Skip to content

Commit a84d705

Browse files
gauravneelwarnagauravneelwarna
committed
Added ECS fields
1 parent 2ef5cea commit a84d705

File tree

4 files changed

+281
-79
lines changed

4 files changed

+281
-79
lines changed

‎packages/checkpoint_harmony_endpoint/data_stream/forensics/agent/stream/forensics.yml.hbs

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
config_version: 3
2+
{{#if enable_request_tracer}}
23
resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson"
3-
request.tracer.maxbackups: 5
4+
resource.tracer.maxbackups: 5
5+
{{/if}}
46
resource.url: {{base_url}}
57
interval: {{interval}}
6-
prefix: json
78
state:
89
auth_client_id: {{client_id}}
910
auth_access_key: {{access_key}}
@@ -199,7 +200,7 @@ program: |
199200
body.data.nextPageToken == "NULL"
200201
?
201202
{
202-
"events": body.data.records,
203+
"events": body.data.records.map(e, { "message": e.encode_json(), }),
203204
"want_more": false,
204205
"cursor": {
205206
"auth_token": null,
@@ -218,7 +219,7 @@ program: |
218219
}
219220
:
220221
{
221-
"events": body.data.records,
222+
"events": body.data.records.map(e, { "message": e.encode_json(), }),
222223
"want_more": true,
223224
"cursor": {
224225
"auth_token": state.cursor.auth_token,
@@ -240,3 +241,20 @@ program: |
240241
)
241242
)
242243
)
244+
tags:
245+
{{#if preserve_original_event}}
246+
- preserve_original_event
247+
{{/if}}
248+
{{#if preserve_duplicate_custom_fields}}
249+
- preserve_duplicate_custom_fields
250+
{{/if}}
251+
{{#each tags as |tag|}}
252+
- {{tag}}
253+
{{/each}}
254+
{{#contains "forwarded" tags}}
255+
publisher_pipeline.disable_host: true
256+
{{/contains}}
257+
{{#if processors}}
258+
processors:
259+
{{processors}}
260+
{{/if}}

‎packages/checkpoint_harmony_endpoint/data_stream/forensics/elasticsearch/ingest_pipeline/default.yml

