowdstrike/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.4.3"
3+
changes:
4+
- description: Copy `ti_crowdstrike.intel.vulnerabilities` into `vulnerability.id` instead of `vulnerability.category`.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/14010
27
- version: "2.4.2"
38
changes:
49
- description: Fix default request trace enabled behavior.

‎packages/ti_crowdstrike/data_stream/intel/_dev/test/pipeline/test-intel.log‎

Lines changed: 6 additions & 5 deletions
Large diffs are not rendered by default.

‎packages/ti_crowdstrike/data_stream/intel/_dev/test/pipeline/test-intel.log-expected.json‎

Lines changed: 148 additions & 21 deletions
Large diffs are not rendered by default.

‎packages/ti_crowdstrike/data_stream/intel/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,7 @@ processors:
401401
if: ctx.ti_crowdstrike?.intel?.vulnerabilities instanceof List
402402
processor:
403403
append:
404-
field: vulnerability.category
404+
field: vulnerability.id
405405
tag: append_vulnerabilities_into_vulnerability-category
406406
value: '{{{_ingest._value}}}'
407407
allow_duplicates: false

‎packages/ti_crowdstrike/data_stream/intel/sample_event.json‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
{
22
"@timestamp": "2023-11-21T06:16:01.000Z",
33
"agent": {
4-
"ephemeral_id": "6d3e7b87-a3f6-47b1-81a5-0264e901b3f9",
5-
"id": "36b03887-7783-4bc4-b8c5-6f8997e4cd1a",
6-
"name": "docker-fleet-agent",
4+
"ephemeral_id": "0a4081d5-cebd-4aa5-88f3-4056061d594d",
5+
"id": "0845386f-5916-4313-8f9d-2690b283c317",
6+
"name": "elastic-agent-91284",
77
"type": "filebeat",
8-
"version": "8.13.0"
8+
"version": "8.18.0"
99
},
1010
"data_stream": {
1111
"dataset": "ti_crowdstrike.intel",
12-
"namespace": "36922",
12+
"namespace": "57429",
1313
"type": "logs"
1414
},
1515
"ecs": {
1616
"version": "8.11.0"
1717
},
1818
"elastic_agent": {
19-
"id": "36b03887-7783-4bc4-b8c5-6f8997e4cd1a",
19+
"id": "0845386f-5916-4313-8f9d-2690b283c317",
2020
"snapshot": false,
21-
"version": "8.13.0"
21+
"version": "8.18.0"
2222
},
2323
"event": {
2424
"agent_id_status": "verified",
@@ -27,9 +27,9 @@
2727
],
2828
"dataset": "ti_crowdstrike.intel",
2929
"id": "hash_sha256_c98e1a7f563824cd448b47613743dcd1c853742b78f42b000192b83d",
30-
"ingested": "2024-08-01T08:31:15Z",
30+
"ingested": "2025-05-27T04:25:28Z",
3131
"kind": "enrichment",
32-
"original": "{\"_marker\":\"17005473618d17ae6353d123235e4158c5c81f25f0\",\"actors\":[\"SALTYSPIDER\"],\"deleted\":false,\"domain_types\":[\"abc.com\"],\"id\":\"hash_sha256_c98e1a7f563824cd448b47613743dcd1c853742b78f42b000192b83d\",\"indicator\":\"c98e192bf71a7f97563824cd448b47613743dcd1c853742b78f42b000192b83d\",\"ip_address_types\":[\"81.2.69.192\"],\"kill_chains\":[\"Installation\",\"C2\"],\"labels\":[{\"created_on\":1700547356,\"last_valid_on\":1700547360,\"name\":\"MaliciousConfidence/High\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"Malware/Mofksys\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/Commodity\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/CredentialHarvesting\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/InformationStealer\"}],\"last_updated\":1700547361,\"malicious_confidence\":\"high\",\"malware_families\":[\"Mofksys\"],\"published_date\":1700547356,\"relations\":[{\"created_date\":1700547339,\"id\":\"domain.com.yy\",\"indicator\":\"domain.ds\",\"last_valid_date\":1700547339,\"type\":\"domain\"},{\"created_date\":1700547339,\"id\":\"domain.xx.yy\",\"indicator\":\"domain.xx.fd\",\"last_valid_date\":1700547339,\"type\":\"domain\"}],\"reports\":[\"reports\"],\"targets\":[\"abc\"],\"threat_types\":[\"Commodity\",\"CredentialHarvesting\",\"InformationStealer\"],\"type\":\"hash_sha256\",\"vulnerabilities\":[\"vuln\"]}",
32+
"original": "{\"_marker\":\"17005473618d17ae6353d123235e4158c5c81f25f0\",\"actors\":[\"SALTYSPIDER\"],\"deleted\":false,\"domain_types\":[\"abc.com\"],\"id\":\"hash_sha256_c98e1a7f563824cd448b47613743dcd1c853742b78f42b000192b83d\",\"indicator\":\"c98e192bf71a7f97563824cd448b47613743dcd1c853742b78f42b000192b83d\",\"ip_address_types\":[\"81.2.69.192\"],\"kill_chains\":[\"Installation\",\"C2\"],\"labels\":[{\"created_on\":1700547356,\"last_valid_on\":1700547360,\"name\":\"MaliciousConfidence/High\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"Malware/Mofksys\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/Commodity\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/CredentialHarvesting\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/InformationStealer\"}],\"last_updated\":1700547361,\"malicious_confidence\":\"high\",\"malware_families\":[\"Mofksys\"],\"published_date\":1700547356,\"relations\":[{\"created_date\":1700547339,\"id\":\"domain.com.yy\",\"indicator\":\"domain.ds\",\"last_valid_date\":1700547339,\"type\":\"domain\"},{\"created_date\":1700547339,\"id\":\"domain.xx.yy\",\"indicator\":\"domain.xx.fd\",\"last_valid_date\":1700547339,\"type\":\"domain\"}],\"reports\":[\"reports\"],\"targets\":[\"abc\"],\"threat_types\":[\"Commodity\",\"CredentialHarvesting\",\"InformationStealer\"],\"type\":\"hash_sha256\",\"vulnerabilities\":[\"CVE-2020-14882\",\"CVE-2021-41773\"]}",
3333
"type": [
3434
"indicator"
3535
]
@@ -147,13 +147,15 @@
147147
"type": "hash_sha256",
148148
"value": "c98e192bf71a7f97563824cd448b47613743dcd1c853742b78f42b000192b83d",
149149
"vulnerabilities": [
150-
"vuln"
150+
"CVE-2020-14882",
151+
"CVE-2021-41773"
151152
]
152153
}
153154
},
154155
"vulnerability": {
155-
"category": [
156-
"vuln"
156+
"id": [
157+
"CVE-2020-14882",
158+
"CVE-2021-41773"
157159
]
158160
}
159-
}
161+
}

