Skip to content

Commit e224172

Browse files
efd6efd6
authored
crowdstrike: improve falcon EppDetectionSummaryEvent field mapping (#13334)
1 parent 23044d9 commit e224172

File tree

6 files changed

+271
-3
lines changed

6 files changed

+271
-3
lines changed

‎packages/crowdstrike/changelog.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
# newer versions go on top
2+
- version: "1.59.0"
3+
changes:
4+
- description: Improve `EppDetectionSummaryEvent` event field mapping for falcon.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13334
27
- version: "1.58.0"
38
changes:
49
- description: Add support for `EppDetectionSummaryEvent` events.
510
type: enhancement
6-
link: http://github.com/elastic/integrations/pull/12869
11+
link: https://github.com/elastic/integrations/pull/12869
712
- version: "1.57.0"
813
changes:
914
- description: Reduce storage load for less useful or constant fields.

‎packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log‎

Lines changed: 3 additions & 1 deletion
Large diffs are not rendered by default.

‎packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-epp-detection-summary.log-expected.json‎

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -689,6 +689,216 @@
689689
"user": {
690690
"name": "azureuser"
691691
}
692+
},
693+
{
694+
"@timestamp": "2025-03-21T19:07:20.000Z",
695+
"crowdstrike": {
696+
"event": {
697+
"AgentId": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
698+
"AggregateId": "aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106",
699+
"CompositeId": "cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424",
700+
"DataDomains": "Endpoint",
701+
"Description": "For evaluation only - benign, no action needed.",
702+
"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc",
703+
"FileName": "choice.exe",
704+
"FilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\choice.exe",
705+
"GrandParentCommandLine": "C:\\Windows\\Explorer.EXE",
706+
"GrandParentImageFileName": "explorer.exe",
707+
"GrandParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe",
708+
"HostGroups": "88888888888888888888888888888888",
709+
"Hostname": "CISO-DUMMY-CSDEV",
710+
"LocalIP": "192.168.33.133",
711+
"LogonDomain": "CISO-DUMMY-CSDEV",
712+
"MACAddress": "00-0c-29-46-56-09",
713+
"MD5String": "00000000000000000000000000000000",
714+
"Name": "Suspicious Activity",
715+
"Objective": "Falcon Detection Method",
716+
"ParentImageFileName": "cmd.exe",
717+
"ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe",
718+
"ParentProcessId": 43146803382,
719+
"PatternDispositionDescription": "Detection, standard detection.",
720+
"PatternDispositionFlags": {
721+
"BlockingUnsupportedOrDisabled": false,
722+
"BootupSafeguardEnabled": false,
723+
"ContainmentFileSystem": false,
724+
"CriticalProcessDisabled": false,
725+
"Detect": false,
726+
"FsOperationBlocked": false,
727+
"HandleOperationDowngraded": false,
728+
"InddetMask": false,
729+
"Indicator": false,
730+
"KillActionFailed": false,
731+
"KillParent": false,
732+
"KillProcess": false,
733+
"KillSubProcess": false,
734+
"OperationBlocked": false,
735+
"PolicyDisabled": false,
736+
"ProcessBlocked": false,
737+
"QuarantineFile": false,
738+
"QuarantineMachine": false,
739+
"RegistryOperationBlocked": false,
740+
"Rooting": false,
741+
"SensorOnly": false,
742+
"SuspendParent": false,
743+
"SuspendProcess": false
744+
},
745+
"PatternId": "10197",
746+
"ProcessId": 43185188660,
747+
"SHA1String": "0000000000000000000000000000000000000000",
748+
"SHA256String": "0000000000000000000000000000000000000000000000000000000000000000",
749+
"Severity": 30,
750+
"SeverityName": "Low",
751+
"SourceProducts": "Falcon Insight",
752+
"SourceVendors": "CrowdStrike",
753+
"Type": "ldt",
754+
"UserName": "Administrator"
755+
},
756+
"metadata": {
757+
"customerIDString": "cccccccccccccccccccccccccccccccc",
758+
"eventType": "EppDetectionSummaryEvent",
759+
"offset": 1532939,
760+
"version": "1.0"
761+
}
762+
},
763+
"ecs": {
764+
"version": "8.17.0"
765+
},
766+
"event": {
767+
"created": "2025-03-21T19:07:20.000Z",
768+
