›

Claroty CTD

Version	0.4.0 [beta] This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. (View all)
Compatible Kibana version(s)	8.13.0 or higher
Supported Serverless project types What’s this?	Security Observability
Subscription level What’s this?	Basic
Level of support What’s this?	Elastic

Overview

edit

Claroty CTD is a robust solution that delivers comprehensive cybersecurity controls for industrial and government environments. The company’s comprehensive platform connects seamlessly with customers' existing infrastructure and programs while providing a full range of industrial cybersecurity controls for visibility, threat detection, risk and vulnerability management, and secure remote access all with a significantly reduced total cost of ownership.

Claroty CTD integration collects and parses data using a Syslog server and REST API, then visualizes it in Kibana.

Compatibility

edit

This module has been tested against the latest Claroty CTD version 4.10.0.

Data streams

edit

The Claroty CTD integration collects 7 types of message:

Supported via Syslog

edit

[Activity Log] - The Activity Log records activities performed in CTD in the last year by users and by the system.

[Alerts] - Qualified and quantified event or chain of events which are based on various risk factors. Further categorized as either Security Alerts or Integrity Alerts depending on the nature of the alert.

[Events] - Events are the foundation of the CTD’s threat detection module. They are conversations or activities logged by various engines in CTD, which are then categorized as either risky (Alert or OT Alert) or non-risky (Non-Risky Change or an OT Operation) events.

[Health Monitoring] - Scheduled periodic system Health Monitoring information can be sent via Syslog messages.This can be used for forwarding real-time system health status information to external monitoring tools and for alert generation.

[Insights] - The CTD system identifies assets affected by potential security risks, based on a variety of out-of-the-box use cases, and groups them together into insights. The purpose of the insights is to provide knowledge regarding these security risks and indicate mitigation measures, which will improve the overall security posture of the organization.

Supported via REST API

edit

[Assets] - Asset is any distinguishable network entity. CTD can discover an extensive range of assets in three classes - OT, IT, and IoT.

[Baseline] - Baseline is a collection of valid network behaviors. An individual baseline represents a command or an instance of communication between two assets.

The Claroty CTD integration collects logs for different events, but for syslog input we have combined all of those in one data stream named event.

Requirements

edit

Elastic Agent must be installed.
You can install only one Elastic Agent per host.
Elastic Agent is required to stream data through the Syslog server and ship the data to Elastic, where the events will then be processed via the integration’s ingest pipelines.

Installing and managing an Elastic Agent:

edit

You have a few options for installing and managing an Elastic Agent:

Install a Fleet-managed Elastic Agent (recommended):

edit

With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.

Install Elastic Agent in standalone mode (advanced users):

edit

With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.

Install Elastic Agent in a containerized environment:

edit

You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.

There are some minimum requirements for running Elastic Agent and for more information, refer to the link here.

Setup

edit

To collect data via TCP/UDP, follow the below steps:

edit

To set up Claroty CTD, refer to the Installation Guide.
To configure the syslog message types in Claroty CTD, refer to the Administration Guide.
Claroty CTD supports multiple message formats, including RFC5424, CEF, and CEF(Latest). Currently, we recommend using the CEF(Latest) message format for optimal integration with Elastic.

To collect data via REST API, follow the below steps:

edit

To set up Claroty CTD, refer to the Installation Guide.
Obtain the credentials (username, password, and URL) that are generated during the setup process.

Enabling the integration in Elastic:

edit

In Kibana go to Management > Integrations.
In "Search for integrations" search bar, type Claroty CTD.
Select "Claroty CTD" integration from the search results.
To collect logs via TCP or UDP, please enter the following details:
- Listen Address
- Listen Port
  
  To collect logs via REST API, please enter the following details:
- Username
- Password
- URL

Logs Reference

edit

Event

edit

This is the event dataset.

Example

An example event for event looks as following:

{
    "@timestamp": "2023-08-13T01:00:00.000Z",
    "agent": {
        "ephemeral_id": "6c3f14b1-0b2c-4bec-8859-27a02692a875",
        "id": "7090d98c-c949-469c-9209-a0de3adaaa65",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.14.0"
    },
    "claroty_ctd": {
        "event": {
            "busy": {
                "dm": {
                    "a_value": 0.77,
                    "value": 0.66
                },
                "fd": 0.11,
                "sda": {
                    "a_value": 0.33,
                    "b_value": 0.44,
                    "value": 0.22
                },
                "sr": 0.55
            },
            "capsaver": {
                "folder_cleanup": true
            },
            "class_id": "HealthCheck",
            "conclude_time": 50,
            "cpu": 12.21,
            "ctrl_site": 48,
            "dissection": {
                "coverage": 44,
                "efficiency": {
                    "dcerpc": 4.2345,
                    "factory_talk_rna": 6.2345,
                    "ge_ifix": 15.2345,
                    "http": 11.2345,
                    "jrmi": 14.2345,
                    "ldap": 13.2345,
                    "llc": 16.2345,
                    "matrikon_nopc": 17.2345,
                    "modbus": 2.2345,
                    "rdp": 9.2345,
                    "smb": 3.2345,
                    "ssh": 10.2345,
                    "ssl": 7.2345,
                    "tcp_http": 12.2345,
                    "vnc": 18.2345,
                    "vrrp_protocol_matcher": 8.2345,
                    "zabbix": 5.2345
                }
            },
            "dissector_ng_packet_drops": 35,
            "dropped_entities": 51,
            "exceptions": 31,
            "full_output_packet_drops": 34,
            "input_packet_drops": 32,
            "loop_call_duration": {
                "baseline_tracker_wrker_handle_network_statistics": 1.2345,
                "cloud_client_wrkr_base_run_cloud_connected": 22.2345,
                "poll_objects": 21.2345
            },
            "memory": 13.31,
            "message": "Successfully ran health monitoring",
            "mysql_query": 19.2345,
            "name": "Health",
            "output_packet_drops": 33,
            "postgres_query": 20.2345,
            "psql_idle": {
                "in_transaction_sessions": 53,
                "sessions": 52
            },
            "queue": {
                "baseline_tracker": 1,
                "bridge": 2,
                "central_bridge": 3,
                "concluding": 4,
                "diode_feeder": 5,
                "dissector": {
                    "a_value": 7,
                    "ng": 8,
                    "value": 6
                },
                "indicator_service": 9,
                "leecher": 10,
                "monitor": 11,
                "network_statistics": 12,
                "packets": {
                    "count": 13,
                    "errors": 14
                },
                "preprocessing": {
                    "count": 15,
                    "ng": 16
                },
                "priority_processing": 17,
                "processing": {
                    "count": 18,
                    "high": 19
                },
                "purge": 22,
                "statistics_ng": 20,
                "syslog": {
                    "alerts": 23,
                    "events": 24,
                    "insights": 25
                },
                "zordon_updates": 21
            },
            "read_count": {
                "dissector": {
                    "a_value": 27,
                    "count": 26,
                    "ng": 28
                },
                "preprocessing": {
                    "count": 29,
                    "ng": 30
                }
            },
            "real_time": "2023-08-14T01:00:00.000Z",
            "sensor_name": "Sensor-1",
            "service": {
                "docker": "Down",
                "firewalld": "Down",
                "icsranger": "Down",
                "jwthenticator": "Down",
                "mariadb": "Down",
                "netunnel": "Down",
                "postgres": "Down",
                "rabbit_mq": "Down",
                "redis": "Down",
                "watchdog": "Down"
            },
            "severity": 0,
            "site": "Default",
            "sniffer_status": {
                "site": 23.2345
            },
            "tag_artifacts_drops": {
                "dissector_pypy": {
                    "sum": 43,
                    "value": 42
                },
                "preprocessor": {
                    "sum": 37,
                    "value": 36
                },
                "processor": {
                    "sum": 39,
                    "value": 38
                },
                "sniffer": {
                    "sum": 41,
                    "value": 40
                }
            },
            "time": "2023-08-13T01:00:00.000Z",
            "unhandled_events": 49,
            "used": {
                "etc": 17.71,
                "opt_icsranger": 14.41,
                "tmp": 16.61,
                "var": 15.51
            },
            "version": "0",
            "worker": {
                "active": {
                    "executer": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    },
                    "value": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    }
                },
                "authentication": {
                    "api": "Not Available",
                    "last_restart": "21 min, 18 sec"
                },
                "baseline_tracker": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "bridge": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "cacher": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "capsaver": {
                    "api": "Not Available",
                    "last_restart": "19 min, 17 sec"
                },
                "cloud": {
                    "agent": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    },
                    "client": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    }
                },
                "concluder": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "configurator": {
                    "nginx": {
                        "api": "Not Available",
                        "last_restart": "19 min, 17 sec"
                    },
                    "value": {
                        "api": "Available",
                        "last_restart": "21 min, 18 sec"
                    }
                },
                "dissector": {
                    "a_value": {
                        "api": "Available",
                        "last_restart": "18 min, 34 sec"
                    },
                    "value": {
                        "api": "Available",
                        "last_restart": "18 min, 34 sec"
                    }
                },
                "enricher": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "indicators": {
                    "api": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    },
                    "value": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    }
                },
                "insights": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "known_threats": {
                    "api": "Available",
                    "last_restart": "18 min, 58 sec"
                },