‎packages/ti_crowdstrike/docs/README.md‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -101,24 +101,24 @@ An example event for `intel` looks as following:
101101
{
102102
"@timestamp": "2023-11-21T06:16:01.000Z",
103103
"agent": {
104-
"ephemeral_id": "6d3e7b87-a3f6-47b1-81a5-0264e901b3f9",
105-
"id": "36b03887-7783-4bc4-b8c5-6f8997e4cd1a",
106-
"name": "docker-fleet-agent",
104+
"ephemeral_id": "0a4081d5-cebd-4aa5-88f3-4056061d594d",
105+
"id": "0845386f-5916-4313-8f9d-2690b283c317",
106+
"name": "elastic-agent-91284",
107107
"type": "filebeat",
108-
"version": "8.13.0"
108+
"version": "8.18.0"
109109
},
110110
"data_stream": {
111111
"dataset": "ti_crowdstrike.intel",
112-
"namespace": "36922",
112+
"namespace": "57429",
113113
"type": "logs"
114114
},
115115
"ecs": {
116116
"version": "8.11.0"
117117
},
118118
"elastic_agent": {
119-
"id": "36b03887-7783-4bc4-b8c5-6f8997e4cd1a",
119+
"id": "0845386f-5916-4313-8f9d-2690b283c317",
120120
"snapshot": false,
121-
"version": "8.13.0"
121+
"version": "8.18.0"
122122
},
123123
"event": {
124124
"agent_id_status": "verified",
@@ -127,9 +127,9 @@ An example event for `intel` looks as following:
127127
],
128128
"dataset": "ti_crowdstrike.intel",
129129
"id": "hash_sha256_c98e1a7f563824cd448b47613743dcd1c853742b78f42b000192b83d",
130-
"ingested": "2024-08-01T08:31:15Z",
130+
"ingested": "2025-05-27T04:25:28Z",
131131
"kind": "enrichment",
132-
"original": "{\"_marker\":\"17005473618d17ae6353d123235e4158c5c81f25f0\",\"actors\":[\"SALTYSPIDER\"],\"deleted\":false,\"domain_types\":[\"abc.com\"],\"id\":\"hash_sha256_c98e1a7f563824cd448b47613743dcd1c853742b78f42b000192b83d\",\"indicator\":\"c98e192bf71a7f97563824cd448b47613743dcd1c853742b78f42b000192b83d\",\"ip_address_types\":[\"81.2.69.192\"],\"kill_chains\":[\"Installation\",\"C2\"],\"labels\":[{\"created_on\":1700547356,\"last_valid_on\":1700547360,\"name\":\"MaliciousConfidence/High\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"Malware/Mofksys\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/Commodity\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/CredentialHarvesting\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/InformationStealer\"}],\"last_updated\":1700547361,\"malicious_confidence\":\"high\",\"malware_families\":[\"Mofksys\"],\"published_date\":1700547356,\"relations\":[{\"created_date\":1700547339,\"id\":\"domain.com.yy\",\"indicator\":\"domain.ds\",\"last_valid_date\":1700547339,\"type\":\"domain\"},{\"created_date\":1700547339,\"id\":\"domain.xx.yy\",\"indicator\":\"domain.xx.fd\",\"last_valid_date\":1700547339,\"type\":\"domain\"}],\"reports\":[\"reports\"],\"targets\":[\"abc\"],\"threat_types\":[\"Commodity\",\"CredentialHarvesting\",\"InformationStealer\"],\"type\":\"hash_sha256\",\"vulnerabilities\":[\"vuln\"]}",
132+
"original": "{\"_marker\":\"17005473618d17ae6353d123235e4158c5c81f25f0\",\"actors\":[\"SALTYSPIDER\"],\"deleted\":false,\"domain_types\":[\"abc.com\"],\"id\":\"hash_sha256_c98e1a7f563824cd448b47613743dcd1c853742b78f42b000192b83d\",\"indicator\":\"c98e192bf71a7f97563824cd448b47613743dcd1c853742b78f42b000192b83d\",\"ip_address_types\":[\"81.2.69.192\"],\"kill_chains\":[\"Installation\",\"C2\"],\"labels\":[{\"created_on\":1700547356,\"last_valid_on\":1700547360,\"name\":\"MaliciousConfidence/High\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"Malware/Mofksys\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/Commodity\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/CredentialHarvesting\"},{\"created_on\":1700547359,\"last_valid_on\":1700547359,\"name\":\"ThreatType/InformationStealer\"}],\"last_updated\":1700547361,\"malicious_confidence\":\"high\",\"malware_families\":[\"Mofksys\"],\"published_date\":1700547356,\"relations\":[{\"created_date\":1700547339,\"id\":\"domain.com.yy\",\"indicator\":\"domain.ds\",\"last_valid_date\":1700547339,\"type\":\"domain\"},{\"created_date\":1700547339,\"id\":\"domain.xx.yy\",\"indicator\":\"domain.xx.fd\",\"last_valid_date\":1700547339,\"type\":\"domain\"}],\"reports\":[\"reports\"],\"targets\":[\"abc\"],\"threat_types\":[\"Commodity\",\"CredentialHarvesting\",\"InformationStealer\"],\"type\":\"hash_sha256\",\"vulnerabilities\":[\"CVE-2020-14882\",\"CVE-2021-41773\"]}",
133133
"type": [
134134
"indicator"
135135
]
@@ -247,13 +247,15 @@ An example event for `intel` looks as following:
247247
"type": "hash_sha256",
248248
"value": "c98e192bf71a7f97563824cd448b47613743dcd1c853742b78f42b000192b83d",
249249
"vulnerabilities": [
250-
"vuln"
250+
"CVE-2020-14882",
251+
"CVE-2021-41773"
251252
]
252253
}
253254
},
254255
"vulnerability": {
255-
"category": [
256-
"vuln"
256+
"id": [
257+
"CVE-2020-14882",
258+
"CVE-2021-41773"
257259
]
258260
}
259261
}

‎packages/ti_crowdstrike/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.0.3
22
name: ti_crowdstrike
33
title: CrowdStrike Falcon Intelligence
4-
version: "2.4.2"
4+
version: "2.4.3"
55
description: Collect logs from CrowdStrike Falcon Intelligence with Elastic Agent.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)