forked from elastic/detection-rules
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathnon-ecs-schema.json
More file actions
250 lines (250 loc) · 10.9 KB
/
non-ecs-schema.json
File metadata and controls
250 lines (250 loc) · 10.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
{
"auditbeat-*": {
"auditd.data.addr": "keyword",
"auditd.data.grantors": "keyword",
"auditd.data.syscall": "keyword",
"auditd.data.terminal": "keyword",
"auditd.result": "keyword"
},
"endgame-*": {
"endgame": {
"metadata": {
"type": "keyword"
},
"event_subtype_full": "keyword"
}
},
"winlogbeat-*": {
"problemchild.prediction": "long",
"problemchild.prediction_probability": "long",
"blocklist_label": "long",
"winlog": {
"event_data": {
"AccessList": "keyword",
"AccessMask": "keyword",
"AccessMaskDescription": "keyword",
"AdditionalInfo": "keyword",
"AllowedToDelegateTo": "keyword",
"AttributeLDAPDisplayName": "keyword",
"AttributeValue": "keyword",
"AuditPolicyChangesDescription": "keyword",
"CallerProcessName": "keyword",
"CallTrace": "keyword",
"ClientProcessId": "keyword",
"Consumer": "keyword",
"GrantedAccess": "keyword",
"NewTargetUserName": "keyword",
"ObjectClass": "keyword",
"ObjectDN": "keyword",
"ObjectName": "keyword",
"OldTargetUserName": "keyword",
"OriginalFileName": "keyword",
"ParentProcessId": "keyword",
"ProcessName": "keyword",
"Properties": "keyword",
"RelativeTargetName": "keyword",
"ShareName": "keyword",
"SubjectLogonId": "keyword",
"SubjectUserName": "keyword",
"SubjectUserSid": "keyword",
"ServiceAccount": "keyword",
"ElevatedToken": "keyword",
"TargetUserName": "keyword",
"TargetImage": "keyword",
"TargetLogonId": "keyword",
"TargetProcessGUID": "keyword",
"TargetSid": "keyword",
"SchemaFriendlyName": "keyword",
"Resource": "keyword",
"RpcCallClientLocality": "keyword",
"PrivilegeList": "keyword",
"AuthenticationPackageName" : "keyword",
"TargetUserSid" : "keyword",
"LogonProcessName": "keyword",
"DnsHostName" : "keyword",
"ServiceFileName": "keyword",
"ImagePath": "keyword",
"TaskName": "keyword",
"Status": "keyword",
"EnabledPrivilegeList": "keyword",
"Operation": "keyword",
"OperationType": "keyword",
"NewUACList": "keyword",
"SubCategory": "keyword"
}
},
"winlog.logon.type": "keyword",
"winlog.logon.id": "keyword",
"powershell.file.script_block_text": "text"
},
"filebeat-*": {
"o365.audit.NewValue": "keyword",
"labels.is_ioc_transform_source": "keyword"
},
"logs-endpoint.events.*": {
"process.Ext.token.integrity_level_name": "keyword",
"process.parent.Ext.real.pid": "long",
"process.Ext.effective_parent.executable": "keyword",
"process.Ext.effective_parent.entity_id": "keyword",
"process.Ext.effective_parent.name": "keyword",
"file.Ext.header_bytes": "keyword",
"file.Ext.entropy": "long",
"file.Ext.windows.zone_identifier": "long",
"file.size": "long",
"file.Ext.original.name": "keyword",
"dll.Ext.device.product_id": "keyword",
"dll.Ext.relative_file_creation_time": "double",
"dll.Ext.relative_file_name_modify_time": "double",
"process.Ext.relative_file_name_modify_time": "double",
"process.Ext.relative_file_creation_time": "double",
"Target.process.name": "keyword",
"process.Ext.api.name": "keyword"
},
"logs-endpoint.events.api-*": {
"process.Ext.api.parameters.consumer_type": "keyword",
"process.Ext.api.name": "keyword"
},
"logs-endpoint.events.file-*": {
"file.Ext.header_bytes": "keyword",
"file.Ext.windows.zone_identifier": "long"
},