Lines changed: 227 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,230 @@
11
---
2-
description: Pipeline for processing sample logs
2+
description: Pipeline for processing Harmony Endpoint Forensics logs
33
processors:
4-
- set:
5-
field: event.ingested
6-
value: '{{_ingest.timestamp}}'
4+
- set:
5+
field: ecs.version
6+
value: "8.11.0"
7+
- set:
8+
field: event.ingested
9+
value: "{{_ingest.timestamp}}"
10+
- set:
11+
field: event.kind
12+
value: alert
13+
- rename:
14+
field: message
15+
target_field: event.original
16+
ignore_missing: true
17+
if: ctx.event?.original == null
18+
- json:
19+
field: event.original
20+
target_field: json
21+
ignore_failure: true
22+
- date:
23+
field: json.time
24+
target_field: event.created # Issue: When set to "@timestamp", event creation fails.
25+
formats:
26+
- strict_date_optional_time_nanos
27+
ignore_failure: true
28+
- rename:
29+
field: json.id
30+
target_field: event.id
31+
ignore_missing: true
32+
ignore_failure: true
33+
- rename:
34+
field: json.action
35+
target_field: event.action
36+
ignore_missing: true
37+
ignore_failure: true
38+
- set:
39+
field: event.dataset
40+
value: harmony_endpoint.forensics
41+
- set:
42+
field: event.module
43+
value: harmony_endpoint
44+
- set:
45+
field: event.category
46+
value: malware
47+
- set:
48+
field: event.type
49+
value: info
50+
- rename:
51+
field: json.host_type
52+
target_field: host.type
53+
ignore_missing: true
54+
ignore_failure: true
55+
- rename:
56+
field: json.src
57+
target_field: host.ip
58+
override: true
59+
ignore_missing: true
60+
ignore_failure: true
61+
- rename:
62+
field: json.src_machine_name
63+
target_field: host.hostname
64+
override: true
65+
ignore_missing: true
66+
ignore_failure: true
67+
- set:
68+
field: host.name
69+
copy_from: host.hostname
70+
- join:
71+
field: json.os_name
72+
target_field: host.os.name
73+
separator: ','
74+
if: ctx.json?.os_name != null
75+
ignore_failure: true
76+
- join:
77+
field: json.os_version
78+
target_field: host.os.version
79+
separator: ','
80+
if: ctx.json?.os_version != null
81+
ignore_failure: true
82+
- rename:
83+
field: json.domain
84+
target_field: user.domain
85+
ignore_missing: true
86+
ignore_failure: true
87+
- rename:
88+
field: json.src_user_name
89+
target_field: user.name
90+
ignore_missing: true
91+
ignore_failure: true
92+
- rename:
93+
field: json.user_sid
94+
target_field: user.id
95+
ignore_missing: true
96+
ignore_failure: true
97+
- rename:
98+
field: json.file_type
99+
target_field: file.type
100+
if: ctx.json?.file_type != null
101+
ignore_missing: true
102+
ignore_failure: true
103+
- join:
104+
field: json.file_name
105+
target_field: file.name
106+
separator: ','
107+
if: ctx.json?.file_name != null
108+
ignore_failure: true
109+
- remove:
110+
field: file.name
111+
ignore_missing: true
112+
ignore_failure: true
113+
if: ctx.file.name == " "
114+
- rename:
115+
field: json.file_size
116+
target_field: file.size
117+
ignore_missing: true
118+
ignore_failure: true
119+
- join:
120+
field: json.resource
121+
target_field: file.path
122+
separator: ','
123+
if: ctx.json?.resource != null && !["http emulation", "url reputation"].contains(ctx.json?.protection_type?.toLowerCase())
124+
ignore_failure: true
125+
- join:
126+
field: json.resource
127+
target_field: url.original
128+
separator: ','
129+
if: ctx.json?.resource != null && ["http emulation", "url reputation"].contains(ctx.json?.protection_type?.toLowerCase())
130+
ignore_failure: true
131+
- uri_parts:
132+
field: url.original
133+
tag: uri_parts_harmony_endpoint_forensics
134+
ignore_missing: true
135+
on_failure:
136+
- append:
137+
field: error.message
138+
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
139+
- rename:
140+
field: json.file_md5
141+
target_field: file.hash.md5
142+
if: ctx.json?.file_md5 != null
143+
ignore_missing: true
144+
ignore_failure: true
145+
- rename:
146+
field: json.file_sha1
147+
target_field: file.hash.sha1
148+
if: ctx.json?.file_sha1 != null
149+
ignore_missing: true
150+
ignore_failure: true
151+
- rename:
152+
field: json.protection_name
153+
target_field: rule.name
154+
ignore_missing: true
155+
ignore_failure: true
156+
- rename:
157+
field: json.protection_type
158+
target_field: harmony_endpoint.forensics.protection_type
159+
- rename:
160+
field: json.attack_status
161+
target_field: harmony_endpoint.forensics.attack_status
162+
ignore_missing: true
163+
ignore_failure: true
164+
- rename:
165+
field: json.detected_by
166+
target_field: harmony_endpoint.forensics.detected_by
167+
- rename:
168+
field: json.confidence_level
169+
target_field: harmony_endpoint.forensics.confidence_level
170+
- rename:
171+
field: json.description
172+
target_field: harmony_endpoint.forensics.description
173+
- rename:
174+
field: json.policy_date
175+
target_field: harmony_endpoint.forensics.policy.date
176+
- rename:
177+
field: json.policy_name
178+
target_field: harmony_endpoint.forensics.policy.name
179+
- rename:
180+
field: json.policy_number
181+
target_field: harmony_endpoint.forensics.policy.number
182+
- rename:
183+
field: json.severity
184+
target_field: harmony_endpoint.forensics.severity
185+
- rename:
186+
field: json.service_domain
187+
target_field: harmony_endpoint.forensics.service_domain
188+
- rename:
189+
field: json.packet_capture_unique_id
190+
target_field: harmony_endpoint.forensics.packet_capture_unique_id
191+
- rename:
192+
field: json.suspicious_events
193+
target_field: harmony_endpoint.forensics.suspicious_events
194+
if: ctx.json?.suspicious_events != null
195+
- rename:
196+
field: json.tenant_id
197+
target_field: harmony_endpoint.forensics.tenant_id
198+
- rename:
199+
field: json.client_name
200+
target_field: harmony_endpoint.forensics.client.name
201+
- join:
202+
field: json.malware_action
203+
target_field: harmony_endpoint.forensics.malware.action
204+
separator: ','
205+
ignore_failure: true
206+
if: ctx.json?.malware_action != null
207+
- remove:
208+
field: harmony_endpoint.forensics.malware.action
209+
ignore_missing: true
210+
ignore_failure: true
211+
if: ctx.harmony_endpoint?.forensics?.malware?.action == " "
212+
- join:
213+
field: json.client_version
214+
target_field: harmony_endpoint.forensics.client.version
215+
separator: ','
216+
ignore_failure: true
217+
if: ctx.json?.client_version != null
218+
- remove:
219+
field: json
220+
ignore_missing: true
221+
ignore_failure: true
222+
- remove:
223+
field: message
224+
if: ctx.event?.original != null
225+
ignore_missing: true
226+
ignore_failure: true
7227
on_failure:
8-
- set:
9-
field: error.message
10-
value: '{{ _ingest.on_failure_message }}'
11-
- remove:
12-
field: event.installed_products
13-
ignore_failure: true
228+
- set:
229+
field: error.message
230+
value: "{{ _ingest.on_failure_message }}"