"original": "{\"metadata\":{\"customerIDString\":\"cccccccccccccccccccccccccccccccc\",\"offset\":1532939,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1742584040000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1742583971,\"ProcessEndTime\":1742583972,\"ProcessId\":43185188660,\"ParentProcessId\":43146803382,\"Hostname\":\"CISO-DUMMY-CSDEV\",\"UserName\":\"Administrator\",\"Name\":\"Suspicious Activity\",\"Description\":\"For evaluation only - benign, no action needed.\",\"Severity\":30,\"SeverityName\":\"Low\",\"FileName\":\"choice.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\choice.exe\",\"CommandLine\":\"choice /m crowdstrike_sample_detection\",\"SHA256String\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"MD5String\":\"00000000000000000000000000000000\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"CISO-DUMMY-CSDEV\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424?_cid=cccccccccccccccccccccccccccccccc\",\"AgentId\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"CompositeId\":\"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43185188660-10197-561424\",\"LocalIP\":\"192.168.33.133\",\"MACAddress\":\"00-0c-29-46-56-09\",\"Tactic\":\"Malware\",\"Technique\":\"Malicious File\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Detection, standard detection.\",\"PatternDispositionValue\":0,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":false,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false,\"ContainmentFileSystem\":false},\"ParentImageFileName\":\"cmd.exe\",\"ParentCommandLine\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" \",\"GrandParentImageFileName\":\"explorer.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"HostGroups\":\"88888888888888888888888888888888\",\"PatternId\":10197,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42952716106\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\cmd.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"LocalIPv6\":\"\"}}",
769+
"severity": 21
770+
},
771+
"observer": {
772+
"product": "Falcon",
773+
"vendor": "Crowdstrike"
774+
},
775+
"process": {
776+
"args": [
777+
"choice",
778+
"/m",
779+
"crowdstrike_sample_detection"
780+
],
781+
"command_line": "choice /m crowdstrike_sample_detection",
782+
"executable": "choice",
783+
"parent": {
784+
"args": [
785+
"\"C:\\Windows\\system32\\cmd.exe\""
786+
],
787+
"command_line": "\"C:\\Windows\\system32\\cmd.exe\"",
788+
"executable": "\"C:\\Windows\\system32\\cmd.exe\""
789+
}
790+
},
791+
"tags": [
792+
"preserve_original_event"
793+
]
794+
},
795+
{
796+
"@timestamp": "2025-03-21T19:10:02.000Z",
797+
"crowdstrike": {
798+
"event": {
799+
"AgentId": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
800+
"AggregateId": "aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054",
801+
"AssociatedFile": "\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe",
802+
"CompositeId": "cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080",
803+
"DataDomains": "Endpoint",
804+
"Description": "A process triggered a high severity custom rule.",
805+
"FalconHostLink": "https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc",
806+
"FileName": "atera.exe.exe",
807+
"FilePath": "\\Device\\HarddiskVolume4\\Users\\Administrator\\Desktop\\atera.exe.exe",
808+
"GrandParentCommandLine": "C:\\Windows\\system32\\userinit.exe",
809+
"GrandParentImageFileName": "userinit.exe",
810+
"GrandParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe",
811+
"HostGroups": "88888888888888888888888888888888",
812+
"Hostname": "CISO-DUMMY-CSDEV",
813+
"IOARuleGroupName": "Custom IOA Group - Windows",
814+
"IOARuleInstanceID": "167",
815+
"IOARuleInstanceVersion": 2,
816+
"IOARuleName": "Initial Access via Remote Service (Atera) Block",
817+
"IOCType": "hash_sha256",
818+
"IOCValue": "0000000000000000000000000000000000000000000000000000000000000000",
819+
"LocalIP": "192.168.33.133",
820+
"LogonDomain": "CISO-DUMMY-CSDEV",
821+
"MACAddress": "00-ff-12-46-56-09",
822+
"MD5String": "00000000000000000000000000000000",
823+
"Name": "Suspicious Activity",
824+
"Objective": "Falcon Detection Method",
825+
"ParentImageFileName": "explorer.exe",
826+
"ParentImageFilePath": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe",
827+
"ParentProcessId": 43046029968,
828+
"PatternDispositionDescription": "Prevention, process was blocked from execution.",
829+
"PatternDispositionFlags": {
830+
"BlockingUnsupportedOrDisabled": false,
831+
"BootupSafeguardEnabled": false,
832+
"ContainmentFileSystem": false,
833+
"CriticalProcessDisabled": false,
834+
"Detect": false,
835+
"FsOperationBlocked": false,
836+
"HandleOperationDowngraded": false,
837+
"InddetMask": false,
838+
"Indicator": false,
839+
"KillActionFailed": false,
840+
"KillParent": false,
841+
"KillProcess": false,
842+
"KillSubProcess": false,
843+
"OperationBlocked": false,
844+
"PolicyDisabled": false,
845+
"ProcessBlocked": true,
846+
"QuarantineFile": false,
847+
"QuarantineMachine": false,
848+
"RegistryOperationBlocked": false,
849+
"Rooting": false,
850+
"SensorOnly": false,
851+
"SuspendParent": false,
852+
"SuspendProcess": false
853+
},
854+
"PatternDispositionValue": 2048,
855+
"PatternId": "41001",
856+
"ProcessId": 43186863960,
