Winlogbeat pipeline improvements #36657
Labels
Comments
botelastic
bot
added
the
needs_team
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
botelastic
bot
removed
the
needs_team
|
@jguay Would you mind asking for the JSON with |
|
I've gone through the processors here to reduce the syntax for clarity and maintainability. There is no indication of which of the modules the processors are intended to be added. Please ask the user to explain which modules each of the processors is intended to be added. The pipeline (in YAML) with my changes is here. ---
processors:
- set:
field: event.outcome
value: success
if: ctx.event?.outcome == null && ctx.event?.code == "18454"
ignore_failure: true
description: Event Code 18454 - Set event outcome success for a list of conditional event codes
- set:
field: event.outcome
value: failure
if: ctx.event?.outcome == null && ["4625", "18452", "18456"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 18456 & 18452 & 4625 - Set event outcome failure for a list of conditional event codes
- append:
field: event.category
value:
- authentication
if: ctx.event?.category == null && ["4625", "18452", "18454", "18456"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 18456 18454 18452 4625 - Set event category to authentication if doesn't exist
- grok:
field: winlog.event_data.param1
patterns:
- '^%{HOSTNAME:user.domain}\\%{USERNAME:user.name}'
- '^%{USERNAME:user.name}'
if: ctx.winlog?.event_data?.param1 != null && (ctx.user?.name == null || ctx.user.name == "-") && ["18454", "18456"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 18456 - Parse user.name ANDOR user.domain from winlog.event_data.param1
- set:
field: user.name
copy_from: winlog.user.name
if: ctx.winlog?.user?.name != null && (ctx.user?.name == null || ctx.user.name == "-") && ["18454", "18456"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 18456 - Set user.name to winlog.user.name IF Exists
- set:
field: user.name
copy_from: winlog.event_data.param1
if: ctx.winlog?.event_data?.param1 != null && (ctx.user?.name == null || ctx.user.name == "-") && ["18454", "18456"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 18456 - Set user.name to winlog.event_data.param1
- grok:
field: winlog.event_data.param2
patterns:
- '%{SPACE}Reason: %{GREEDYDATA:event.reason}$'
if: ctx.winlog?.event_data?.param2 != null && ctx.event?.code == "18456" && (ctx.event?.reason == null || ctx.event.reason == "-")
ignore_failure: true
description: Event Code 18456 - Parse event.reason to winlog.event_data.param2
- grok:
field: winlog.event_data.param3
patterns:
- '^%{SPACE}\[CLIENT: (%{IPORHOST:client.address})\]'
- '^%{SPACE}\[CLIENT: \<%{GREEDYDATA:client.address}\>\]'
ignore_missing: true
if: ctx.winlog?.event_data?.param3 != null && ctx.event?.code == "18456" && (ctx.event?.reason == null || ctx.event.reason == "-")
ignore_failure: true
description: Event Code 18456 - Parse client address from winlog.event_data.param3
- grok:
field: winlog.event_data.param2
patterns:
- '^%{SPACE}\[CLIENT: (%{IPORHOST:client.address})\]'
- '^%{SPACE}\[CLIENT: \<%{GREEDYDATA:client.address}\>\]'
ignore_missing: true
if: ctx.winlog?.event_data?.param2 != null && ctx.event?.code == "18454" && (ctx.client?.address == null || ctx.client.address == "-")
ignore_failure: true
description: Event Code 18454 - Parse client address from winlog.event_data.param2
- grok:
field: winlog.event_data.param1
patterns:
- '^%{SPACE}\[CLIENT: (%{IPORHOST:client.address})\]'
- '^%{SPACE}\[CLIENT: \<%{GREEDYDATA:client.address}\>\]'
ignore_missing: true
if: ctx.winlog?.event_data?.param1 != null && ctx.event?.code == "18452" && (ctx.client?.address == null || ctx.client.address == "-")
ignore_failure: true
description: Event Code 18452 - Parse client address from winlog.event_data.param1
- grok:
field: winlog.event_data.param1