                "leecher": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "mailer": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "mitre": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "notifications": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "preprocessor": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "processor": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "scheduler": {
                    "api": "Available",
                    "last_restart": "21 min, 19 sec"
                },
                "sensor": {
                    "api": "Available",
                    "last_restart": "18 min, 34 sec"
                },
                "sync_manager": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "web": {
                    "auth": {
                        "api": "Not Available",
                        "last_restart": "21 min, 1 sec"
                    },
                    "nginx": {
                        "api": "Not Available",
                        "last_restart": "21 min, 1 sec"
                    },
                    "ranger": {
                        "api": "Not Available",
                        "last_restart": "21 min, 6 sec"
                    },
                    "ws": {
                        "api": "Not Available",
                        "last_restart": "21 min, 1 sec"
                    }
                },
                "workers": {
                    "restart": 47,
                    "stop": 46
                }
            },
            "yara_scanner_test": 45
        }
    },
    "data_stream": {
        "dataset": "claroty_ctd.event",
        "namespace": "19344",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "7090d98c-c949-469c-9209-a0de3adaaa65",
        "snapshot": false,
        "version": "8.14.0"
    },
    "event": {
        "agent_id_status": "verified",
        "dataset": "claroty_ctd.event",
        "ingested": "2024-09-05T10:02:23Z",
        "kind": "event",
        "original": "<134>1 2023-08-15T01:00:00Z Site syslog-HealthCheck-Default - - - CEF:0|Claroty|CTD|4.10.0|HealthCheck|Health|0|CtdRealTime=Aug 14 2023 01:00:00 CtdTimeGenerated=Aug 13 2023 01:00:00 CtdMessage=Successfully ran health monitoring CtdSite=Default CtdCpu=12.21 CtdMem=13.31 CtdUsedOptIcsranger=14.41 CtdUsedVar=15.51 CtdUsedTmp=16.61 CtdUsedEtc=17.71 CtdBusyFd=0.11 CtdBusySda=0.22 CtdBusySdaA=0.33 CtdBusySdaB=0.44 CtdBusySr=0.55 CtdBusyDm=0.66 CtdBusyDmA=0.77 CtdQuBaselineTracker=1 CtdQuBridge=2 CtdQuCentralBridge=3 CtdQuConcluding=4 CtdQuDiodeFeeder=5 CtdQuDissector=6 CtdQuDissectorA=7 CtdQuDissectorNg=8 CtdQuIndicatorService=9 CtdQuLeecher=10 CtdQuMonitor=11 CtdQuNetworkStatistics=12 CtdQuPackets=13 CtdQuPacketsErrors=14 CtdQuPreprocessing=15 CtdQuPreprocessingNg=16 CtdQuPriorityProcessing=17 CtdQuProcessing=18 CtdQuProcessingHigh=19 CtdQuStatisticsNg=20 CtdQuZordonUpdates=21 CtdQueuePurge=22 CtdQuSyslogAlerts=23 CtdQuSyslogEvents=24 CtdQuSyslogInsights=25 CtdRdDissector=26 CtdRdDissectorA=27 CtdRdDissectorNg=28 CtdRdPreprocessing=29 CtdRdPreprocessingNg=30 CtdSvcMariaDb=Down CtdSvcPostgres=Down CtdSvcRedis=Down CtdSvcRabbitMq=Down CtdSvcIcsranger=Down CtdSvcWatchdog=Down CtdSvcFirewalld=Down CtdSvcNetunnel=Down CtdSvcJwthenticator=Down CtdSvcDocker=Down CtdExceptions=31 CtdInputPacketDrops=32 CtdOutputPacketDrops=33 CtdFullOutputPacketDrops=34 CtdDissectorNgPacketDrops=35 CtdTagArtifactsDropsPreprocessor=36 CtdTagArtifactsDropsPreprocessorSum=37 CtdTagArtifactsDropsProcessor=38 CtdTagArtifactsDropsProcessorSum=39 CtdTagArtifactsDropsSniffer=40 CtdTagArtifactsDropsSnifferSum=41 CtdTagArtifactsDropsDissectorPypy=42 CtdTagArtifactsDropsDissectorPypySum=43 CtdCapsaverFolderCleanup=TRUE CtdDissectionCoverage=44 CtdCapsaverUtilzationTest=N/A CtdYaraScannerTest=45 CtdWrkrWorkersStop=46 CtdWrkrWorkersRestart=47 CtdWrkrActiveExecuter={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrSensor={'api': 'Available', 'last_restart': '18 min, 34 sec'} CtdWrkrAuthentication={'api': 'Not Available', 'last_restart': '21 min, 18 sec'} CtdWrkrMailer={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrMitre={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrNotifications={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrProcessor={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrCloudAgent={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrCloudClient={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrScheduler={'api': 'Available', 'last_restart': '21 min, 19 sec'} CtdWrkrknownThreats={'api': 'Available', 'last_restart': '18 min, 58 sec'} CtdWrkrCacher={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrInsights={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrActive={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrEnricher={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrIndicators={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrIndicatorsApi={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrConcluder={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrPreprocessor={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrLeecher={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrSyncManager={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrBridge={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrWebRanger={'api': 'Not Available', 'last_restart': '21 min, 6 sec'} CtdWrkrWebWs={'api': 'Not Available', 'last_restart': '21 min, 1 sec'} CtdWrkrWebAuth={'api': 'Not Available', 'last_restart': '21 min, 1 sec'} CtdWrkrWebNginx={'api': 'Not Available', 'last_restart': '21 min, 1 sec'} CtdWrkrConfigurator={'api': 'Available', 'last_restart': '21 min, 18 sec'} CtdWrkrConfiguratorNginx={'api': 'Not Available', 'last_restart': '19 min, 17 sec'} CtdWrkrCapsaver={'api': 'Not Available', 'last_restart': '19 min, 17 sec'} CtdWrkrBaselineTracker={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrDissector={'api': 'Available', 'last_restart': '18 min, 34 sec'} CtdWrkrDissectorA={'api': 'Available', 'last_restart': '18 min, 34 sec'} CtdSensorName=Sensor-1 CtdCtrlSite=48 CtdLoopCallDurationBaselineTrackerWrkerHandleNetworkStatistics=1.2345 CtdDissectionEfficiencyModbus=2.2345 CtdDissectionEfficiencySmb=3.2345 CtdDissectionEfficiencyDcerpc=4.2345 CtdDissectionEfficiencyZabbix=5.2345 CtdDissectionEfficiencyFactorytalkRna=6.2345 CtdDissectionEfficiencySsl=7.2345 CtdDissectionEfficiencyVrrpProtocolMatcher=8.2345 CtdDissectionEfficiencyRdp=9.2345 CtdDissectionEfficiencySsh=10.2345 CtdDissectionEfficiencyHttp=11.2345 CtdDissectionEfficiencyTcpHttp=12.2345 CtdDissectionEfficiencyLdap=13.2345 CtdDissectionEfficiencyJrmi=14.2345 CtdDissectionEfficiencyGeIfix=15.2345 CtdDissectionEfficiencyLlc=16.2345 CtdDissectionEfficiencyMatrikonNopc=17.2345 CtdDissectionEfficiencyVnc=18.2345 CtdUnhandledEvents=49 CtdConcludeTime=50 CtdMysqlQuery=19.2345 CtdPostgresQuery=20.2345 CtdDroppedEntities=51 CtdPsqlIdleSessions=52 CtdPsqlIdleInTransactionSessions=53 CtdSnifferStatus=N/A CtdLoopCallDurationPollObjects=21.2345 CtdLoopCallDurationCloudClientWrkrBaseRunCloudConnected=22.2345 CtdSnifferStatusCentral=N/A CtdSnifferStatusSite=23.2345"
    },
    "host": {
        "cpu": {
            "usage": 12.21
        }
    },
    "input": {
        "type": "udp"
    },
    "log": {
        "source": {
            "address": "192.168.243.7:46503"
        }
    },
    "message": "Successfully ran health monitoring",
    "observer": {
        "hostname": "Default",
        "product": "CTD",
        "vendor": "Claroty",
        "version": "4.10.0"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "claroty_ctd-event"
    ]
}