857+
"SHA1String": "0000000000000000000000000000000000000000",
858+
"SHA256String": "0000000000000000000000000000000000000000000000000000000000000000",
859+
"Severity": 70,
860+
"SeverityName": "High",
861+
"SourceProducts": "Falcon Insight",
862+
"SourceVendors": "CrowdStrike",
863+
"Type": "ldt",
864+
"UserName": "Administrator"
865+
},
866+
"metadata": {
867+
"customerIDString": "cccccccccccccccccccccccccccccccc",
868+
"eventType": "EppDetectionSummaryEvent",
869+
"offset": 1532956,
870+
"version": "1.0"
871+
}
872+
},
873+
"ecs": {
874+
"version": "8.17.0"
875+
},
876+
"event": {
877+
"created": "2025-03-21T19:10:02.000Z",
878+
"original": "{\"metadata\":{\"customerIDString\":\"cccccccccccccccccccccccccccccccc\",\"offset\":1532956,\"eventType\":\"EppDetectionSummaryEvent\",\"eventCreationTime\":1742584202000,\"version\":\"1.0\"},\"event\":{\"ProcessStartTime\":1742584138,\"ProcessEndTime\":1742584138,\"ProcessId\":43186863960,\"ParentProcessId\":43046029968,\"Hostname\":\"CISO-DUMMY-CSDEV\",\"UserName\":\"Administrator\",\"Name\":\"Suspicious Activity\",\"Description\":\"A process triggered a high severity custom rule.\",\"Severity\":70,\"SeverityName\":\"High\",\"FileName\":\"atera.exe.exe\",\"FilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\Administrator\\\\Desktop\\\\atera.exe.exe\",\"CommandLine\":\"\\\"C:\\\\Users\\\\Administrator\\\\Desktop\\\\atera.exe.exe\\\" \",\"SHA256String\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"MD5String\":\"00000000000000000000000000000000\",\"SHA1String\":\"0000000000000000000000000000000000000000\",\"LogonDomain\":\"CISO-DUMMY-CSDEV\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/activity-v2/detections/cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080?_cid=cccccccccccccccccccccccccccccccc\",\"AgentId\":\"eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee\",\"IOCType\":\"hash_sha256\",\"IOCValue\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"CompositeId\":\"cccccccccccccccccccccccccccccccc:ind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:43186863960-41001-568080\",\"LocalIP\":\"192.168.33.133\",\"MACAddress\":\"00-ff-12-46-56-09\",\"Tactic\":\"Custom Intelligence\",\"Technique\":\"Indicator of Attack\",\"Objective\":\"Falcon Detection Method\",\"PatternDispositionDescription\":\"Prevention, process was blocked from execution.\",\"PatternDispositionValue\":2048,\"PatternDispositionFlags\":{\"Indicator\":false,\"Detect\":false,\"InddetMask\":false,\"SensorOnly\":false,\"Rooting\":false,\"KillProcess\":false,\"KillSubProcess\":false,\"QuarantineMachine\":false,\"QuarantineFile\":false,\"PolicyDisabled\":false,\"KillParent\":false,\"OperationBlocked\":false,\"ProcessBlocked\":true,\"RegistryOperationBlocked\":false,\"CriticalProcessDisabled\":false,\"BootupSafeguardEnabled\":false,\"FsOperationBlocked\":false,\"HandleOperationDowngraded\":false,\"KillActionFailed\":false,\"BlockingUnsupportedOrDisabled\":false,\"SuspendProcess\":false,\"SuspendParent\":false,\"ContainmentFileSystem\":false},\"ParentImageFileName\":\"explorer.exe\",\"ParentCommandLine\":\"C:\\\\Windows\\\\Explorer.EXE\",\"GrandParentImageFileName\":\"userinit.exe\",\"GrandParentCommandLine\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"IOARuleInstanceID\":\"167\",\"IOARuleInstanceVersion\":2,\"IOARuleName\":\"Initial Access via Remote Service (Atera) Block\",\"IOARuleGroupName\":\"Custom IOA Group - Windows\",\"HostGroups\":\"88888888888888888888888888888888\",\"AssociatedFile\":\"\\\\Device\\\\HarddiskVolume4\\\\Users\\\\Administrator\\\\Desktop\\\\atera.exe.exe\",\"PatternId\":41001,\"SourceVendors\":\"CrowdStrike\",\"SourceProducts\":\"Falcon Insight\",\"DataDomains\":\"Endpoint\",\"AggregateId\":\"aggind:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee:42953194054\",\"Type\":\"ldt\",\"ParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\explorer.exe\",\"GrandParentImageFilePath\":\"\\\\Device\\\\HarddiskVolume4\\\\Windows\\\\System32\\\\userinit.exe\",\"LocalIPv6\":\"\"}}",
879+
"severity": 73
880+
},
881+
"observer": {
882+
"product": "Falcon",
883+
"vendor": "Crowdstrike"
884+
},
885+
"process": {
886+
"args": [
887+
"\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\""
888+
],
889+
"command_line": "\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\"",
890+
"executable": "\"C:\\Users\\Administrator\\Desktop\\atera.exe.exe\"",
891+
"parent": {
892+
"args": [
893+
"C:\\Windows\\Explorer.EXE"
894+
],
895+
"command_line": "C:\\Windows\\Explorer.EXE",
896+
"executable": "C:\\Windows\\Explorer.EXE"
897+
}
898+
},
899+
"tags": [
900+
"preserve_original_event"
901+
]
692902
}
693903
]
694904
}