‎packages/checkpoint_harmony_endpoint/data_stream/forensics/fields/fields.yml

Lines changed: 30 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1,42 @@
1-
- name: harmony_endpoint
1+
- name: harmony_endpoint.forensics
22
type: group
33
fields:
4-
- name: time
5-
type: date
6-
description: Time
7-
- name: id
8-
type: keyword
9-
description: ID
10-
- name: confidence_level
11-
type: keyword
12-
description: Confidence level
13-
- name: severity
14-
type: keyword
15-
description: Event severity
16-
- name: policy_date
17-
type: date
18-
description: Policy Date
19-
- name: policy_name
20-
type: keyword
21-
description: Policy Name
22-
- name: policy_number
23-
type: keyword
24-
description: Policy Name
25-
- name: action
26-
type: keyword
27-
description: Action
28-
- name: protection_type
29-
type: keyword
30-
description: Protection Type
314
- name: attack_status
325
type: keyword
33-
description: Attack Status
346
- name: detected_by
357
type: keyword
36-
description: Detected By
37-
- name: event_type
8+
- name: confidence_level
389
type: keyword
39-
description: Event Type
40-
- name: malware_action
41-
type: text
42-
description: Action Taken
43-
- name: protection_name
10+
- name: description
4411
type: text
45-
description: Protection Name
46-
- name: text
47-
type: flattened
48-
description: Resource
49-
- name: src
50-
type: ip
51-
description: Source IP
52-
- name: src_machine_name
12+
- name: policy
13+
type: group
14+
fields:
15+
- name: date
16+
type: date
17+
- name: name
18+
type: keyword
19+
- name: number
20+
type: integer
21+
- name: protection_type
5322
type: keyword
54-
description: Source Host Name
55-
- name: src_user_name
56-
type: text
57-
description: Source User Name
58-
- name: file_name
59-
type: text #Apply Regex or extract first value from list.
60-
description: File Name
61-
- name: file_size
62-
type: integer
63-
description: File Size
64-
- name: host_type
65-
type: text
66-
description: Host Types
67-
- name: product
23+
- name: severity
6824
type: keyword
69-
description: Product
70-
- name: user_sid
25+
- name: service_domain
7126
type: keyword
72-
description: User SID
73-
- name: type
27+
- name: packet_capture_unique_id
7428
type: keyword
75-
description: Capture Type
29+
- name: suspicious_events
30+
type: flattened
31+
- name: tenant_id
32+
type: keyword
33+
- name: malware
34+
type: group
35+
fields:
36+
- name: action
37+
type: keyword
38+
- name: client
39+
type: group
40+
fields:
41+
- name: version
42+
type: version

0 commit comments

Comments
 (0)