patterns:
- '^%{SPACE}\[CLIENT: (%{IPORHOST:client.address})\]'
- '^%{SPACE}\[CLIENT: \<%{GREEDYDATA:client.address}\>\]'
ignore_missing: true
if: ctx.winlog?.event_data?.param1 != null && ctx.event?.code == "18452" && (ctx.client?.address == null || ctx.client.address == "-")
ignore_failure: true
description: Event Code 18454 - Parse client address from winlog.event_data.param2
- convert:
field: winlog.event_data.ProcessId
type: integer
target_field: process.pid
if: ctx.winlog?.event_data?.ProcessId != null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624- Convert hex PID to dec into process.pid
- grok:
field: winlog.event_data.ProcessName
patterns:
- '^%{WINPATHALT:process.executable}'
pattern_definitions:
WINPATHALT: '^(.*(?<=\\))?+(?.*$|$)'
if: ctx.winlog?.event_data?.ProcessName != null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624- Parse process.name and exec path from winlog.event_data.ProcessExecutable
- set:
if: ctx.winlog?.event_data?.ProcessId != null && ctx.event?.code == "1"
ignore_failure: true
field: process.pid
copy_from: winlog.event_data.ProcessId
description: Event Code 1- set winlog.event_data.ProcessId to into process.pid -
- set:
field: winlog.logon.code
copy_from: winlog.event_data.LogonType
if: ctx.winlog?.event_data?.LogonType != null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624- Set winlog.logon/code to winlog.event_data.LogonType
- set:
field: user.domain
copy_from: winlog.event_data.TargetDomainName
if: ctx.winlog?.event_data?.TargetDomainName != null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set user.domain to winlog.event_data.TargetDomainName
- set:
field: user.name
copy_from: winlog.event_data.TargetUserName
if: ctx.winlog?.event_data?.TargetUserName != null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set user.name to winlog.event_data.TargetUserName
- set:
field: user.id
copy_from: winlog.event_data.TargetUserSid
if: ctx.winlog?.event_data?.TargetUserSid != null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set user.id to winlog.event_data.TargetUserSid
- set:
field: user.domain
copy_from: winlog.event_data.SubjectDomainName
if: ctx.winlog?.event_data?.SubjectDomainName != null && ctx.event?.code == "4648"
ignore_failure: true
description: Event Code 4648 - Set user.domain to winlog.event_data.SubjectDomainName
- set:
field: user.name
copy_from: winlog.event_data.SubjectUserName
if: ctx.winlog?.event_data?.SubjectUserName != null && ctx.event?.code == "4648"
ignore_failure: true
description: Event Code 4648 - Set user.name to winlog.event_data.SubjectUserName
- set:
field: user.id
copy_from: winlog.event_data.SubjectUserSid
if: ctx.winlog?.event_data?.SubjectUserSid != null && ctx.event?.code == "4648"
ignore_failure: true
description: Event Code 4648 - Set user.id to winlog.event_data.SubjectUserSid
- set:
field: server.user.domain
copy_from: winlog.event_data.SubjectDomainName
if: ctx.winlog?.event_data?.SubjectDomainName != null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set server.user.domain to winlog.event_data.SubjectDomainName
- set:
field: server.user.name
copy_from: winlog.event_data.SubjectUserName
if: ctx.winlog?.event_data?.SubjectUserName != null && (ctx.server?.user?.name == null || ctx.server.user.name == "-") && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set server.user.name to winlog.event_data.SubjectUserName
- set:
field: server.user.id
copy_from: winlog.event_data.SubjectUserSid
if: ctx.winlog?.event_data?.SubjectUserSid != null && (ctx.server?.user?.id == null || ctx.server.user.id == "-") && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set server.user.id to winlog.event_data.SubjectUserSid
- set:
field: user.effective.name
copy_from: winlog.event_data.TargetUserName
if: ctx.winlog?.event_data?.TargetUserName != null && ctx.event?.code == "4648"