"logs-windows.*": {
"powershell.file.script_block_text": "text"
},
"logs-kubernetes.audit_logs-*": {
"kubernetes.audit.objectRef.resource": "keyword",
"kubernetes.audit.objectRef.subresource": "keyword",
"kubernetes.audit.verb": "keyword",
"kubernetes.audit.user.username": "keyword",
"kubernetes.audit.impersonatedUser.username": "keyword",
"kubernetes.audit.annotations.authorization_k8s_io/decision": "keyword",
"kubernetes.audit.annotations.authorization_k8s_io/reason": "keyword",
"kubernetes.audit.user.groups": "text",
"kubernetes.audit.requestObject.spec.containers.securityContext.privileged": "boolean",
"kubernetes.audit.requestObject.spec.containers.securityContext.allowPrivilegeEscalation": "boolean",
"kubernetes.audit.requestObject.spec.securityContext.runAsUser": "long",
"kubernetes.audit.requestObject.spec.containers.securityContext.runAsUser": "long",
"kubernetes.audit.requestObject.spec.hostPID": "boolean",
"kubernetes.audit.requestObject.spec.hostNetwork": "boolean",
"kubernetes.audit.requestObject.spec.hostIPC": "boolean",
"kubernetes.audit.requestObject.spec.volumes.hostPath.path": "keyword",
"kubernetes.audit.requestObject.spec.type": "keyword",
"kubernetes.audit.requestObject.rules.resources": "keyword",
"kubernetes.audit.requestObject.rules.verb": "keyword",
"kubernetes.audit.objectRef.namespace": "keyword",
"kubernetes.audit.objectRef.serviceAccountName": "keyword",
"kubernetes.audit.requestObject.spec.serviceAccountName": "keyword",
"kubernetes.audit.responseStatus.reason": "keyword",
"kubernetes.audit.requestObject.spec.containers.securityContext.capabilities.add": "keyword",
"kubernetes.audit.requestObject.spec.containers.image": "text"
},
".alerts-security.*": {
"signal.rule.name": "keyword",
"signal.rule.tags": "keyword",
"signal.rule.threat.tactic.name": "keyword",
"kibana.alert.rule.threat.tactic.id": "keyword",
"kibana.alert.workflow_status": "keyword",
"kibana.alert.rule.rule_id": "keyword",
"kibana.alert.rule.name": "keyword"
},
"logs-google_workspace*": {
"gsuite.admin": "keyword",
"gsuite.admin.new_value": "keyword",
"gsuite.admin.setting.name": "keyword",
"google_workspace.drive.owner_is_team_drive": "keyword",
"google_workspace.drive.copy_type": "keyword",
"google_workspace.drive.file.type": "keyword",
"google_workspace.drive.visibility": "keyword",
"google_workspace.token.client.id": "keyword",
"google_workspace.token.scope.data": "keyword",
"google_workspace.token.scope.data.scope_name": "keyword"
},
"logs-ti_*": {
"labels.is_ioc_transform_source": "keyword"
},
"logs-auditd_manager.auditd-*": {
"auditd.data.a0": "keyword",
"auditd.data.a1": "keyword",
"auditd.data.a2": "keyword",
"auditd.data.a3": "keyword"
},
"logs-aws.cloudtrail-*": {
"aws.cloudtrail.flattened.request_parameters.ipPermissions.items.ipRanges.items.cidrIp": "keyword",
"aws.cloudtrail.flattened.request_parameters.ipPermissions.items.fromPort": "keyword",
"aws.cloudtrail.flattened.request_parameters.serialNumber": "keyword",
"aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm": "keyword",
"aws.cloudtrail.flattened.request_parameters.includeDeprecated": "keyword",
"aws.cloudtrail.flattened.request_parameters.withDecryption": "boolean",
"aws.cloudtrail.flattened.request_parameters.instanceId": "keyword",
"aws.cloudtrail.flattened.request_parameters.attribute": "keyword",
"aws.cloudtrail.flattened.request_parameters.reason": "keyword",