‎packages/crowdstrike/data_stream/falcon/fields/fields.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@
2424
fields:
2525
- name: AccountId
2626
type: keyword
27+
- name: AgentId
28+
type: keyword
2729
- name: AgentIdString
2830
type: keyword
2931
- name: AggregateId
@@ -90,6 +92,12 @@
9092
type: keyword
9193
- name: Timestamp
9294
type: keyword
95+
- name: FalconHostLink
96+
type: keyword
97+
- name: FileName
98+
type: keyword
99+
- name: FilePath
100+
type: keyword
93101
- name: FilesWritten
94102
type: group
95103
fields:
@@ -101,8 +109,22 @@
101109
type: date
102110
- name: GrandparentImageFilePath
103111
type: keyword
112+
- name: GrandParentCommandLine
113+
type: keyword
114+
- name: GrandParentImageFileName
115+
type: keyword
116+
- name: GrandParentImageFilePath
117+
type: keyword
118+
- name: Hostname
119+
type: keyword
104120
- name: LocalIPv6
105121
type: ip
122+
- name: IOARuleGroupName
123+
type: keyword
124+
- name: IOARuleInstanceID
125+
type: keyword
126+
- name: LogonDomain
127+
type: keyword
106128
- name: MobileAppsDetails
107129
type: group
108130
fields:
@@ -122,6 +144,8 @@
122144
type: keyword
123145
- name: IsContainerized
124146
type: keyword
147+
- name: Name
148+
type: keyword
125149
- name: NetworkAccesses
126150
type: group
127151
fields:
@@ -143,8 +167,14 @@
143167
type: keyword
144168
- name: RemotePort
145169
type: keyword
170+
- name: PatternDispositionDescription
171+
type: keyword
146172
- name: ParentImageFilePath
147173
type: keyword
174+
- name: ParentProcessId
175+
type: long
176+
- name: ProcessId
177+
type: long
148178
- name: Region
149179
type: keyword
150180
- name: ReportFileReference
@@ -160,6 +190,8 @@
160190
- name: Type
161191
type: keyword
162192
description: 'The endpoint detection type ("ldt": Legacy Endpoint Detection, or "ofp": Office Prevention Macro Detection).'
193+
- name: UserName
194+
type: keyword
163195
- name: UserUUID
164196
type: keyword
165197
- name: ActivityId
@@ -411,6 +443,8 @@
411443
description: |
412444
Flags indicating actions taken.
413445
fields:
446+
- name: ContainmentFileSystem
447+
type: boolean
414448
- name: Detect
415449
type: boolean
416450
- name: InddetMask

0 commit comments

Comments
 (0)