Exported fields

Field	Description	Type
@timestamp	Event timestamp.	date
claroty_ctd.event.action.status	Describes the final Status for the Activity Log (e.g. Info, Failure, Success, etc.).	keyword
claroty_ctd.event.action.value	Action of the Activity Log (e.g. Added, Removed, Updated, Created, etc.).	keyword
claroty_ctd.event.alert.id	The ID of the Alert.	keyword
claroty_ctd.event.alert.link	URL for viewing the event in CTD.	keyword
claroty_ctd.event.alert.score	Alerts are scored from a scale of 0 through 100. Actual alert score can be higher than 100 depending on the sum of various indicator scores, however it is capped at max 100.	long
claroty_ctd.event.alert.status	Used to differentiate alerts with an Unresolved vs. Resolved status. Because resolved alerts are not sent by default, this field is empty. To enable receiving resolved alerts in Syslog, use this CLI command: lm set_config report_resolved_alerts True lm rw notifications.	keyword
claroty_ctd.event.alert.type_id	The Class ID of the Alert (As it is in CTD’s Back-end).	keyword
claroty_ctd.event.application	Application used in this Insight.	keyword
claroty_ctd.event.assigned_to	Name of the user who was assigned to this Alert.	keyword
claroty_ctd.event.busy.dm.a_value	How frequently the particular disk partition is in use (as a percentage between 0 and 1.	double
claroty_ctd.event.busy.dm.value	How frequently the particular disk partition is in use (as a percentage between 0 and 1.	double
claroty_ctd.event.busy.fd	How frequently the particular disk partition is in use (as a percentage between 0 and 1.	double
claroty_ctd.event.busy.sda.a_value	How frequently the particular disk partition is in use (as a percentage between 0 and 1.	double
claroty_ctd.event.busy.sda.b_value	How frequently the particular disk partition is in use (as a percentage between 0 and 1.	double
claroty_ctd.event.busy.sda.value	How frequently the particular disk partition is in use (as a percentage between 0 and 1.	double
claroty_ctd.event.busy.sr	How frequently the particular disk partition is in use (as a percentage between 0 and 1.	double
claroty_ctd.event.capsaver.folder_cleanup		boolean
claroty_ctd.event.capsaver.utilzation_test		keyword
claroty_ctd.event.category	Category/Type of the Alert.	keyword
claroty_ctd.event.class_id	CEF Event Class ID.	keyword
claroty_ctd.event.class_type	CEF Event Class type for alert and event.	keyword
claroty_ctd.event.community	In Insights involving SNMP queries this will mention the community type used during the authentication.	keyword
claroty_ctd.event.conclude_time		long
claroty_ctd.event.cpu	CPU Utilization: CPU load average as a percentage of the total available CPU capacity (including all available cores).	double
claroty_ctd.event.ctrl_site		double
claroty_ctd.event.cve.id	Unique identifier of the CVE.	keyword
claroty_ctd.event.cve.modified_date	The date and time the CVE was modified by global security community.	date
claroty_ctd.event.cve.pipe_service	In Insights involving SMB access, this will list the pipe service that was accessed.	keyword
claroty_ctd.event.cve.publish_date	The date and time the CVE was found by global security community.	date
claroty_ctd.event.cve.score	CVSS - Common Vulnerability Scoring System score (0-10).	double
claroty_ctd.event.default_password	Checks if the Asset uses a default password.	boolean
claroty_ctd.event.destination.asset_type	The asset type of the secondary asset, e.g. Engineering Station If multiple destinations exist, they won’t be presented.	keyword
claroty_ctd.event.destination.host	The host name of the secondary asset involved in the Alert. May be FQDN or hostname.	keyword
claroty_ctd.event.destination.ip	The IPv4 address of the secondary asset involved in the Alert.	ip
claroty_ctd.event.destination.mac	The MAC address of the secondary asset involved in the Alert.	keyword
claroty_ctd.event.destination.zone	Destination Zone Name If multiple destinations exist, they won’t be presented.	keyword
claroty_ctd.event.device_external_id	Name of the site generating the message.	keyword
claroty_ctd.event.dissection.coverage		long
claroty_ctd.event.dissection.efficiency.dcerpc		double
claroty_ctd.event.dissection.efficiency.factory_talk_rna		double
claroty_ctd.event.dissection.efficiency.ge_ifix		double
claroty_ctd.event.dissection.efficiency.http		double
claroty_ctd.event.dissection.efficiency.jrmi		double
claroty_ctd.event.dissection.efficiency.ldap		double
claroty_ctd.event.dissection.efficiency.llc		double
claroty_ctd.event.dissection.efficiency.matrikon_nopc		double
claroty_ctd.event.dissection.efficiency.modbus		double
claroty_ctd.event.dissection.efficiency.rdp		double
claroty_ctd.event.dissection.efficiency.smb		double
claroty_ctd.event.dissection.efficiency.ssh		double
claroty_ctd.event.dissection.efficiency.ssl		double
claroty_ctd.event.dissection.efficiency.tcp_http		double
claroty_ctd.event.dissection.efficiency.vnc		double
claroty_ctd.event.dissection.efficiency.vrrp_protocol_matcher		double
claroty_ctd.event.dissection.efficiency.zabbix		double
claroty_ctd.event.dissector_ng_packet_drops		long
claroty_ctd.event.dropped_entities	The number of entities dropped by the system due to reaching the limit of number of entities.	long
claroty_ctd.event.end_of_life_date	In Unsupported OS Insights, this presented the End of Life date for the primary asset of this insight.	date
claroty_ctd.event.event_type_id	The Class ID of the Event (As it is in CTD’s Back-end).	keyword
claroty_ctd.event.exceptions	The number of new logged exceptions.	long
claroty_ctd.event.external.id	The ID of the Alert.	keyword
claroty_ctd.event.external.links	More information about publicly available signatures.	keyword
claroty_ctd.event.file_path	The filepath or file share envolved in the Insight.	keyword
claroty_ctd.event.full_output_packet_drops		long
claroty_ctd.event.input_packet_drops		long
claroty_ctd.event.insight.password_plaintext	Checks if the Asset implements a protocol that transfers data in plain-text.	boolean
claroty_ctd.event.insight.state	Describes the PLC’s state.	keyword
claroty_ctd.event.insight.user	The User name involved in the Insight.	keyword
claroty_ctd.event.insights.protocol	The Protocol envolved in the Insight.	keyword
claroty_ctd.event.insights.protocol_version	The Version of the Protocol envolved in the Insight.	keyword
claroty_ctd.event.insights.severity	Indicates the Insight Severity (Low, Medium, and High).	keyword
claroty_ctd.event.is_ghost	In Insights involving communication with other IP’s this will describe if the external IP’s are Ghost assets or real assets.	boolean
claroty_ctd.event.last_managed	In Insights involving managed PLC’s this will present the date when it was last managed.	date
claroty_ctd.event.log_type	Describes the level type that created the Activity Log (e.g. System or User.).	keyword
claroty_ctd.event.loop_call_duration.baseline_tracker_wrker_handle_network_statistics		double
claroty_ctd.event.loop_call_duration.cloud_client_wrkr_base_run_cloud_connected		double
claroty_ctd.event.loop_call_duration.poll_objects		double
claroty_ctd.event.memory	Memory Usage: The percent of current memory consumption.The value is a number between 0 and 100.	double
claroty_ctd.event.message	Full description of the message.	keyword
claroty_ctd.event.method	The query method used in the Insight.	keyword
claroty_ctd.event.mitre_attack.tactic_names	The MITRE ATT&CK® for ICS framework Tactic that are mapped to this Alert.	keyword
claroty_ctd.event.mitre_attack.technique_ids	The MITRE ATT&CK® for ICS framework Techniques that are mapped to this Alert.	keyword
claroty_ctd.event.model	This presented the model of the primary asset of this insight.	keyword
claroty_ctd.event.mysql_query	MySQL Query time, in seconds.	double
claroty_ctd.event.name	CEF Event Name.	keyword
claroty_ctd.event.no_password	Checks if the Asset has no password.	boolean
claroty_ctd.event.number_of.accesed_client	For Insights presenting assets that are identified as web servers, this field will show the clients connecting to this web server.	long
claroty_ctd.event.number_of.interface	For Insights presenting assets with multiple interfaces, this field will show the number of interfaces on the specific asset.	long
claroty_ctd.event.number_of.neighbours	In Insights presenting the highly Connected Assets, this field will show the number of connected assets.	long
claroty_ctd.event.operating_system	This presented the Operating System of the primary asset of this insight.	keyword
claroty_ctd.event.output_packet_drops		long
claroty_ctd.event.postgres_query	Postgres Query time, in seconds.	double
claroty_ctd.event.protocol	Protocol used within the Alert.	keyword
claroty_ctd.event.psql_idle.in_transaction_sessions		long
claroty_ctd.event.psql_idle.sessions		long
claroty_ctd.event.queue.baseline_tracker	Baseline Tracker queue message count.	long
claroty_ctd.event.queue.bridge	Bridge queue message count.	long
claroty_ctd.event.queue.central_bridge	CentralBridge queue message count.	long
claroty_ctd.event.queue.concluding	Concluding queue message count.	long
claroty_ctd.event.queue.diode_feeder	DiodeFeeder queue message count.	long
claroty_ctd.event.queue.dissector.a_value	DissectorA queue message count.	long
claroty_ctd.event.queue.dissector.ng	DissectorNg queue message count.	long
claroty_ctd.event.queue.dissector.value	Dissector queue message count.	long
claroty_ctd.event.queue.indicator_service	IndicatorService queue message count.	long
claroty_ctd.event.queue.leecher	Leecher queue message count.	long
claroty_ctd.event.queue.monitor	Monitor queue message count.	long
claroty_ctd.event.queue.network_statistics	NetworkStatistics queue message count.	long
claroty_ctd.event.queue.packets.count	Packets queue message count.	long
claroty_ctd.event.queue.packets.errors	PacketsErrors queue message count.	long
claroty_ctd.event.queue.preprocessing.count	Preprocessing queue message count.	long
claroty_ctd.event.queue.preprocessing.ng	PreprocessingNg queue message count.	long
claroty_ctd.event.queue.priority_processing	PriorityProcessing queue message count.	long
claroty_ctd.event.queue.processing.count	Processing queue message count.	long
claroty_ctd.event.queue.processing.high	ProcessingHigh queue message count.	long
claroty_ctd.event.queue.purge	Purge queue message count.	long
claroty_ctd.event.queue.statistics_ng	StatisticsNg queue message count.	long
claroty_ctd.event.queue.syslog.alerts	SyslogSlerts queue message count.	long
claroty_ctd.event.queue.syslog.events	SyslogEvents queue message count.	long
claroty_ctd.event.queue.syslog.insights	SyslogInsights queue message count.	long
claroty_ctd.event.queue.zordon_updates	ZordonUpdates queue message count.	long
claroty_ctd.event.read_count.dissector.a_value	The queue read count for each component.	long
claroty_ctd.event.read_count.dissector.count	The queue read count for each component.	long
claroty_ctd.event.read_count.dissector.ng	The queue read count for each component.	long
claroty_ctd.event.read_count.preprocessing.count	The queue read count for each component.	long
claroty_ctd.event.read_count.preprocessing.ng	The queue read count for each component.	long
claroty_ctd.event.real_time	Timestamp of HealthCheck creation.	date
claroty_ctd.event.resolved.as	Type of resolution. (Unresolved, Valid, Incident, Training, User Alert Rules, Unqualified, Ignore, Acknowledge, Auto Approved With No Expiration, Auto Approved With Expiration, Auto Archived With No Expiration, Auto Archived With Expiration). Because resolved alerts are not sent by default, this field is empty. To enable receiving resolved alerts in Syslog, use this CLI command: lm set_config report_resolved_alerts True lm rw notifications.	keyword
claroty_ctd.event.resolved.by	Name of the user (or System) who resolved the Alert. Because resolved alerts are not sent by default, this field is empty. To enable receiving resolved alerts in Syslog, use this CLI command: lm set_config report_resolved_alerts True lm rw notifications.	keyword
claroty_ctd.event.risk_score	In Insights presenting the top risky assets, this will present the risk for the specific asset.	long
claroty_ctd.event.sensor_name		keyword
claroty_ctd.event.series	This presented the series of the primary asset of this insight.	keyword
claroty_ctd.event.service.docker	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.service.firewalld	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.service.icsranger	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.service.jwthenticator	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.service.mariadb	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.service.netunnel	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.service.postgres	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.service.rabbit_mq	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.service.redis	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.service.watchdog	Whether the service is running (Up or Down).	keyword
claroty_ctd.event.severity	CEF Event Severity.	long
claroty_ctd.event.signature.confidence	A score representing the probability that a communication event that triggers the signature is a network threat. Expressed on a scale of 1% to 100%, It is calculated using a combination of signature parameters and Claroty research, and does not apply to user-powered signatures.	keyword
claroty_ctd.event.signature.criticality	A score calculated using a combination of signature parameters and Claroty research. Possible values include Low, Medium, High, and Critical. This score is not calculated for user-powered signatures.	keyword
claroty_ctd.event.signature.id	ID number assigned to the signature by its creator.	keyword
claroty_ctd.event.signature.last_updated	Date this revision was last updated by its creator.	date
claroty_ctd.event.signature.name	Name assigned to the signature by its creator.	keyword
claroty_ctd.event.signature.powered_by	Creator and maintainer of the signature. Options include: Claroty - Signatures created by Team82 or by Claroty’s data team Emerging Threats, Other - Publicly available signatures Username of the user who uploaded the signature User - User-powered signatures created in a version earlier than v4.8.0.	keyword
claroty_ctd.event.signature.tags	Attack types and other enriched signature information.	keyword
claroty_ctd.event.site	The ID of the site.	keyword
claroty_ctd.event.sniffer_status.central		keyword
claroty_ctd.event.sniffer_status.site		double
claroty_ctd.event.sniffer_status.value		keyword
claroty_ctd.event.source.asset_type	The asset type of the primary asset, e.g. Engineering Station.	keyword
claroty_ctd.event.source.host	The host name of the Primary asset involved in the Alert. May be FQDN or hostname.	keyword
claroty_ctd.event.source.ip	The IPv4 address of the primary asset involved in the Alert.	ip
claroty_ctd.event.source.mac	The MAC address of the primary asset involved in the Alert.	keyword
claroty_ctd.event.source.zone	Source Zone Name.	keyword
claroty_ctd.event.story_id	The Story ID for which this Alert is correlated.	keyword
claroty_ctd.event.tag_artifacts_drops.dissector_pypy.sum		long
claroty_ctd.event.tag_artifacts_drops.dissector_pypy.value		long
claroty_ctd.event.tag_artifacts_drops.preprocessor.sum		long
claroty_ctd.event.tag_artifacts_drops.preprocessor.value		long
claroty_ctd.event.tag_artifacts_drops.processor.sum		long
claroty_ctd.event.tag_artifacts_drops.processor.value		long
claroty_ctd.event.tag_artifacts_drops.sniffer.sum		long
claroty_ctd.event.tag_artifacts_drops.sniffer.value		long
claroty_ctd.event.time	Timestamp of Alert creation Format is: MMM dd yyyy HH:mm:ss Timezone should be UTC.	date
claroty_ctd.event.unhandled_events	The number of events that have not been handled by the system.	long
claroty_ctd.event.used.etc	The percent of disk space currently used in this particular directory.	double
claroty_ctd.event.used.opt_icsranger	The percent of disk space currently used in this particular directory.	double
claroty_ctd.event.used.tmp	The percent of disk space currently used in this particular directory.	double
claroty_ctd.event.used.var	The percent of disk space currently used in this particular directory.	double
claroty_ctd.event.user	The User name involved in the Activity Log.	keyword
claroty_ctd.event.version	CEF Event Version.	keyword
claroty_ctd.event.worker.active.executer.api		keyword
claroty_ctd.event.worker.active.executer.last_restart		keyword
claroty_ctd.event.worker.active.value.api		keyword
claroty_ctd.event.worker.active.value.last_restart		keyword
claroty_ctd.event.worker.authentication.api		keyword
claroty_ctd.event.worker.authentication.last_restart		keyword
claroty_ctd.event.worker.baseline_tracker.api		keyword
claroty_ctd.event.worker.baseline_tracker.last_restart		keyword
claroty_ctd.event.worker.bridge.api		keyword
claroty_ctd.event.worker.bridge.last_restart		keyword
claroty_ctd.event.worker.cacher.api		keyword
claroty_ctd.event.worker.cacher.last_restart		keyword
claroty_ctd.event.worker.capsaver.api		keyword
claroty_ctd.event.worker.capsaver.last_restart		keyword
claroty_ctd.event.worker.cloud.agent.api		keyword
claroty_ctd.event.worker.cloud.agent.last_restart		keyword
claroty_ctd.event.worker.cloud.client.api		keyword
claroty_ctd.event.worker.cloud.client.last_restart		keyword
claroty_ctd.event.worker.concluder.api		keyword
claroty_ctd.event.worker.concluder.last_restart		keyword
claroty_ctd.event.worker.configurator.nginx.api		keyword
claroty_ctd.event.worker.configurator.nginx.last_restart		keyword
claroty_ctd.event.worker.configurator.value.api		keyword
claroty_ctd.event.worker.configurator.value.last_restart		keyword
claroty_ctd.event.worker.dissector.a_value.api		keyword
claroty_ctd.event.worker.dissector.a_value.last_restart		keyword
claroty_ctd.event.worker.dissector.value.api		keyword
claroty_ctd.event.worker.dissector.value.last_restart		keyword
claroty_ctd.event.worker.enricher.api		keyword
claroty_ctd.event.worker.enricher.last_restart		keyword
claroty_ctd.event.worker.indicators.api.api		keyword
claroty_ctd.event.worker.indicators.api.last_restart		keyword
claroty_ctd.event.worker.indicators.value.api		keyword
claroty_ctd.event.worker.indicators.value.last_restart		keyword
claroty_ctd.event.worker.insights.api		keyword
claroty_ctd.event.worker.insights.last_restart		keyword
claroty_ctd.event.worker.known_threats.api		keyword
claroty_ctd.event.worker.known_threats.last_restart		keyword
claroty_ctd.event.worker.leecher.api		keyword
claroty_ctd.event.worker.leecher.last_restart		keyword
claroty_ctd.event.worker.mailer.api		keyword
claroty_ctd.event.worker.mailer.last_restart		keyword
claroty_ctd.event.worker.mitre.api		keyword
claroty_ctd.event.worker.mitre.last_restart		keyword
claroty_ctd.event.worker.notifications.api		keyword
claroty_ctd.event.worker.notifications.last_restart		keyword
claroty_ctd.event.worker.preprocessor.api		keyword
claroty_ctd.event.worker.preprocessor.last_restart		keyword
claroty_ctd.event.worker.processor.api		keyword
claroty_ctd.event.worker.processor.last_restart		keyword
claroty_ctd.event.worker.scheduler.api		keyword
claroty_ctd.event.worker.scheduler.last_restart		keyword
claroty_ctd.event.worker.sensor.api		keyword
claroty_ctd.event.worker.sensor.last_restart		keyword
claroty_ctd.event.worker.sync_manager.api		keyword
claroty_ctd.event.worker.sync_manager.last_restart		keyword
claroty_ctd.event.worker.web.auth.api		keyword
claroty_ctd.event.worker.web.auth.last_restart		keyword
claroty_ctd.event.worker.web.nginx.api		keyword
claroty_ctd.event.worker.web.nginx.last_restart		keyword
claroty_ctd.event.worker.web.ranger.api		keyword
claroty_ctd.event.worker.web.ranger.last_restart		keyword
claroty_ctd.event.worker.web.ws.api		keyword
claroty_ctd.event.worker.web.ws.last_restart		keyword
claroty_ctd.event.worker.workers.restart	The total number of workers restarted.	long
claroty_ctd.event.worker.workers.stop	The total number of stopped workers.	long
claroty_ctd.event.yara_scanner_test		long
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset.	constant_keyword
event.module	Event module.	constant_keyword
input.type	Type of filebeat input.	keyword
log.offset	Log offset.	long
log.source.address	Source address from which the log event read/sent.	keyword
tags	User defined tags.	keyword

Assets

edit

This is the asset dataset.

Example

An example event for asset looks as following:

{
    "@timestamp": "2024-07-24T15:09:48.000Z",
    "agent": {
        "ephemeral_id": "639a39fa-e0cd-4d50-a485-07788e0cf613",
        "id": "7090d98c-c949-469c-9209-a0de3adaaa65",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.14.0"
    },
    "claroty_ctd": {
        "asset": {
            "approved": true,
            "asset_types": {
                "name": "eHMI",
                "number": 1
            },
            "class_type": "OT",
            "criticalities": {
                "name": "eLow",
                "value": 0
            },
            "custom_attributes": [
                {
                    "asset_id": "1",
                    "category": {
                        "description": "sdfas",
                        "id": "1",
                        "name": "Some Asset",
                        "resource_id": "1-1",
                        "site_id": "1"
                    },
                    "id": "1",
                    "resource_id": "1-1",
                    "site_id": "1",
                    "value": "some value"
                }
            ],
            "first_seen": "2023-04-17T07:30:15.000Z",
            "ghost": false,
            "id": "1",
            "insight_names": [
                "Managed PLCs (by Rockwell users)",
                "Privileged Operations (Operated PLCs)"
            ],
            "installed_programs_count": 0,
            "ipv4": [
                "1.128.0.0"
            ],
            "last_entity_seen": "2023-04-17T07:36:30.000Z",
            "last_seen": "2023-04-17T07:36:30.000Z",
            "last_updated": "2024-07-24T15:09:48.000Z",
            "name": "1.128.0.0",
            "network": {
                "id": "1",
                "name": "Default",
                "resource_id": "1-1",
                "site_id": "1"
            },
            "network_id": "1",
            "num_alerts": 0,
            "parsed": false,
            "patch_count": 0,
            "protocol": [
                "CIP",
                "ENIP",
                "PCCC",
                "TCP"
            ],
            "purdue_level": 2,
            "resource_id": "1-1",
            "risk_level": 0,
            "site_id": "1",
            "site_name": "site-10-0-11-136",
            "special_hints": {
                "name": "eUnicast",
                "value": 0
            },
            "subnet_id": "1",
            "timestamp": "2023-04-17T07:30:15.000Z",
            "usb_devices_count": 0,
            "valid": true,
            "virtual_zone": {
                "id": "2",
                "name": "HMI: Rockwell"
            }
        }
    },
    "data_stream": {
        "dataset": "claroty_ctd.asset",
        "namespace": "42864",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "7090d98c-c949-469c-9209-a0de3adaaa65",
        "snapshot": false,
        "version": "8.14.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "host"
        ],
        "dataset": "claroty_ctd.asset",
        "ingested": "2024-09-05T09:56:07Z",
        "kind": "event",
        "original": "{\"active_queries_names\":[],\"active_tasks_names\":[],\"approved\":true,\"asset_type\":1,\"asset_type__\":\"eHMI\",\"children\":[],\"class_type\":\"OT\",\"code_sections\":[],\"criticality\":0,\"criticality__\":\"eLow\",\"custom_attributes\":[{\"asset_id\":1,\"category\":{\"description\":\"sdfas\",\"id\":1,\"name\":\"Some Asset\",\"resource_id\":\"1-1\",\"site_id\":1},\"id\":1,\"resource_id\":\"1-1\",\"site_id\":1,\"value\":\"some value\"}],\"custom_informations\":[],\"default_gateway\":null,\"display_name\":null,\"domain_workgroup\":null,\"edge_id\":null,\"edge_last_run\":null,\"first_seen\":\"2023-04-17T07:30:15+00:00\",\"ghost\":false,\"id\":1,\"insight_names\":[\"Managed PLCs (by Rockwell users)\",\"Privileged Operations (Operated PLCs)\"],\"installed_antivirus\":null,\"installed_programs_count\":0,\"ipv4\":[\"1.128.0.0\"],\"last_entity_seen\":\"2023-04-17T07:36:30+00:00\",\"last_seen\":\"2023-04-17T07:36:30+00:00\",\"last_updated\":\"2024-07-24T15:09:48+00:00\",\"name\":\"1.128.0.0\",\"network\":{\"id\":1,\"name\":\"Default\",\"resource_id\":\"1-1\",\"site_id\":1},\"network_id\":1,\"num_alerts\":0,\"os_architecture\":null,\"os_build\":null,\"os_revision\":null,\"os_service_pack\":null,\"parsed\":false,\"patch_count\":0,\"project_parsed\":null,\"protocol\":[\"CIP\",\"ENIP\",\"PCCC\",\"TCP\"],\"purdue_level\":2,\"resource_id\":\"1-1\",\"risk_level\":0,\"site_id\":1,\"site_name\":\"site-10-0-11-136\",\"special_hint\":0,\"special_hint__\":\"eUnicast\",\"state\":null,\"subnet\":{\"name\":\"1.128.0.0\"},\"subnet_id\":1,\"subnet_type\":0,\"timestamp\":\"2023-04-17T07:30:15+00:00\",\"usb_devices_count\":0,\"valid\":true,\"virtual_zone_id\":2,\"virtual_zone_name\":\"HMI: Rockwell\"}",
        "severity": 0,
        "type": [
            "info"
        ]
    },
    "host": {
        "id": "1",
        "name": "1.128.0.0"
    },
    "input": {
        "type": "cel"
    },
    "network": {
        "name": "Default",
        "protocol": [
            "cip",
            "enip",
            "pccc",
            "tcp"
        ]
    },
    "related": {
        "ip": [
            "1.128.0.0"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "claroty_ctd-asset"
    ]
}

Exported fields

Field	Description	Type
@timestamp	Event timestamp.	date
claroty_ctd.asset.active.queries_names		keyword
claroty_ctd.asset.active.scans_names		keyword
claroty_ctd.asset.active.tasks_names		keyword
claroty_ctd.asset.approved		boolean
claroty_ctd.asset.asset_types.name		keyword
claroty_ctd.asset.asset_types.number		long
claroty_ctd.asset.children.active_queries_names		keyword
claroty_ctd.asset.children.active_tasks_names		keyword
claroty_ctd.asset.children.address		keyword
claroty_ctd.asset.children.approved		boolean
claroty_ctd.asset.children.asset_types.name		keyword
claroty_ctd.asset.children.asset_types.number		long
claroty_ctd.asset.children.class_type		keyword
claroty_ctd.asset.children.criticalities.name		keyword
claroty_ctd.asset.children.criticalities.value		long
claroty_ctd.asset.children.custom_informations.category		long
claroty_ctd.asset.children.custom_informations.display_key		keyword
claroty_ctd.asset.children.custom_informations.key		keyword
claroty_ctd.asset.children.custom_informations.priority		long
claroty_ctd.asset.children.custom_informations.type		long
claroty_ctd.asset.children.custom_informations.val		keyword
claroty_ctd.asset.children.default_gateway		keyword
claroty_ctd.asset.children.display_name		keyword
claroty_ctd.asset.children.domain_workgroup		keyword
claroty_ctd.asset.children.edge_id		keyword
claroty_ctd.asset.children.edge_last_run		keyword
claroty_ctd.asset.children.firmware		keyword
claroty_ctd.asset.children.first_seen		date
claroty_ctd.asset.children.ghost		boolean
claroty_ctd.asset.children.id		keyword
claroty_ctd.asset.children.installed_antivirus		keyword
claroty_ctd.asset.children.last_entity_seen		date
claroty_ctd.asset.children.last_seen		date
claroty_ctd.asset.children.last_updated		date
claroty_ctd.asset.children.model		keyword
claroty_ctd.asset.children.name		keyword
claroty_ctd.asset.children.network.id		keyword
claroty_ctd.asset.children.network.name		keyword
claroty_ctd.asset.children.network.resource_id		keyword
claroty_ctd.asset.children.network.site_id		keyword
claroty_ctd.asset.children.network_id		keyword
claroty_ctd.asset.children.os.architecture		keyword
claroty_ctd.asset.children.os.build		keyword
claroty_ctd.asset.children.os.revision		keyword
claroty_ctd.asset.children.os.service_pack		keyword
claroty_ctd.asset.children.parsed		boolean
claroty_ctd.asset.children.project_parsed.builder_hostname		keyword
claroty_ctd.asset.children.project_parsed.creation_time		long
claroty_ctd.asset.children.project_parsed.creation_ver		keyword
claroty_ctd.asset.children.project_parsed.description		keyword
claroty_ctd.asset.children.project_parsed.information_type		long
claroty_ctd.asset.children.project_parsed.modification_time		long
claroty_ctd.asset.children.project_parsed.modification_ver		keyword
claroty_ctd.asset.children.project_parsed.name		keyword
claroty_ctd.asset.children.project_parsed.priority		long
claroty_ctd.asset.children.project_parsed.project_ver		keyword
claroty_ctd.asset.children.resource_id		keyword
claroty_ctd.asset.children.risk_level		long
claroty_ctd.asset.children.serial_number		keyword
claroty_ctd.asset.children.site_id		keyword
claroty_ctd.asset.children.site_name		keyword
claroty_ctd.asset.children.special_hints.name		keyword
claroty_ctd.asset.children.special_hints.value		long
claroty_ctd.asset.children.state		keyword
claroty_ctd.asset.children.subnet.name		keyword
claroty_ctd.asset.children.subnet_id		keyword
claroty_ctd.asset.children.subnet_type		long
claroty_ctd.asset.children.timestamp		date
claroty_ctd.asset.children.vendor		keyword
claroty_ctd.asset.children.virtual_zone.id		keyword
claroty_ctd.asset.children.virtual_zone.name		keyword
claroty_ctd.asset.class_type		keyword
claroty_ctd.asset.code_sections.filename		keyword
claroty_ctd.asset.code_sections.rid		keyword
claroty_ctd.asset.code_sections.type		keyword
claroty_ctd.asset.criticalities.name		keyword
claroty_ctd.asset.criticalities.value		long
claroty_ctd.asset.custom_attributes.asset_id		keyword
claroty_ctd.asset.custom_attributes.category.description		keyword
claroty_ctd.asset.custom_attributes.category.id		keyword
claroty_ctd.asset.custom_attributes.category.name		keyword
claroty_ctd.asset.custom_attributes.category.resource_id		keyword
claroty_ctd.asset.custom_attributes.category.site_id		keyword
claroty_ctd.asset.custom_attributes.id		keyword
claroty_ctd.asset.custom_attributes.resource_id		keyword
claroty_ctd.asset.custom_attributes.site_id		keyword
claroty_ctd.asset.custom_attributes.value		keyword
claroty_ctd.asset.custom_informations.category		long
claroty_ctd.asset.custom_informations.display_key		keyword
claroty_ctd.asset.custom_informations.key		keyword
claroty_ctd.asset.custom_informations.priority		long
claroty_ctd.asset.custom_informations.type		long
claroty_ctd.asset.custom_informations.val		keyword
claroty_ctd.asset.default_gateway		keyword
claroty_ctd.asset.display_name		keyword
claroty_ctd.asset.domain_workgroup		keyword
claroty_ctd.asset.edge_id		keyword
claroty_ctd.asset.edge_last_run		keyword
claroty_ctd.asset.firmware		keyword
claroty_ctd.asset.first_seen		date
claroty_ctd.asset.ghost		boolean
claroty_ctd.asset.hostname		keyword
claroty_ctd.asset.id		keyword
claroty_ctd.asset.insight_names		keyword
claroty_ctd.asset.installed_antivirus		keyword
claroty_ctd.asset.installed_programs_count		long
claroty_ctd.asset.ipv4		ip
claroty_ctd.asset.last_entity_seen		date
claroty_ctd.asset.last_seen		date
claroty_ctd.asset.last_updated		date
claroty_ctd.asset.mac		keyword
claroty_ctd.asset.model		keyword
claroty_ctd.asset.name		keyword
claroty_ctd.asset.network.id		keyword
claroty_ctd.asset.network.name		keyword
claroty_ctd.asset.network.resource_id		keyword
claroty_ctd.asset.network.site_id		keyword
claroty_ctd.asset.network_id		keyword
claroty_ctd.asset.num_alerts		long
claroty_ctd.asset.os.architecture		keyword
claroty_ctd.asset.os.build		keyword
claroty_ctd.asset.os.revision		keyword
claroty_ctd.asset.os.service_pack		keyword
claroty_ctd.asset.parsed		boolean
claroty_ctd.asset.patch_count		long
claroty_ctd.asset.plc_slots.plcslotinformations.description		keyword
claroty_ctd.asset.plc_slots.plcslotinformations.information_type		long
claroty_ctd.asset.plc_slots.plcslotinformations.priority		long
claroty_ctd.asset.plc_slots.plcslotinformations.slot		long
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.address		keyword
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.description		keyword
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.firmware_version		keyword
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.information_type		long
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.name		keyword
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.order_number		keyword
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.priority		long
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.product		keyword
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.serial_number		keyword
claroty_ctd.asset.plc_slots.plcslotinformations.value.plcinformation.vendor		keyword
claroty_ctd.asset.project_parsed.builder_hostname		keyword
claroty_ctd.asset.project_parsed.creation_time		long
claroty_ctd.asset.project_parsed.creation_ver		keyword
claroty_ctd.asset.project_parsed.description		keyword
claroty_ctd.asset.project_parsed.information_type		long
claroty_ctd.asset.project_parsed.modification_time		long
claroty_ctd.asset.project_parsed.modification_ver		keyword
claroty_ctd.asset.project_parsed.name		keyword
claroty_ctd.asset.project_parsed.priority		long
claroty_ctd.asset.project_parsed.project_ver		keyword
claroty_ctd.asset.protocol		keyword
claroty_ctd.asset.purdue_level		double
claroty_ctd.asset.resource_id		keyword
claroty_ctd.asset.risk_level		long
claroty_ctd.asset.serial_number		keyword
claroty_ctd.asset.site_id		keyword
claroty_ctd.asset.site_name		keyword
claroty_ctd.asset.special_hints.name		keyword
claroty_ctd.asset.special_hints.value		long
claroty_ctd.asset.state		keyword
claroty_ctd.asset.subnet_id		keyword
claroty_ctd.asset.timestamp		date
claroty_ctd.asset.usb_devices_count		long
claroty_ctd.asset.valid		boolean
claroty_ctd.asset.vendor		keyword
claroty_ctd.asset.virtual_zone.id		keyword
claroty_ctd.asset.virtual_zone.name		keyword
claroty_ctd.asset.vlan		keyword
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset.	constant_keyword
event.module	Event module.	constant_keyword
input.type	Type of filebeat input.	keyword
log.offset	Log offset.	long
tags	User defined tags.	keyword

Baseline

edit

This is the baseline dataset.

Example

An example event for baseline looks as following:

{
    "@timestamp": "2024-07-09T12:03:12.000Z",
    "agent": {
        "ephemeral_id": "b90e99a6-b998-47ad-9883-8bb06ad3be20",
        "id": "7090d98c-c949-469c-9209-a0de3adaaa65",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.14.0"
    },
    "claroty_ctd": {
        "baseline": {
            "approved": true,
            "category": 3,
            "category_access": 1,
            "description": "CIP : Read attribute 'Minor Events Reported' of object FaultLog",
            "destination": {
                "asset_id": "51",
                "entity": {
                    "asset_name": "Chemical_plant",
                    "id": "2",
                    "ipv4": "1.128.0.0",
                    "mac": "00:00:BC:C7:8F:06",
                    "resource_id": "2-1",
                    "virtual_zone_id": "3",
                    "virtual_zone_name": "PLC: Rockwell"
                }
            },
            "frequency": 0,
            "has_values": false,
            "hash": "513826395598251000",
            "id": "1",
            "last_seen": "2023-04-17T07:30:09.000Z",
            "last_updated": "2024-07-09T12:03:12.000Z",
            "protocol": "CIP",
            "resource_id": "1-1",
            "session_state": 3,
            "site_id": "1",
            "source": {
                "asset_id": "1",
                "entity": {
                    "id": "1",
                    "ipv4": "1.128.0.0",
                    "resource_id": "1-1",
                    "virtual_zone": {
                        "id": "2",
                        "name": "HMI: Rockwell"
                    }
                }
            },
            "time": "2023-04-17T07:30:09.000Z",
            "type": 0,
            "valid": true
        }
    },
    "data_stream": {
        "dataset": "claroty_ctd.baseline",
        "namespace": "38694",
        "type": "logs"
    },
    "destination": {
        "ip": [
            "1.128.0.0"
        ],
        "mac": "00-00-BC-C7-8F-06"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "7090d98c-c949-469c-9209-a0de3adaaa65",
        "snapshot": false,
        "version": "8.14.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "network"
        ],
        "dataset": "claroty_ctd.baseline",
        "hash": "513826395598251000",
        "id": "1",
        "ingested": "2024-09-05T09:58:36Z",
        "kind": "event",
        "original": "{\"approved\":true,\"category\":3,\"category_access\":1,\"description\":\"CIP : Read attribute 'Minor Events Reported' of object FaultLog\",\"destination_asset_id\":51,\"destination_entity\":{\"asset_name\":\"Chemical_plant\",\"id\":2,\"ipv4\":\"1.128.0.0\",\"mac\":\"00:00:BC:C7:8F:06\",\"resource_id\":\"2-1\",\"virtual_zone_id\":3,\"virtual_zone_name\":\"PLC: Rockwell\"},\"dst_port\":null,\"frequency\":0,\"has_values\":false,\"hash\":513826395598251000,\"id\":1,\"interval\":null,\"last_seen\":\"2023-04-17T07:30:09+00:00\",\"last_updated\":\"2024-07-09T12:03:12+00:00\",\"protocol\":\"CIP\",\"resource_id\":\"1-1\",\"session_state\":3,\"site_id\":1,\"source_asset_id\":1,\"source_entity\":{\"asset_name\":\"1.128.0.0\",\"id\":1,\"ipv4\":\"1.128.0.0\",\"resource_id\":\"1-1\",\"virtual_zone_id\":2,\"virtual_zone_name\":\"HMI: Rockwell\"},\"src_port\":null,\"timestamp\":\"2023-04-17T07:30:09+00:00\",\"transmission\":null,\"type\":0,\"valid\":true}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "message": "CIP : Read attribute 'Minor Events Reported' of object FaultLog",
    "network": {
        "protocol": "cip"
    },
    "related": {
        "hash": [
            "513826395598251000"
        ],
        "ip": [
            "1.128.0.0"
        ]
    },
    "source": {
        "ip": [
            "1.128.0.0"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "claroty_ctd-baseline"
    ]
}

Exported fields

Field	Description	Type
@timestamp	Event timestamp.	date
claroty_ctd.baseline.approved		boolean
claroty_ctd.baseline.category		long
claroty_ctd.baseline.category_access		long
claroty_ctd.baseline.description		keyword
claroty_ctd.baseline.destination.asset_id		keyword
claroty_ctd.baseline.destination.entity.asset_name		keyword
claroty_ctd.baseline.destination.entity.id		keyword
claroty_ctd.baseline.destination.entity.ipv4		ip
claroty_ctd.baseline.destination.entity.mac		keyword
claroty_ctd.baseline.destination.entity.resource_id		keyword
claroty_ctd.baseline.destination.entity.virtual_zone_id		keyword
claroty_ctd.baseline.destination.entity.virtual_zone_name		keyword
claroty_ctd.baseline.destination.port		long
claroty_ctd.baseline.frequency		long
claroty_ctd.baseline.has_values		boolean
claroty_ctd.baseline.hash		keyword
claroty_ctd.baseline.id		keyword
claroty_ctd.baseline.interval		long
claroty_ctd.baseline.last_seen		date
claroty_ctd.baseline.last_updated		date
claroty_ctd.baseline.protocol		keyword
claroty_ctd.baseline.resource_id		keyword
claroty_ctd.baseline.session_state		long
claroty_ctd.baseline.site_id		keyword
claroty_ctd.baseline.source.asset_id		keyword
claroty_ctd.baseline.source.entity.asset_name		keyword
claroty_ctd.baseline.source.entity.id		keyword
claroty_ctd.baseline.source.entity.ipv4		ip
claroty_ctd.baseline.source.entity.mac		keyword
claroty_ctd.baseline.source.entity.resource_id		keyword
claroty_ctd.baseline.source.entity.virtual_zone.id		keyword
claroty_ctd.baseline.source.entity.virtual_zone.name		keyword
claroty_ctd.baseline.source.port		long
claroty_ctd.baseline.time		date
claroty_ctd.baseline.transmission		keyword
claroty_ctd.baseline.type		long
claroty_ctd.baseline.valid		boolean
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
event.dataset	Event dataset.	constant_keyword
event.module	Event module.	constant_keyword
input.type	Type of filebeat input.	keyword
log.offset	Log offset.	long
tags	User defined tags.	keyword

Changelog

edit

Changelog

Version	Details	Kibana version(s)
0.4.0	Enhancement (View pull request) Add "preserve_original_event" tag to documents with `event.kind` manually set to "pipeline_error".	—
0.3.0	Enhancement (View pull request) Add "preserve_original_event" tag to documents with `event.kind` set to "pipeline_error".	—
0.2.0	Enhancement (View pull request) Added double new lines between the navigation links on the dashboard.	—
0.1.2	Bug fix (View pull request) Fixed batch size issue in data collection for asset and baseline data-streams.	—
0.1.1	Bug fix (View pull request) Ensure empty replacement is included in configuration.	—
0.1.0	Enhancement (View pull request) Initial release.	—

« Citrix Web App Firewall Cloudflare »