"aws.cloudtrail.flattened.request_parameters.omitted": "keyword",
"aws.cloudtrail.flattened.response_elements.documentDescription.documentType": "keyword",
"aws.cloudtrail.flattened.request_parameters.groupSet.items.groupId": "keyword",
"aws.cloudtrail.flattened.request_parameters.protocol": "keyword"
},
"logs-azure.signinlogs-*": {
"azure.signinlogs.properties.conditional_access_audiences.application_id": "keyword",
"azure.signinlogs.properties.original_transfer_method": "keyword",
"azure.auditlogs.properties.target_resources.0.display_name": "keyword",
"azure.signinlogs.properties.authentication_details.authentication_method": "keyword",
"azure.signinlogs.properties.authentication_processing_details": "keyword",
"azure.signinlogs.properties.token_protection_status_details.sign_in_session_status": "keyword",
"azure.signinlogs.properties.session_id": "keyword",
"azure.signinlogs.properties.mfa_detail.auth_method": "keyword",
"azure.signinlogs.properties.client_credential_type": "keyword",
"azure.signinlogs.properties.app_owner_tenant_id": "keyword",
"azure.signinlogs.properties.resource_owner_tenant_id": "keyword"
},
"logs-azure.activitylogs-*": {
"azure.activitylogs.properties.authentication_protocol": "keyword",
"azure.activitylogs.properties.appId": "keyword",
"azure.activitylogs.properties.resourceDisplayName": "keyword",
"azure.activitylogs.properties.appDisplayName": "keyword",
"azure.activitylogs.properties.requestbody.properties.roleDefinitionId": "keyword",
"azure.activitylogs.properties.responseBody": "keyword"
},
"logs-azure.graphactivitylogs-*": {
"azure.graphactivitylogs.properties.c_idtyp": "keyword",
"azure.graphactivitylogs.properties.user_principal_object_id": "keyword",
"azure.graphactivitylogs.properties.requestUri": "keyword",
"azure.graphactivitylogs.properties.c_sid": "keyword"
},
"logs-azure.auditlogs-*": {
"azure.auditlogs.properties.target_resources.0.modified_properties.1.display_name": "keyword",
"azure.auditlogs.properties.target_resources.0.modified_properties.1.new_value": "keyword",
"azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value": "keyword",
"azure.auditlogs.properties.target_resources.0.modified_properties.2.new_value": "keyword",
"azure.auditlogs.properties.additional_details.value": "keyword",
"azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value": "keyword",
"azure.auditlogs.properties.target_resources.0.modified_properties.0.old_value": "keyword"
},
"logs-azure.platformlogs-*": {
"azure.platformlogs.identity.claim.upn": "keyword",
"azure.platformlogs.properties.id": "keyword",
"azure.platformlogs.identity.claim.appid": "keyword"
},
"logs-o365.audit-*": {
"o365.audit.ExtendedProperties.RequestType": "keyword",
"o365.audit.ExtendedProperties.ResultStatusDetail": "keyword",
"o365.audit.OperationProperties.Name": "keyword",
"o365.audit.OperationProperties.Value": "keyword",
"o365.audit.OperationCount": "long"
},
"logs-okta*": {
"okta.debug_context.debug_data.flattened.requestedScopes": "keyword",
"okta.debug_context.debug_data.flattened.grantType": "keyword"
},
"logs-network_traffic.http*": {
"data_stream.dataset": "keyword",
"url.path": "keyword",
"http.request.referrer": "keyword",
"http.request.headers.content-type": "keyword",
"network.direction": "keyword",
"http.request.method": "keyword",
"request": "keyword",
"http.request.body.bytes": "long",
"http.request.body.content": "keyword",
"http.response.headers.server": "keyword"
}
}