ignore_failure: true
description: Event Code 4648 - Set user.effective.name to winlog.event_data.TargetUserName
- set:
field: user.effective.id
copy_from: winlog.event_data.TargetUserSid
if: ctx.winlog?.event_data?.TargetUserSid != null && ctx.event?.code == "4648"
ignore_failure: true
description: Event Code 4648 - Set user.effective.id to winlog.event_data.TargetUserSid
- set:
field: user.effective.domain
copy_from: winlog.event_data.TargetDomainName
if: ctx.winlog?.event_data?.TargetDomainName != null && ctx.event?.code == "4648"
ignore_failure: true
description: Event Code 4648 - Set user.effective.domain to winlog.event_data.TargetDomainName
- set:
field: source.domain
copy_from: winlog.event_data.WorkstationName
if: ctx.winlog?.event_data?.WorkstationName != null && ctx.source?.domain == null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set source.domain to winlog.event_data.WorkstationName if exists -
- grok:
field: winlog.event_data.IpAddress
patterns:
- '^%{IP:source.ip}'
if: ctx.winlog?.event_data?.IpAddress != null && ctx.source?.ip == null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set source.ip to winlog.event_data.IpAddress if exists -
- grok:
field: winlog.event_data.IpPort
patterns:
- '^%{INT:source.port}'
if: ctx.winlog?.event_data?.IpPort != null && ctx.source?.port == null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set source.port to winlog.event_data.IpPort if exists -
- set:
field: package.name
copy_from: winlog.event_data.AuthenticationPackageName
if: ctx.winlog?.event_data?.AuthenticationPackageName != null && ctx.package?.name == null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set package.name to winlog.event_data.AuthenticationPackageName if exists -
- set:
field: winlog.logon.process.name
copy_from: winlog.event_data.LogonProcessName
if: ctx.winlog?.event_data?.LogonProcessName != null && ctx.winlog?.logon?.process?.name == null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set winlog.logon.process.name to winlog.event_data.LogonProcessName if exists -
- set:
field: service.name
copy_from: winlog.event_data.TransmittedServices
if: ctx.winlog?.event_data?.TransmittedServices != null && ctx.service?.name == null && ["4624", "4625"].contains(ctx.event?.code)
ignore_failure: true
description: Event Code 4625 & 4624 - Set service.name to winlog.event_data.TransmittedServices if exists -
- grok:
field: winlog.event_data.Image
patterns:
- '^%{WINPATHALT:process.executable}'
pattern_definitions:
WINPATHALT: '^(.*(?<=\\))?+(?.*$|$)'
if: ctx.winlog?.event_data?.Image != null && ctx.event?.code == "1"
ignore_failure: true
description: Event Code 1 - Parse process.name and exec path from winlog.event_data.Image if it exists and process.name does not
- grok:
field: winlog.event_data.Hashes
patterns:
- '^MD5=%{DATA:process.hash.md5},SHA256=%{DATA:process.hash.sha256},IMPHASH=%{DATA:process.hash.imphash}$'
if: ctx.winlog?.event_data?.Hashes != null && ctx.event?.code == "1"
ignore_failure: true
description: Event Code 1 - Parses md5 and sha256 hash to process.hash. from winlog.event_data.Hashes
- set:
field: server.address
copy_from: winlog.event_data.TargetServerName
if: ctx.winlog?.event_data?.TargetServerName != null && ctx.server?.address == null && ctx.event?.code == "4648"
ignore_failure: true
description: Event Code 4648 - Set server.address to winlog.event_data.TargetServerName if exists -
|
norrietaylor
added
Team:Security-Windows Platform
|
Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the enhancement:
Winlogbeat user is sending recommendations and pipeline for winlogbeat developers to review
Describe a specific use case for the enhancement or feature:
winlogbeat suggestions
Pipeline processors
The text was updated successfully, but these errors were encountered: