CrowdStrike Integration
editCrowdStrike Integration
editVersion |
1.49.0 (View all) |
Compatible Kibana version(s) |
8.16.0 or higher |
Supported Serverless project types |
Security |
Subscription level |
Basic |
Level of support |
Elastic |
The CrowdStrike integration allows you to easily connect your CrowdStrike Falcon platform to Elastic for seamless onboarding of alerts and telemetry from CrowdStrike Falcon and Falcon Data Replicator. Elastic Security can leverage this data for security analytics including correlation, visualization and incident response. It provides support using four different modes for integrating CrowdStrike to the Elastic:
-
Falcon SIEM Connector: This is a pre-built integration designed to connect CrowdStrike Falcon with Security Information and Event Management (SIEM) systems. It streamlines the flow of security data from CrowdStrike Falcon to the SIEM, providing a standardized and structured way of feeding information into the SIEM platform. It includes the following datasets for receiving logs:
-
falcondataset: consists of endpoint data and Falcon platform audit data forwarded from Falcon SIEM Connector.
-
-
CrowdStrike REST API: This provides a programmatic interface to interact with the CrowdStrike Falcon platform. It allows users to perform various operations such as querying information about unified alerts and hosts/devices. It includes the following datasets for receiving logs:
-
alertdataset: It is typically used to retrieve detailed information about unified alerts generated by the CrowdStrike Falcon platform, via Falcon Intelligence Alert API -/alerts/entities/alerts/v2. -
hostdataset: It retrieves all the hosts/devices in your environment providing information such as device metadata, configuration, and status generated by the CrowdStrike Falcon platform, via Falcon Intelligence Host/Device API -/devices/entities/devices/v2. It is more focused to provide the management and monitoring information of devices such as login details, status, policies, configuration etc.
-
-
Falcon Data Replicator: This Collect events in near real time from your endpoints and cloud workloads, identities and data. CrowdStrike Falcon Data Replicator (FDR) enables you with actionable insights to improve SOC performance. FDR contains near real-time data collected by the Falcon platform’s single, lightweight agent. It includes the following datasets for receiving logs:
-
fdrdataset: consists of logs forwarded using the Falcon Data Replicator.
-
-
CrowdStrike Event Stream: This streams security logs from CrowdStrike Event Stream, including authentication activity, cloud security posture management (CSPM), firewall logs, user activity, and XDR data. It captures real-time security events like user logins, cloud environment changes, network traffic, and advanced threat detections. The streaming integration provides continuous monitoring and analysis for proactive threat detection. It enhances visibility into user behavior, network security, and overall system health. This setup enables faster response capabilities to emerging security incidents. It includes the following datasets for receiving logs:
-
falcondataset: consists of streaming data forwarded from CrowdStrike Event Stream.
-
Compatibility
editThis integration is compatible with CrowdStrike Falcon SIEM-Connector-v2.0, REST API, and CrowdStrike Event Streaming. For Rest API support, this module has been tested against the CrowdStrike API Version v1/v2.
Setup
editTo collect data from CrowdStrike REST API, the following parameters from your CrowdStrike instance are required:
edit- Client ID
- Client Secret
- Token url
- API Endpoint url
-
Required scopes for each data stream :
Data Stream Scope Alert
read:alert
Host
read:host
To collect data from CrowdStrike Event Stream, the following parameters from your CrowdStrike instance are required:
edit- Client ID
- Client Secret
- Token URL
- API Endpoint URL
- CrowdStrike App ID
-
Required scopes for event stream:
Data Stream Scope Event Stream
read: Event streams
Logs
editAlert
editThis is the Alert dataset.
Example
An example event for alert looks as following:
{
"@timestamp": "2023-11-03T18:00:22.328Z",
"agent": {
"ephemeral_id": "27ef9ebb-d201-4dce-a6fe-40de865e8c36",
"id": "03b4d78a-97e1-4c91-9b6f-c97feae33280",
"name": "elastic-agent-14353",
"type": "filebeat",
"version": "8.13.0"
},
"crowdstrike": {
"alert": {
"agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b",
"aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778",
"alleged_filetype": "exe",
"cid": "92012896127c4a948236ba7601b886b0",
"cloud_indicator": false,
"cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"",
"composite_id": "92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600",
"confidence": 10,
"context_timestamp": "2023-11-03T18:00:31.000Z",
"control_graph_id": "ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778",
"crawl_edge_ids": {
"Sensor": [
"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2J<d2T/ji6R&RIHe-tZSkP*q?HW;:leq.:kk)>IVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N",
"KZcZA__;?\"cmott@m_k)MSZ^+C?.cg<Lga#0@71X07*LY2teE56*16pL[=!bjF7g@0jOQE'jT6RX_F@sr#RP-U/d[#nm9A,A,W%cl/T@<W`alY1K_h%QDBBF;_e7S!!*'!",
"KZd)iK2;s\\ckQl_P*d=Mo?^a7/JKc\\\*L48169!7I5;0\\\<H^hNG\"ZQ3#U3\"eo<>92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';e<OHh9AmlT?5<gGqK:*L99kat+P)eZ$HR\"Ql@Q!!!$!rr",
"N6=Ks_B9Bncmur)?\\\[fV$k/N5;:6@aB$P;R$2XAaPJ?E<G5,UfaP')8#2AY4ff+q?T?b0/RBi-YAeGmb<6Bqp[DZh#I(jObGkjJJaMf\\:#mb;BM\\L[g!\\F*M!!*'!",
"N6B%O`'=_7d#%u&d[+LTNDs<3307?8n=GrFI:4YYGCL,cIt-Tuj!&<6:3RbC`uNjL#gW&=)E`4^/'fp*.bFX@p_$,R6.\"=lV*T*5Vf`c.:nkd$+YD:DJ,Ls0[sArC')K%YTc$:@kUQW5s8N",
"N6B%s!\\k)ed$F6>a%iM\"<FTSe/eH8M:<9gf;$$.b??kpC*99aX!Lq:g6:Q3@Ga4Zrb@MaMa]L'YAt$IFBu])\"H^sF$r7gDPf6&CHpVKO3<DgK9,Y/e@V\"b&m!<<'",
"N6CU&`%VT\"d$=67=h\\I)/BJH:8-lS!.%\\-!$1@bAhtVO?q4]9'9'haE4N0*-0Uh'-'f',YW3]T=jL3D#N=fJi]Pp-bWej+R9q[%h[p]p26NK8q3b50k9G:.&eM<Qer>__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!",
"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr",
"N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'",
"N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_<r/JG0TCEQ!Ug(be3)&R2JnX+RSqorgC-NCjf6XATBWX(5<L1J1DV>44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"
]
},
"crawl_vertex_ids": {
"Sensor": [
"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778",
"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778",
"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600",
"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4",
"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd",
"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33",
"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135",
"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876",
"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993",
"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd",
"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"
]
},
"crawled_timestamp": "2023-11-03T19:00:23.985Z",
"created_timestamp": "2023-11-03T18:01:23.995Z",
"data_domains": [
"Endpoint"
],
"description": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.",
"device": {
"agent_load_flags": 0,
"agent_local_time": "2023-10-12T03:45:57.753Z",
"agent_version": "7.04.17605.0",
"bios_manufacturer": "ABC",
"bios_version": "F8CN42WW(V2.05)",
"cid": "92012896127c4a948236ba7601b886b0",
"config_id_base": "65994763",
"config_id_build": "17605",
"config_id_platform": 3,
"external_ip": "81.2.69.142",
"first_seen": "2023-04-07T09:36:36.000Z",
"groups": [
"18704e21288243b58e4c76266d38caaf"
],
"hostinfo": {
"active_directory_dn_display": [
"WinComputers",
"WinComputers\\ABC"
],
"domain": "ABC.LOCAL"
},
"hostname": "ABC709-1175",
"id": "2ce412d17b334ad4adc8c1c54dbfec4b",
"last_seen": "2023-11-03T17:51:42.000Z",
"local_ip": "81.2.69.142",
"mac_address": "AB-21-48-61-05-B2",
"machine_domain": "ABC.LOCAL",
"major_version": "10",
"minor_version": "0",
"modified_timestamp": "2023-11-03T17:53:43.000Z",
"os_version": "Windows11",
"ou": [
"ABC",
"WinComputers"
],
"platform_id": "0",
"platform_name": "Windows",
"product_type": "1",
"product_type_desc": "Workstation",
"site_name": "Default-First-Site-Name",
"status": "normal",
"system_manufacturer": "LENOVO",
"system_product_name": "20VE"
},
"falcon_host_link": "https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600",
"filename": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe",
"filepath": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe",
"grandparent_details": {
"cmdline": "C:\\Windows\\system32\\userinit.exe",
"filename": "userinit.exe",
"filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe",
"local_process_id": "4328",
"md5": "b07f77fd3f9828b2c9d61f8a36609741",
"process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135",
"process_id": "392734873135",
"sha256": "caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33",
"timestamp": "2023-10-30T16:49:19.000Z",
"user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425",
"user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425",
"user_name": "yuvraj.mahajan"
},
"has_script_or_module_ioc": true,
"id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600",
"indicator_id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600",
"ioc_context": [
{
"ioc_description": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe",
"ioc_source": "library_load",
"ioc_type": "hash_sha256",
"ioc_value": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd",
"md5": "cdf9cfebb400ce89d5b6032bfcdc693b",
"sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd",
"type": "module"
}
],
"ioc_values": [
"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd"
],
"is_synthetic_quarantine_disposition": true,
"local_process_id": "17076",
"logon_domain": "ABSYS",
"md5": "cdf9cfebb400ce89d5b6032bfcdc693b",
"name": "PrewittPupAdwareSensorDetect-Lowest",
"objective": "FalconDetectionMethod",
"parent_details": {
"cmdline": "C:\\WINDOWS\\Explorer.EXE",
"filename": "explorer.exe",
"filepath": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe",
"local_process_id": "1040",
"md5": "8cc3fcdd7d52d2d5221303c213e044ae",
"process_graph_id": "pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876",
"process_id": "392736520876",
"sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4",
"timestamp": "2023-11-03T18:00:32.000Z",
"user_graph_id": "uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425",
"user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425",
"user_name": "mohit.jha"
},
"parent_process_id": "392736520876",
"pattern_disposition": 2176,
"pattern_disposition_description": "Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.",
"pattern_disposition_details": {
"blocking_unsupported_or_disabled": false,
"bootup_safeguard_enabled": false,
"critical_process_disabled": false,
"detect": false,
"fs_operation_blocked": false,
"handle_operation_downgraded": false,
"inddet_mask": false,
"indicator": false,
"kill_action_failed": false,
"kill_parent": false,
"kill_process": false,
"kill_subprocess": false,
"operation_blocked": false,
"policy_disabled": false,
"process_blocked": true,
"quarantine_file": true,
"quarantine_machine": false,
"registry_operation_blocked": false,
"rooting": false,
"sensor_only": false,
"suspend_parent": false,
"suspend_process": false
},
"pattern_id": "5761",
"platform": "Windows",
"poly_id": "AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==",
"process_end_time": "2023-11-03T18:00:21.000Z",
"process_id": "399748687993",
"process_start_time": "2023-11-03T18:00:13.000Z",
"product": "epp",
"quarantined_files": [
{
"filename": "\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe",
"id": "2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd",
"sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd",
"state": "quarantined"
}
],
"scenario": "NGAV",
"severity": 30,
"sha1": "0000000000000000000000000000000000000000",
"sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd",
"show_in_ui": true,
"source_products": [
"FalconInsight"
],
"source_vendors": [
"CrowdStrike"
],
"status": "new",
"tactic": "MachineLearning",
"tactic_id": "CSTA0004",
"technique": "Adware/PUP",
"technique_id": "CST0000",
"timestamp": "2023-11-03T18:00:22.328Z",
"tree_id": "1931778",
"tree_root": "38687993",
"triggering_process_graph_id": "pid:2ce4124ad4adc8c1c54dbfec4b:399748687993",
"type": "ldt",
"updated_timestamp": "2023-11-03T19:00:23.985Z",
"user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425",
"user_name": "mohit.jha"
}
},
"data_stream": {
"dataset": "crowdstrike.alert",
"namespace": "94431",
"type": "logs"
},
"device": {
"id": "2ce412d17b334ad4adc8c1c54dbfec4b",
"manufacturer": "LENOVO",
"model": {
"name": "20VE"
}
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "03b4d78a-97e1-4c91-9b6f-c97feae33280",
"snapshot": false,
"version": "8.13.0"
},
"event": {
"agent_id_status": "verified",
"dataset": "crowdstrike.alert",
"id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600",
"ingested": "2024-10-01T00:09:14Z",
"kind": "alert",
"original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\\Users\\\\\yuvraj.mahajan\\\\\AppData\\\\\Local\\\\\Temp\\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\\pfSenseFirewallOpenVPNClients\\\\\Windows\\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K\\u0026cmqQ]Z=W,QK4W.9(rBfs\\\\\gfmjTblqI^F-_oNnAWQ\\u0026-o0:dR/\\u003e\\u003e2J\\u003cd2T/ji6R\\u0026RIHe-tZSkP*q?HW;:leq.:kk)\\u003eIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`\\u003eZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg\\u003cLga#0@71X07*LY2teE56*16pL[=!bjF7g@0jOQE'jT6RX_F@sr#RP-U/d[#nm9A,A,W%cl/T@\\u003cW`alY1K_h%QDBBF;_e7S!!*'!\",\"KZd)iK2;s\\\\\ckQl_P*d=Mo?^a7/JKc\\\\\*L48169!7I5;0\\\\\\\u003cH^hNG\\\"ZQ3#U3\\\"eo\\u003c\\u003e92t[f!\\u003e*b9WLY@H!V0N,BJsNSTD:?/+fY';e\\u003cOHh9AmlT?5\\u003cgGqK:*L99kat+P)eZ$HR\\\"Ql@Q!!!$!rr\",\"N6=Ks_B9Bncmur)?\\\\\[fV$k/N5;:6@aB$P;R$2XAaPJ?E\\u003cG5,UfaP')8#2AY4ff+q?T?b0/RBi-YAeGmb\\u003c6Bqp[DZh#I(jObGkjJJaMf\\\\\:#mb;BM\\\\\L[g!\\\\\F*M!!*'!\",\"N6B%O`'=_7d#%u\\u0026d[+LTNDs\\u003c3307?8n=GrFI:4YYGCL,cIt-Tuj!\\u0026\\u003c6:3RbC`uNjL#gW\\u0026=)E`4^/'fp*.bFX@p_$,R6.\\\"=lV*T*5Vf`c.:nkd$+YD:DJ,Ls0[sArC')K%YTc$:@kUQW5s8N\",\"N6B%s!\\\\\k)ed$F6\\u003ea%iM\\\"\\u003cFTSe/eH8M:\\u003c9gf;$$.b??kpC*99aX!Lq:g6:Q3@Ga4Zrb@MaMa]L'YAt$IFBu])\\\"H^sF$r7gDPf6\\u0026CHpVKO3\\u003cDgK9,Y/e@V\\\"b\\u0026m!\\u003c\\u003c'\",\"N6CU\\u0026`%VT\\\"d$=67=h\\\\\I)/BJH:8-lS!.%\\\\\-!$1@bAhtVO?q4]9'9'haE4N0*-0Uh'-'f',YW3]T=jL3D#N=fJi]Pp-bWej+R9q[%h[p]p26NK8q3b50k9G:.\\u0026eM\\u003cQer\\u003e__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A\\u0026FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\\\\u0026\\u0026V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\\AtNML2_C__7ic6,8Dc[F\\u003c0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##\\u0026$^81(P+hN*-#rf/cUs)Wb\\\"\\u003c_/?I'[##WMh'H[Rcl+!!\\u003c\\u003c'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=\\u003e#DM0j$_\\u003cr/JG0TCEQ!Ug(be3)\\u0026R2JnX+RSqorgC-NCjf6XATBWX(5\\u003cL1J1DV\\u003e44ZjO9q*d!YLuHhkq!3\\u003e3tpi\\u003eOPYZp9]5f1#/AlRZL06`/I6cl\\\"d.\\u0026=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\\Device\\\\\HarddiskVolume3\\\\\Users\\\\\yuvraj.mahajan\\\\\AppData\\\\\Local\\\\\Temp\\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\\pfSenseFirewallOpenVPNClients\\\\\Windows\\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\\Windows\\\\\system32\\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\\Device\\\\\HarddiskVolume3\\\\\Windows\\\\\System32\\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\\Device\\\\\HarddiskVolume3\\\\\Users\\\\\yuvraj.mahajan\\\\\AppData\\\\\Local\\\\\Temp\\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\\pfSenseFirewallOpenVPNClients\\\\\Windows\\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"parent_details\":{\"cmdline\":\"C:\\\\\WINDOWS\\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\\Device\\\\\HarddiskVolume3\\\\\Windows\\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\\Device\\\\\Volume3\\\\\Users\\\\\yuvraj.mahajan\\\\\AppData\\\\\Local\\\\\Temp\\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\\pfSenseFirewallOpenVPNClients\\\\\Windows\\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}",
"severity": 30
},
"file": {
"name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe",
"path": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe"
},
"host": {
"domain": "ABC.LOCAL",
"hostname": "ABC709-1175",
"ip": [
"81.2.69.142"
],
"mac": [
"AB-21-48-61-05-B2"
],
"os": {
"full": "Windows11",
"platform": "Windows",
"type": "windows"
}
},
"input": {
"type": "cel"
},
"message": "ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.",
"process": {
"end": "2023-11-03T18:00:21.000Z",
"executable": "\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe",
"hash": {
"md5": "cdf9cfebb400ce89d5b6032bfcdc693b",
"sha1": "0000000000000000000000000000000000000000",
"sha256": "b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd"
},
"name": "openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe",
"parent": {
"command_line": "C:\\WINDOWS\\Explorer.EXE",
"executable": "\\Device\\HarddiskVolume3\\Windows\\explorer.exe",
"hash": {
"md5": "8cc3fcdd7d52d2d5221303c213e044ae",
"sha256": "0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4"
},
"name": "explorer.exe",
"pid": 392736520876
},
"pid": 399748687993,
"start": "2023-11-03T18:00:13.000Z",
"user": {
"id": "S-1-5-21-1909377054-3469629671-4104191496-4425",
"name": "mohit.jha"
}
},
"related": {
"hash": [
"ABC709-1175",
"b07f77fd3f9828b2c9d61f8a36609741",
"cdf9cfebb400ce89d5b6032bfcdc693b",
"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd",
"8cc3fcdd7d52d2d5221303c213e044ae",
"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4",
"0000000000000000000000000000000000000000"
],
"hosts": [
"ABC.LOCAL"
],
"ip": [
"81.2.69.142"
],
"user": [
"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425",
"S-1-5-21-1909377054-3469629671-4104191496-4425",
"yuvraj.mahajan",
"mohit.jha"
]
},
"tags": [
"preserve_original_event",
"preserve_duplicate_custom_fields",
"forwarded",
"crowdstrike-alert"
],
"threat": {
"framework": "CrowdStrike Falcon Detections Framework",
"tactic": {
"id": [
"CSTA0004"
],
"name": [
"MachineLearning"
]
},
"technique": {
"id": [
"CST0000"
],
"name": [
"Adware/PUP"
]
}
},
"user": {
"id": "S-1-5-21-1909377054-3469629671-4104191496-4425",
"name": "mohit.jha"
}
}
Exported fields
| Field | Description | Type |
|---|---|---|
@timestamp |
Event timestamp. |
date |
crowdstrike.alert.active_directory_authentication_method |
long |
|
crowdstrike.alert.activity.browser |
keyword |
|
crowdstrike.alert.activity.device |
keyword |
|
crowdstrike.alert.activity.id |
keyword |
|
crowdstrike.alert.activity.os |
keyword |
|
crowdstrike.alert.agent_id |
keyword |
|
crowdstrike.alert.agent_scan_id |
keyword |
|
crowdstrike.alert.aggregate_id |
keyword |
|
crowdstrike.alert.alert_attributes |
long |
|
crowdstrike.alert.alleged_filetype |
keyword |
|
crowdstrike.alert.assigned_to.name |
keyword |
|
crowdstrike.alert.assigned_to.uid |
keyword |
|
crowdstrike.alert.assigned_to.uuid |
keyword |
|
crowdstrike.alert.associated_files.filepath |
keyword |
|
crowdstrike.alert.associated_files.sha256 |
keyword |
|
crowdstrike.alert.child_process_ids |
keyword |
|
crowdstrike.alert.cid |
keyword |
|
crowdstrike.alert.cloud_indicator |
boolean |
|
crowdstrike.alert.cmdline |
keyword |
|
crowdstrike.alert.command_line |
keyword |
|
crowdstrike.alert.comment |
keyword |
|
crowdstrike.alert.composite_id |
keyword |
|
crowdstrike.alert.confidence |
long |
|
crowdstrike.alert.context_timestamp |
date |
|
crowdstrike.alert.control_graph_id |
keyword |
|
crowdstrike.alert.crawl_edge_ids.Sensor |
keyword |
|
crowdstrike.alert.crawl_vertex_ids.Sensor |
keyword |
|
crowdstrike.alert.crawled_timestamp |
date |
|
crowdstrike.alert.created_timestamp |
date |
|
crowdstrike.alert.data_domains |
keyword |
|
crowdstrike.alert.description |
keyword |
|
crowdstrike.alert.detect_type |
keyword |
|
crowdstrike.alert.device.agent_load_flags |
long |
|
crowdstrike.alert.device.agent_local_time |
date |
|
crowdstrike.alert.device.agent_version |
keyword |
|
crowdstrike.alert.device.bios_manufacturer |
keyword |
|
crowdstrike.alert.device.bios_version |
keyword |
|
crowdstrike.alert.device.cid |
keyword |
|
crowdstrike.alert.device.config_id_base |
keyword |
|
crowdstrike.alert.device.config_id_build |
keyword |
|
crowdstrike.alert.device.config_id_platform |
long |
|
crowdstrike.alert.device.external_ip |
ip |
|
crowdstrike.alert.device.first_seen |
date |
|
crowdstrike.alert.device.groups |
keyword |
|
crowdstrike.alert.device.hostinfo.active_directory_dn_display |
keyword |
|
crowdstrike.alert.device.hostinfo.domain |
keyword |
|
crowdstrike.alert.device.hostname |
keyword |
|
crowdstrike.alert.device.id |
keyword |
|
crowdstrike.alert.device.last_seen |
date |
|
crowdstrike.alert.device.local_ip |
ip |
|
crowdstrike.alert.device.mac_address |
keyword |
|
crowdstrike.alert.device.machine_domain |
keyword |
|
crowdstrike.alert.device.major_version |
keyword |
|
crowdstrike.alert.device.minor_version |
keyword |
|
crowdstrike.alert.device.modified_timestamp |
date |
|
crowdstrike.alert.device.os_version |
keyword |
|
crowdstrike.alert.device.ou |
keyword |
|
crowdstrike.alert.device.platform_id |
keyword |
|
crowdstrike.alert.device.platform_name |
keyword |
|
crowdstrike.alert.device.pod_labels |
keyword |
|
crowdstrike.alert.device.product_type |
keyword |
|
crowdstrike.alert.device.product_type_desc |
keyword |
|
crowdstrike.alert.device.site_name |
keyword |
|
crowdstrike.alert.device.status |
keyword |
|
crowdstrike.alert.device.system_manufacturer |
keyword |
|
crowdstrike.alert.device.system_product_name |
keyword |
|
crowdstrike.alert.device.tags |
keyword |
|
crowdstrike.alert.display_name |
keyword |
|
crowdstrike.alert.documents_accessed.filename |
keyword |
|
crowdstrike.alert.documents_accessed.filepath |
keyword |
|
crowdstrike.alert.documents_accessed.timestamp |
date |
|
crowdstrike.alert.email_sent |
boolean |
|
crowdstrike.alert.end_time |
date |
|
crowdstrike.alert.event_id |
keyword |
|
crowdstrike.alert.executables_written.filename |
keyword |
|
crowdstrike.alert.executables_written.filepath |
keyword |
|
crowdstrike.alert.executables_written.timestamp |
date |
|
crowdstrike.alert.falcon_host_link |
keyword |
|
crowdstrike.alert.file_writes.name |
keyword |
|
crowdstrike.alert.file_writes.sha256 |
keyword |
|
crowdstrike.alert.filename |
keyword |
|
crowdstrike.alert.filepath |
keyword |
|
crowdstrike.alert.files_accessed.filename |
keyword |
|
crowdstrike.alert.files_accessed.filepath |
keyword |
|
crowdstrike.alert.files_accessed.timestamp |
date |
|
crowdstrike.alert.files_written.filename |
keyword |
|
crowdstrike.alert.files_written.filepath |
keyword |
|
crowdstrike.alert.files_written.timestamp |
date |
|
crowdstrike.alert.global_prevalence |
keyword |
|
crowdstrike.alert.grandparent_details.cmdline |
keyword |
|
crowdstrike.alert.grandparent_details.filename |
keyword |
|
crowdstrike.alert.grandparent_details.filepath |
keyword |
|
crowdstrike.alert.grandparent_details.local_process_id |
keyword |
|
crowdstrike.alert.grandparent_details.md5 |
keyword |
|
crowdstrike.alert.grandparent_details.process_graph_id |
keyword |
|
crowdstrike.alert.grandparent_details.process_id |
keyword |
|
crowdstrike.alert.grandparent_details.sha256 |
keyword |
|
crowdstrike.alert.grandparent_details.timestamp |
date |
|
crowdstrike.alert.grandparent_details.user_graph_id |
keyword |
|
crowdstrike.alert.grandparent_details.user_id |
keyword |
|
crowdstrike.alert.grandparent_details.user_name |
keyword |
|
crowdstrike.alert.has_script_or_module_ioc |
boolean |
|
crowdstrike.alert.host_name |
keyword |
|
crowdstrike.alert.host_type |
keyword |
|
crowdstrike.alert.id |
keyword |
|
crowdstrike.alert.idp_policy.enforced_externally |
long |
|
crowdstrike.alert.idp_policy.mfa_factor_type |
long |
|
crowdstrike.alert.idp_policy.mfa_provider |
long |
|
crowdstrike.alert.idp_policy.rule_action |
long |
|
crowdstrike.alert.idp_policy.rule_id |
keyword |
|
crowdstrike.alert.idp_policy.rule_name |
keyword |
|
crowdstrike.alert.idp_policy.rule_trigger |
long |
|
crowdstrike.alert.image_file_name |
keyword |
|
crowdstrike.alert.incident.created |
date |
|
crowdstrike.alert.incident.end |
date |
|
crowdstrike.alert.incident.id |
keyword |
|
crowdstrike.alert.incident.score |
double |
|
crowdstrike.alert.incident.start |
date |
|
crowdstrike.alert.indicator_id |
keyword |
|
crowdstrike.alert.ioc_context.cmdline |
keyword |
|
crowdstrike.alert.ioc_context.ioc_description |
keyword |
|
crowdstrike.alert.ioc_context.ioc_source |
keyword |
|
crowdstrike.alert.ioc_context.ioc_type |
keyword |
|
crowdstrike.alert.ioc_context.ioc_value |
keyword |
|
crowdstrike.alert.ioc_context.md5 |
keyword |
|
crowdstrike.alert.ioc_context.sha256 |
keyword |
|
crowdstrike.alert.ioc_context.type |
keyword |
|
crowdstrike.alert.ioc_description |
keyword |
|
crowdstrike.alert.ioc_source |
keyword |
|
crowdstrike.alert.ioc_type |
keyword |
|
crowdstrike.alert.ioc_value |
keyword |
|
crowdstrike.alert.ioc_values |
keyword |
|
crowdstrike.alert.is_synthetic_quarantine_disposition |
boolean |
|
crowdstrike.alert.ldap_search_query_attack |
long |
|
crowdstrike.alert.local_prevalence |
keyword |
|
crowdstrike.alert.local_process_id |
keyword |
|
crowdstrike.alert.location_country_code |
keyword |
|
crowdstrike.alert.location_latitude_as_int |
long |
|
crowdstrike.alert.location_longitude_as_int |
long |
|
crowdstrike.alert.logon_domain |
keyword |
|
crowdstrike.alert.md5 |
keyword |
|
crowdstrike.alert.model_anomaly_indicators |
keyword |
|
crowdstrike.alert.name |
keyword |
|
crowdstrike.alert.network_accesses.access_timestamp |
date |
|
crowdstrike.alert.network_accesses.access_type |
long |
|
crowdstrike.alert.network_accesses.connection_direction |
keyword |
|
crowdstrike.alert.network_accesses.isIPV6 |
boolean |
|
crowdstrike.alert.network_accesses.local_address |
ip |
|
crowdstrike.alert.network_accesses.local_port |
long |
|
crowdstrike.alert.network_accesses.protocol |
keyword |
|
crowdstrike.alert.network_accesses.remote_address |
ip |
|
crowdstrike.alert.network_accesses.remote_port |
long |
|
crowdstrike.alert.objective |
keyword |
|
crowdstrike.alert.operating_system |
keyword |
|
crowdstrike.alert.os_name |
keyword |
|
crowdstrike.alert.parent_details.cmdline |
keyword |
|
crowdstrike.alert.parent_details.filename |
keyword |
|
crowdstrike.alert.parent_details.filepath |
keyword |
|
crowdstrike.alert.parent_details.local_process_id |
keyword |
|
crowdstrike.alert.parent_details.md5 |
keyword |
|
crowdstrike.alert.parent_details.process_graph_id |
keyword |
|
crowdstrike.alert.parent_details.process_id |
keyword |
|
crowdstrike.alert.parent_details.sha256 |
keyword |
|
crowdstrike.alert.parent_details.timestamp |
date |
|
crowdstrike.alert.parent_details.user_graph_id |
keyword |
|
crowdstrike.alert.parent_details.user_id |
keyword |
|
crowdstrike.alert.parent_details.user_name |
keyword |
|
crowdstrike.alert.parent_process_id |
keyword |
|
crowdstrike.alert.pattern_disposition |
long |
|
crowdstrike.alert.pattern_disposition_description |
keyword |
|
crowdstrike.alert.pattern_disposition_details.blocking_unsupported_or_disabled |
boolean |
|
crowdstrike.alert.pattern_disposition_details.bootup_safeguard_enabled |
boolean |
|
crowdstrike.alert.pattern_disposition_details.containment_file_system |
boolean |
|
crowdstrike.alert.pattern_disposition_details.critical_process_disabled |
boolean |
|
crowdstrike.alert.pattern_disposition_details.detect |
boolean |
|
crowdstrike.alert.pattern_disposition_details.fs_operation_blocked |
boolean |
|
crowdstrike.alert.pattern_disposition_details.handle_operation_downgraded |
boolean |
|
crowdstrike.alert.pattern_disposition_details.inddet_mask |
boolean |
|
crowdstrike.alert.pattern_disposition_details.indicator |
boolean |
|
crowdstrike.alert.pattern_disposition_details.kill_action_failed |
boolean |
|
crowdstrike.alert.pattern_disposition_details.kill_parent |
boolean |
|
crowdstrike.alert.pattern_disposition_details.kill_process |
boolean |
|
crowdstrike.alert.pattern_disposition_details.kill_subprocess |
boolean |
|
crowdstrike.alert.pattern_disposition_details.mfa_required |
boolean |
|
crowdstrike.alert.pattern_disposition_details.operation_blocked |
boolean |
|
crowdstrike.alert.pattern_disposition_details.policy_disabled |
boolean |
|
crowdstrike.alert.pattern_disposition_details.prevention_provisioning_enabled |
boolean |
|
crowdstrike.alert.pattern_disposition_details.process_blocked |
boolean |
|
crowdstrike.alert.pattern_disposition_details.quarantine_file |
boolean |
|
crowdstrike.alert.pattern_disposition_details.quarantine_machine |
boolean |
|
crowdstrike.alert.pattern_disposition_details.registry_operation_blocked |
boolean |
|
crowdstrike.alert.pattern_disposition_details.response_action_already_applied |
boolean |
|
crowdstrike.alert.pattern_disposition_details.response_action_failed |
boolean |
|
crowdstrike.alert.pattern_disposition_details.response_action_triggered |
boolean |
|
crowdstrike.alert.pattern_disposition_details.rooting |
boolean |
|
crowdstrike.alert.pattern_disposition_details.sensor_only |
boolean |
|
crowdstrike.alert.pattern_disposition_details.suspend_parent |
boolean |
|
crowdstrike.alert.pattern_disposition_details.suspend_process |
boolean |
|
crowdstrike.alert.pattern_id |
keyword |
|
crowdstrike.alert.platform |
keyword |
|
crowdstrike.alert.poly_id |
keyword |
|
crowdstrike.alert.process_end_time |
date |
|
crowdstrike.alert.process_id |
keyword |
|
crowdstrike.alert.process_start_time |
date |
|
crowdstrike.alert.product |
keyword |
|
crowdstrike.alert.protocol_anomaly_classification |
long |
|
crowdstrike.alert.quarantined |
boolean |
|
crowdstrike.alert.quarantined_files.filename |
keyword |
|
crowdstrike.alert.quarantined_files.id |
keyword |
|
crowdstrike.alert.quarantined_files.sha256 |
keyword |
|
crowdstrike.alert.quarantined_files.state |
keyword |
|
crowdstrike.alert.scan_id |
keyword |
|
crowdstrike.alert.scenario |
keyword |
|
crowdstrike.alert.seconds_to_resolved |
long |
|
crowdstrike.alert.seconds_to_triaged |
long |
|
crowdstrike.alert.severity |
long |
|
crowdstrike.alert.severity_name |
keyword |
|
crowdstrike.alert.sha1 |
keyword |
|
crowdstrike.alert.sha256 |
keyword |
|
crowdstrike.alert.show_in_ui |
boolean |
|
crowdstrike.alert.source.account_azure_id |
keyword |
|
crowdstrike.alert.source.account_domain |
keyword |
|
crowdstrike.alert.source.account_name |
keyword |
|
crowdstrike.alert.source.account_object_guid |
keyword |
|
crowdstrike.alert.source.account_object_sid |
keyword |
|
crowdstrike.alert.source.account_sam_account_name |
keyword |
|
crowdstrike.alert.source.account_upn |
keyword |
|
crowdstrike.alert.source.endpoint_account_object_guid |
keyword |
|
crowdstrike.alert.source.endpoint_account_object_sid |
keyword |
|
crowdstrike.alert.source.endpoint_address_ip4 |
ip |
|
crowdstrike.alert.source.endpoint_host_name |
keyword |
|
crowdstrike.alert.source.endpoint_ip_address |
ip |
|
crowdstrike.alert.source.endpoint_ip_reputation |
long |
|
crowdstrike.alert.source.endpoint_sensor_id |
keyword |
|
crowdstrike.alert.source.ip_isp_classification |
long |
|
crowdstrike.alert.source.ip_isp_domain |
keyword |
|
crowdstrike.alert.source_products |
keyword |
|
crowdstrike.alert.source_vendors |
keyword |
|
crowdstrike.alert.start_time |
date |
|
crowdstrike.alert.status |
keyword |
|
crowdstrike.alert.tactic |
keyword |
|
crowdstrike.alert.tactic_id |
keyword |
|
crowdstrike.alert.tags |
keyword |
|
crowdstrike.alert.target.account_name |
keyword |
|
crowdstrike.alert.target.domain_controller_host_name |
keyword |
|
crowdstrike.alert.target.domain_controller_object_guid |
keyword |
|
crowdstrike.alert.target.domain_controller_object_sid |
keyword |
|
crowdstrike.alert.target.endpoint_account_object_guid |
keyword |
|
crowdstrike.alert.target.endpoint_account_object_sid |
keyword |
|
crowdstrike.alert.target.endpoint_host_name |
keyword |
|
crowdstrike.alert.target.endpoint_sensor_id |
keyword |
|
crowdstrike.alert.target.service_access_identifier |
keyword |
|
crowdstrike.alert.technique |
keyword |
|
crowdstrike.alert.technique_id |
keyword |
|
crowdstrike.alert.template_instance_id |
keyword |
|
crowdstrike.alert.timestamp |
date |
|
crowdstrike.alert.tree_id |
keyword |
|
crowdstrike.alert.tree_root |
keyword |
|
crowdstrike.alert.triggering_process_graph_id |
keyword |
|
crowdstrike.alert.type |
keyword |
|
crowdstrike.alert.updated_timestamp |
date |
|
crowdstrike.alert.user_id |
keyword |
|
crowdstrike.alert.user_name |
keyword |
|
crowdstrike.alert.user_principal |
keyword |
|
data_stream.dataset |
Data stream dataset. |
constant_keyword |
data_stream.namespace |
Data stream namespace. |
constant_keyword |
data_stream.type |
Data stream type. |
constant_keyword |
event.dataset |
Event dataset. |
constant_keyword |
event.module |
Event module. |
constant_keyword |
input.type |
Type of filebeat input. |
keyword |
log.offset |
Log offset. |
long |
tags |
List of keywords used to tag each event. |
keyword |
threat.framework |
Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. |
keyword |
threat.tactic.id |
The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) |
keyword |
threat.technique.id |
The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) |
keyword |
Falcon
editContains endpoint data and CrowdStrike Falcon platform audit data forwarded from Falcon SIEM Connector.
Falcon SIEM Connector configuration file
editBy default, the configuration file located at /opt/crowdstrike/etc/cs.falconhoseclient.cf provides configuration options related to the events collected by Falcon SIEM Connector.
Parts of the configuration file called EventTypeCollection and EventSubTypeCollection provides a list of event types that the connector should collect.
Current supported event types are:
- DetectionSummaryEvent
- IncidentSummaryEvent
- UserActivityAuditEvent
- AuthActivityAuditEvent
- FirewallMatchEvent
- RemoteResponseSessionStartEvent
- RemoteResponseSessionEndEvent
- CSPM Streaming events
- CSPM Search events
- IDP Incidents
- IDP Summary events
- Mobile Detection events
- Recon Notification events
- XDR Detection events
- Scheduled Report Notification events
Exported fields
| Field | Description | Type |
|---|---|---|
@timestamp |
Event timestamp. |
date |
agent.id |
Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. |
keyword |
agent.name |
Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. |
keyword |
agent.type |
Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. |
keyword |
agent.version |
Version of the agent. |
keyword |
cloud.image.id |
Image ID for the cloud instance. |
keyword |
crowdstrike.event.AccountCreationTimeStamp |
The timestamp of when the source account was created in Active Directory. |
date |
crowdstrike.event.AccountId |
keyword |
|
crowdstrike.event.ActivityId |
ID of the activity that triggered the detection. |
keyword |
crowdstrike.event.AddedPrivilege |
The difference between their current and previous list of privileges. |
keyword |
crowdstrike.event.AdditionalAccountObjectGuid |
Additional involved user object GUID. |
keyword |
crowdstrike.event.AdditionalAccountObjectSid |
Additional involved user object SID. |
keyword |
crowdstrike.event.AdditionalAccountUpn |
Additional involved user UPN. |
keyword |
crowdstrike.event.AdditionalActivityId |
ID of an additional activity related to the detection. |
keyword |
crowdstrike.event.AdditionalEndpointAccountObjectGuid |
Additional involved endpoint object GUID. |
keyword |
crowdstrike.event.AdditionalEndpointAccountObjectSid |
Additional involved endpoint object SID. |
keyword |
crowdstrike.event.AdditionalEndpointSensorId |
Additional involved endpoint agent ID. |
keyword |
crowdstrike.event.AdditionalLocationCountryCode |
Additional involved country code. |
keyword |
crowdstrike.event.AdditionalSsoApplicationIdentifier |
Additional application identifier. |
keyword |
crowdstrike.event.AgentIdString |
keyword |
|
crowdstrike.event.AnomalousTicketContentClassification |
Ticket signature analysis. |
keyword |
crowdstrike.event.AssociatedFile |
The file associated with the triggering indicator. |
keyword |
crowdstrike.event.Attributes |
JSON objects containing additional information about the event. |
flattened |
crowdstrike.event.AuditKeyValues |
Fields that were changed in this event. |
nested |
crowdstrike.event.AuditKeyValues.Key |
keyword |
|
crowdstrike.event.AuditKeyValues.ValueString |
keyword |
|
crowdstrike.event.Category |
IDP incident category. |
keyword |
crowdstrike.event.CertificateTemplateIdentifier |
The ID of the certificate template. |
keyword |
crowdstrike.event.CertificateTemplateName |
Name of the certificate template. |
keyword |
crowdstrike.event.Certificates |
Provides one or more JSON objects which includes related SSL/TLS Certificates. |
nested |
crowdstrike.event.CloudPlatform |
keyword |
|
crowdstrike.event.CloudProvider |
keyword |
|
crowdstrike.event.CloudService |
keyword |
|
crowdstrike.event.Commands |
Commands run in a remote session. |
keyword |
crowdstrike.event.ComputerName |
Name of the computer where the detection occurred. |
keyword |
crowdstrike.event.CustomerId |
Customer identifier. |
keyword |
crowdstrike.event.DataDomains |
Data domains of the event that was the primary indicator or created it. |
keyword |
crowdstrike.event.DetectId |
Unique ID associated with the detection. |
keyword |
crowdstrike.event.DetectName |
Name of the detection. |
keyword |
crowdstrike.event.DeviceId |
Device on which the event occurred. |
keyword |
crowdstrike.event.DnsRequests |
Detected DNS requests done by a process. |
nested |
crowdstrike.event.DocumentsAccessed |
Detected documents accessed by a process. |
nested |
crowdstrike.event.EmailAddresses |
Summary list of all associated entity email addresses. |
keyword |
crowdstrike.event.EnvironmentVariables |
Provides one or more JSON objects which includes related environment variables. |
nested |
crowdstrike.event.EventType |
CrowdStrike provided event type. |
keyword |
crowdstrike.event.ExecutablesWritten |
Detected executables written to disk by a process. |
nested |
crowdstrike.event.ExecutablesWritten.FileName |
keyword |
|
crowdstrike.event.ExecutablesWritten.FilePath |
keyword |
|
crowdstrike.event.ExecutablesWritten.Timestamp |
keyword |
|
crowdstrike.event.ExecutionID |
keyword |
|
crowdstrike.event.ExecutionMetadata.ExecutionDuration |
long |
|
crowdstrike.event.ExecutionMetadata.ExecutionStart |
date |
|
crowdstrike.event.ExecutionMetadata.ReportFileName |
keyword |
|
crowdstrike.event.ExecutionMetadata.ResultCount |
long |
|
crowdstrike.event.ExecutionMetadata.ResultID |
keyword |
|
crowdstrike.event.ExecutionMetadata.SearchWindowEnd |
date |
|
crowdstrike.event.ExecutionMetadata.SearchWindowStart |
date |
|
crowdstrike.event.Finding |
The details of the finding. |
keyword |
crowdstrike.event.FineScore |
The highest incident score reached as of the time the event was sent. |
float |
crowdstrike.event.Flags.Audit |
CrowdStrike audit flag. |
boolean |
crowdstrike.event.Flags.Log |
CrowdStrike log flag. |
boolean |
crowdstrike.event.Flags.Monitor |
CrowdStrike monitor flag. |
boolean |
crowdstrike.event.GrandparentCommandLine |
Grandparent process command line arguments. |
keyword |
crowdstrike.event.GrandparentImageFileName |
Path to the grandparent process. |
keyword |
crowdstrike.event.Highlights |
Sections of content that matched the monitoring rule. |
text |
crowdstrike.event.HostGroups |
Array of related Host Group IDs. |
keyword |
crowdstrike.event.ICMPCode |
RFC2780 ICMP Code field. |
keyword |
crowdstrike.event.ICMPType |
RFC2780 ICMP Type field. |
keyword |
crowdstrike.event.IOARuleInstanceVersion |
Version number of the InstanceID that triggered. |
long |
crowdstrike.event.IOARuleName |
Name given to the custom IOA rule that triggered. |
keyword |
crowdstrike.event.IOCType |
CrowdStrike type for indicator of compromise. |
keyword |
crowdstrike.event.IOCValue |
CrowdStrike value for indicator of compromise. |
keyword |
crowdstrike.event.IdpPolicyRuleAction |
Identity Protection policy rule action. |
keyword |
crowdstrike.event.IdpPolicyRuleName |
Identity Protection policy rule name. |
keyword |
crowdstrike.event.IdpPolicyRuleTrigger |
Identity Protection policy rule trigger. |
keyword |
crowdstrike.event.IncidentType |
Incident Type |
keyword |
crowdstrike.event.Ipv |
Protocol for network request. |
keyword |
crowdstrike.event.ItemPostedTimestamp |
Time the raw intelligence was posted. |
date |
crowdstrike.event.ItemType |
Type of raw intelligence. |
keyword |
crowdstrike.event.KeyStoreErrors |
Describes a KeyStore error. |
keyword |
crowdstrike.event.LMHostIDs |
Array of host IDs seen to have experienced lateral movement because of the incident. |
keyword |
crowdstrike.event.LateralMovement |
Lateral movement field for incident. |
long |
crowdstrike.event.LdapSearchQueryAttack |
Detected LDAP tool attack. |
keyword |
crowdstrike.event.LoadedObjects |
Provides one or more JSON objects describing the loaded objects related to the detection. |
nested |
crowdstrike.event.LocalIP |
IP address of the host associated with the detection. |
keyword |
crowdstrike.event.MACAddress |
MAC address of the host associated with the detection. |
keyword |
crowdstrike.event.MD5String |
MD5 sum of the executable associated with the detection. |
keyword |
crowdstrike.event.MachineDomain |
Domain for the machine associated with the detection. |
keyword |
crowdstrike.event.MatchCount |
Number of firewall rule matches. |
long |
crowdstrike.event.MatchCountSinceLastReport |
Number of firewall rule matches since the last report. |
long |
crowdstrike.event.MobileAppsDetails |
Provides one or more JSON objects describing the related mobile applications. |
nested |
crowdstrike.event.MobileAppsDetails.AndroidAppLabel |
keyword |
|
crowdstrike.event.MobileAppsDetails.AndroidAppVersionName |
keyword |
|
crowdstrike.event.MobileAppsDetails.AppIdentifier |
keyword |
|
crowdstrike.event.MobileAppsDetails.AppInstallerInformation |
keyword |
|
crowdstrike.event.MobileAppsDetails.DexFileHashes |
keyword |
|
crowdstrike.event.MobileAppsDetails.ImageFileName |
keyword |
|
crowdstrike.event.MobileAppsDetails.IsBeingDebugged |
keyword |
|
crowdstrike.event.MobileAppsDetails.IsContainerized |
keyword |
|
crowdstrike.event.MobileDnsRequests |
Provides one or more JSON objects describing the related DNS requests from the mobile device. |
nested |
crowdstrike.event.MobileNetworkConnections |
Provides one or more JSON objects describing the related network connections from the mobile device. |
nested |
crowdstrike.event.MostRecentActivityTimeStamp |
The timestamp of the latest activity performed by the account. |
date |
crowdstrike.event.MountedVolumes |
Provides one or more JSON objects describing mounted volumes on the mobile device. |
nested |
crowdstrike.event.NetworkAccesses |
Detected Network traffic done by a process. |
nested |
crowdstrike.event.NetworkAccesses.AccessTimestamp |
keyword |
|
crowdstrike.event.NetworkAccesses.AccessType |
keyword |
|
crowdstrike.event.NetworkAccesses.ConnectionDirection |
keyword |
|
crowdstrike.event.NetworkAccesses.IsIPV6 |
keyword |
|
crowdstrike.event.NetworkAccesses.LocalAddress |
keyword |
|
crowdstrike.event.NetworkAccesses.LocalPort |
keyword |
|
crowdstrike.event.NetworkAccesses.Protocol |
keyword |
|
crowdstrike.event.NetworkAccesses.RemoteAddress |
keyword |
|
crowdstrike.event.NetworkAccesses.RemotePort |
keyword |
|
crowdstrike.event.NetworkProfile |
CrowdStrike network profile. |
keyword |
crowdstrike.event.NotificationId |
ID of the generated notification. |
keyword |
crowdstrike.event.NumberOfCompromisedEntities |
Number of compromised entities, users and endpoints. |
long |
crowdstrike.event.NumbersOfAlerts |
Number of alerts in the identity-based incident. |
long |
crowdstrike.event.OARuleInstanceID |
Numerical ID of the custom IOA rule under a given CID. |
keyword |
crowdstrike.event.Objective |
Method of detection. |
keyword |
crowdstrike.event.ObjectiveCRuntimesAltered |
Provides one or more JSON objects describing the obj-c methods related to the malware. |
nested |
crowdstrike.event.OperationName |
Event subtype. |
keyword |
crowdstrike.event.ParentImageFileName |
The parent image file name involved. |
keyword |
crowdstrike.event.PatternDispositionFlags.BlockingUnsupportedOrDisabled |
boolean |
|
crowdstrike.event.PatternDispositionFlags.BootupSafeguardEnabled |
boolean |
|
crowdstrike.event.PatternDispositionFlags.CriticalProcessDisabled |
boolean |
|
crowdstrike.event.PatternDispositionFlags.Detect |
boolean |
|
crowdstrike.event.PatternDispositionFlags.FsOperationBlocked |
boolean |
|
crowdstrike.event.PatternDispositionFlags.HandleOperationDowngraded |
boolean |
|
crowdstrike.event.PatternDispositionFlags.InddetMask |
boolean |
|
crowdstrike.event.PatternDispositionFlags.Indicator |
boolean |
|
crowdstrike.event.PatternDispositionFlags.KillActionFailed |
boolean |
|
crowdstrike.event.PatternDispositionFlags.KillParent |
boolean |
|
crowdstrike.event.PatternDispositionFlags.KillProcess |
boolean |
|
crowdstrike.event.PatternDispositionFlags.KillSubProcess |
boolean |
|
crowdstrike.event.PatternDispositionFlags.OperationBlocked |
boolean |
|
crowdstrike.event.PatternDispositionFlags.PolicyDisabled |
boolean |
|
crowdstrike.event.PatternDispositionFlags.ProcessBlocked |
boolean |
|
crowdstrike.event.PatternDispositionFlags.QuarantineFile |
boolean |
|
crowdstrike.event.PatternDispositionFlags.QuarantineMachine |
boolean |
|
crowdstrike.event.PatternDispositionFlags.RegistryOperationBlocked |
boolean |
|
crowdstrike.event.PatternDispositionFlags.Rooting |
boolean |
|
crowdstrike.event.PatternDispositionFlags.SensorOnly |
boolean |
|
crowdstrike.event.PatternDispositionFlags.SuspendParent |
boolean |
|
crowdstrike.event.PatternDispositionFlags.SuspendProcess |
boolean |
|
crowdstrike.event.PatternDispositionValue |
Unique ID associated with action taken. |
integer |
crowdstrike.event.PatternId |
The numerical ID of the pattern associated with the action taken on the detection. |
keyword |
crowdstrike.event.PolicyID |
CrowdStrike policy id. |
keyword |
crowdstrike.event.PolicyId |
The ID of the associated Policy. |
long |
crowdstrike.event.PolicyName |
CrowdStrike policy name. |
keyword |
crowdstrike.event.PrecedingActivityTimeStamp |
The timestamp of the activity before the most recent activity was performed. |
date |
crowdstrike.event.PreviousPrivileges |
A list of the source account’s privileges before privilege changes were made. |
keyword |
crowdstrike.event.Protocol |
CrowdStrike provided protocol. |
keyword |
crowdstrike.event.ProtocolAnomalyClassification |
Authentication signature analysis. |
keyword |
crowdstrike.event.Region |
keyword |
|
crowdstrike.event.ReportFileReference |
keyword |
|
crowdstrike.event.ReportID |
keyword |
|
crowdstrike.event.ReportName |
keyword |
|
crowdstrike.event.ReportType |
keyword |
|
crowdstrike.event.ResourceAttributes |
A JSON blob with all resource attributes. |
flattened |
crowdstrike.event.ResourceId |
The cloud resource identifier. |
keyword |
crowdstrike.event.ResourceIdType |
The type of the detected resource identifier. |
keyword |
crowdstrike.event.ResourceName |
Resource name if any. |
keyword |
crowdstrike.event.ResourceUrl |
The URL to the cloud resource. |
keyword |
crowdstrike.event.RootAccessIndicators |
Provides one or more JSON objects which includes logs and stack traces from the suspicious source. |
nested |
crowdstrike.event.RpcOpClassification |
RPC operation type. |
keyword |
crowdstrike.event.RuleAction |
Firewall rule action. |
keyword |
crowdstrike.event.RulePriority |
Priority of the monitoring rule that found the match. |
keyword |
crowdstrike.event.SELinuxEnforcementPolicy |
State of SELinux enforcement policy on an Android device. |
keyword |
crowdstrike.event.SHA1String |
SHA1 sum of the executable associated with the detection. |
keyword |
crowdstrike.event.SHA256String |
SHA256 sum of the executable associated with the detection. |
keyword |
crowdstrike.event.SafetyNetAdvice |
Provides information to help explain why the Google SafetyNet Attestation API set eitherCTSProfileMatch or BasicIntegrity fields to false. |
keyword |
crowdstrike.event.SafetyNetBasicIntegrity |
The result of a more lenient verdict for device integrity. |
keyword |
crowdstrike.event.SafetyNetCTSProfileMatch |
The result of a stricter verdict for device integrity. |
keyword |
crowdstrike.event.SafetyNetErrorMessage |
An encoded error message. |
keyword |
crowdstrike.event.SafetyNetErrors |
Describes a SafetyNet error |
keyword |
crowdstrike.event.SafetyNetEvaluationType |
Provides information about the type of measurements used to compute fields likeCTSProfileMatch and BasicIntegrity. |
keyword |
crowdstrike.event.ScanResults |
Array of scan results. |
nested |
crowdstrike.event.ScheduledSearchExecutionId |
ID of the specific search execution. |
keyword |
crowdstrike.event.ScheduledSearchId |
Unique identifier of the associated scheduled search. |
keyword |
crowdstrike.event.ScheduledSearchUserId |
User ID of the user that created the the associated scheduled search. |
keyword |
crowdstrike.event.ScheduledSearchUserUUID |
UUID of the user that created the the associated scheduled search. |
keyword |
crowdstrike.event.SensorId |
Unique ID associated with the Falcon sensor. |
keyword |
crowdstrike.event.ServiceName |
Description of which related service was involved in the event. |
keyword |
crowdstrike.event.SessionId |
Session ID of the remote response session. |
keyword |
crowdstrike.event.SeverityName |
The severity level of the detection, as a string (High/Medium/Informational). |
keyword |
crowdstrike.event.SourceAccountUpn |
Source user UPN. |
keyword |
crowdstrike.event.SourceEndpointAccountObjectGuid |
Source endpoint object GUID |
keyword |
crowdstrike.event.SourceEndpointAccountObjectSid |
Source endpoint object SID. |
keyword |
crowdstrike.event.SourceEndpointIpReputation |
Source endpoint IP reputation. |
keyword |
crowdstrike.event.SourceEndpointSensorId |
Source endpoint agent ID. |
keyword |
crowdstrike.event.SourceProducts |
Names of the products from which the source data originated. |
keyword |
crowdstrike.event.SourceVendors |
Names of the vendors from which the source data originated. |
keyword |
crowdstrike.event.SsoApplicationIdentifier |
Destination application identifier. |
keyword |
crowdstrike.event.State |
Identity-based detection or incident status. |
keyword |
crowdstrike.event.Status |
CrowdStrike status. |
keyword |
crowdstrike.event.StatusMessage |
keyword |
|
crowdstrike.event.Success |
Indicator of whether or not this event was successful. |
boolean |
crowdstrike.event.SuspiciousMachineAccountAlterationType |
Machine alteration type. |
keyword |
crowdstrike.event.SystemProperties |
Provides one or more JSON objects which includes related system properties. |
nested |
crowdstrike.event.Tags |
Tags on the cloud resources if any. |
nested |
crowdstrike.event.TargetAccountDomain |
Target user domain. |
keyword |
crowdstrike.event.TargetAccountName |
Target user name. |
keyword |
crowdstrike.event.TargetAccountObjectSid |
Target user object SID. |
keyword |
crowdstrike.event.TargetAccountUpn |
Target user UPN. |
keyword |
crowdstrike.event.TargetEndpointAccountObjectGuid |
Target endpoint object GUID. |
keyword |
crowdstrike.event.TargetEndpointAccountObjectSid |
Target endpoint object SID. |
keyword |
crowdstrike.event.TargetEndpointHostName |
Target endpoint hostname. |
keyword |
crowdstrike.event.TargetEndpointSensorId |
Target endpoint agent ID. |
keyword |
crowdstrike.event.TargetServiceAccessIdentifier |
Target SPN. |
keyword |
crowdstrike.event.Timestamp |
Firewall rule triggered timestamp. |
date |
crowdstrike.event.Trampolines |
Provides one or more JSON objects describing the relevant functions and processes performing inline API hooks. |
nested |
crowdstrike.event.TreeID |
CrowdStrike tree id. |
keyword |
crowdstrike.event.UserId |
Email address or user ID associated with the event. |
keyword |
crowdstrike.event.UserUUID |
keyword |
|
crowdstrike.event.VerifiedBootState |
Provides the device’s current boot state. |
keyword |
crowdstrike.event.XdrType |
Type of detection: xdr or xdr-scheduled-search. |
keyword |
crowdstrike.metadata.customerIDString |
Customer identifier |
keyword |
crowdstrike.metadata.eventType |
DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent |
keyword |
crowdstrike.metadata.offset |
Offset number that tracks the location of the event in stream. This is used to identify unique detection events. |
integer |
crowdstrike.metadata.version |
Schema version |
keyword |
data_stream.dataset |
Data stream dataset name. |
constant_keyword |
data_stream.namespace |
Data stream namespace. |
constant_keyword |
data_stream.type |
Data stream type. |
constant_keyword |
destination.as.number |
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. |
long |
destination.as.organization.name |
Organization name. |
keyword |
destination.as.organization.name.text |
Multi-field of |
match_only_text |
destination.geo.city_name |
City name. |
keyword |
destination.geo.continent_name |
Name of the continent. |
keyword |
destination.geo.country_iso_code |
Country ISO code. |
keyword |
destination.geo.country_name |
Country name. |
keyword |
destination.geo.location |
Longitude and latitude. |
geo_point |
destination.geo.region_iso_code |
Region ISO code. |
keyword |
destination.geo.region_name |
Region name. |
keyword |
destination.ip |
IP address of the destination (IPv4 or IPv6). |
ip |
destination.port |
Port of the destination. |
long |
device.id |
The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. |
keyword |
ecs.version |
ECS version this event conforms to. |
keyword |
error.message |
Error message. |
match_only_text |
event.action |
The action captured by the event. This describes the information in the event. It is more specific than |
keyword |
event.category |
This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. |
keyword |
event.code |
Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. |
keyword |
event.created |
|
date |
event.dataset |
Event dataset |
constant_keyword |
event.end |
|
date |
event.ingested |
Timestamp when an event arrived in the central data store. This is different from |
date |
event.kind |
This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. |
keyword |
event.module |
Event module |
constant_keyword |
event.original |
Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from |
keyword |
event.outcome |
This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. |
keyword |
event.severity |
The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It’s up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in |
long |
event.start |
|
date |
event.type |
This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. |
keyword |
event.url |
URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by |
keyword |
file.hash.md5 |
MD5 hash. |
keyword |
file.hash.sha1 |
SHA1 hash. |
keyword |
file.hash.sha256 |
SHA256 hash. |
keyword |
file.path |
Full path to the file, including the file name. It should include the drive letter, when appropriate. |
keyword |
file.path.text |
Multi-field of |
match_only_text |
host.containerized |
If the host is a container. |
boolean |
host.os.build |
OS build information. |
keyword |
host.os.codename |
OS codename, if any. |
keyword |
input.type |
Type of Filebeat input. |
keyword |
log.flags |
Flags for the log file. |
keyword |
log.offset |
Offset of the entry in the log file. |
long |
message |
For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. |
match_only_text |
network.direction |
Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host’s point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. |
keyword |
network.type |
In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. |
keyword |
observer.product |
The product name of the observer. |
keyword |
observer.vendor |
Vendor name of the observer. |
keyword |
process.args |
Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. |
keyword |
process.command_line |
Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. |
wildcard |
process.command_line.text |
Multi-field of |
match_only_text |
process.end |
The time the process ended. |
date |
process.executable |
Absolute path to the process executable. |
keyword |
process.executable.text |
Multi-field of |
match_only_text |
process.name |
Process name. Sometimes called program name or similar. |
keyword |
process.name.text |
Multi-field of |
match_only_text |
process.parent.args |
Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. |
keyword |
process.parent.command_line |
Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. |
wildcard |
process.parent.command_line.text |
Multi-field of |
match_only_text |
process.parent.executable |
Absolute path to the process executable. |
keyword |
process.parent.executable.text |
Multi-field of |
match_only_text |
process.parent.pid |
Process id. |
long |
process.pid |
Process id. |
long |
process.start |
The time the process started. |
date |
related.hash |
All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you’re unsure what the hash algorithm is (and therefore which key name to search). |
keyword |
related.hosts |
All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. |
keyword |
related.ip |
All of the IPs seen on your event. |
ip |
related.user |
All the user names or other user identifiers seen on the event. |
keyword |
rule.author |
Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. |
keyword |
rule.category |
A categorization value keyword used by the entity using the rule for detection of this event. |
keyword |
rule.description |
The description of the rule generating the event. |
keyword |
rule.id |
A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. |
keyword |
rule.name |
The name of the rule or signature generating the event. |
keyword |
rule.ruleset |
Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. |
keyword |
rule.uuid |
A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. |
keyword |
source.as.number |
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. |
long |
source.as.organization.name |
Organization name. |
keyword |
source.as.organization.name.text |
Multi-field of |
match_only_text |
source.geo.city_name |
City name. |
keyword |
source.geo.continent_name |
Name of the continent. |
keyword |
source.geo.country_iso_code |
Country ISO code. |
keyword |
source.geo.country_name |
Country name. |
keyword |
source.geo.location |
Longitude and latitude. |
geo_point |
source.geo.region_iso_code |
Region ISO code. |
keyword |
source.geo.region_name |
Region name. |
keyword |
source.ip |
IP address of the source (IPv4 or IPv6). |
ip |
source.port |
Port of the source. |
long |
tags |
List of keywords used to tag each event. |
keyword |
threat.framework |
Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. |
keyword |
threat.tactic.id |
The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) |
keyword |
threat.tactic.name |
Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) |
keyword |
threat.technique.id |
The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) |
keyword |
threat.technique.name |
The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) |
keyword |
threat.technique.name.text |
Multi-field of |
match_only_text |
user.domain |
Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. |
keyword |
user.email |
User email address. |
keyword |
user.id |
Unique identifier of the user. |
keyword |
user.name |
Short name or login of the user. |
keyword |
user.name.text |
Multi-field of |
match_only_text |
Example
An example event for falcon looks as following:
{
"@timestamp": "2023-11-02T13:41:34.000Z",
"agent": {
"ephemeral_id": "72e0f5e3-f55d-4983-a209-651b6b071a1c",
"id": "60ae74ae-652f-4e24-9a9e-e5a00ceb1c1c",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.16.0"
},
"crowdstrike": {
"event": {
"AgentIdString": "fffffffff33333",
"SessionId": "1111-fffff-4bb4-99c1-74c13cfc3e5a"
},
"metadata": {
"customerIDString": "abcabcabc22221",
"eventType": "RemoteResponseSessionStartEvent",
"offset": 1,
"version": "1.0"
}
},
"data_stream": {
"dataset": "crowdstrike.falcon",
"namespace": "34236",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "60ae74ae-652f-4e24-9a9e-e5a00ceb1c1c",
"snapshot": false,
"version": "8.16.0"
},
"event": {
"action": [
"remote_response_session_start_event"
],
"agent_id_status": "verified",
"category": [
"network",
"session"
],
"created": "2023-11-02T13:41:34.000Z",
"dataset": "crowdstrike.falcon",
"ingested": "2024-11-29T06:04:44Z",
"kind": "event",
"original": "{\"event\":{\"AgentIdString\":\"fffffffff33333\",\"HostnameField\":\"UKCHUDL00206\",\"SessionId\":\"1111-fffff-4bb4-99c1-74c13cfc3e5a\",\"StartTimestamp\":1698932494,\"UserName\":\"admin.rose@example.com\"},\"metadata\":{\"customerIDString\":\"abcabcabc22221\",\"eventCreationTime\":1698932494000,\"eventType\":\"RemoteResponseSessionStartEvent\",\"offset\":1,\"version\":\"1.0\"}}",
"start": "2023-11-02T13:41:34.000Z",
"type": [
"start"
]
},
"host": {
"name": "UKCHUDL00206"
},
"input": {
"type": "streaming"
},
"message": "Remote response session started.",
"observer": {
"product": "Falcon",
"vendor": "Crowdstrike"
},
"related": {
"hosts": [
"UKCHUDL00206"
],
"user": [
"admin.rose@example.com"
]
},
"tags": [
"preserve_original_event",
"forwarded",
"crowdstrike-falcon"
],
"user": {
"email": "admin.rose@example.com",
"name": "admin.rose@example.com"
}
}
FDR
editThe CrowdStrike Falcon Data Replicator (FDR) allows CrowdStrike users to replicate FDR data from CrowdStrike managed S3 buckets. CrowdStrike writes notification events to a CrowdStrike managed SQS queue when new data is available in S3.
This integration can be used in two ways. It can consume SQS notifications directly from the CrowdStrike managed SQS queue or it can be used in conjunction with the FDR tool that replicates the data to a self-managed S3 bucket and the integration can read from there.
In both cases SQS messages are deleted after they are processed. This allows you to operate more than one Elastic Agent with this integration if needed and not have duplicate events, but it means you cannot ingest the data a second time.
Use with CrowdStrike managed S3/SQS
editThis is the simplest way to setup the integration, and also the default.
You need to set the integration up with the SQS queue URL provided by Crowdstrike FDR.
Ensure the Is FDR queue option is enabled.
Use with FDR tool and data replicated to a self-managed S3 bucket
editThis option can be used if you want to archive the raw CrowdStrike data.
You need to follow the steps below:
- Create a S3 bucket to receive the logs.
- Create a SQS queue.
- Configure your S3 bucket to send object created notifications to your SQS queue.
- Follow the FDR tool instructions to replicate data to your own S3 bucket.
- Configure the integration to read from your self-managed SQS topic.
-
Disable the
Is FDR queueoption in the integration.
While the FDR tool can replicate the files from S3 to your local file system, this integration cannot read those files because they are gzip compressed, and the log file input does not support reading compressed files.
Configuration for the S3 input
editAWS credentials are required for running this integration if you want to use the S3 input.
-
access_key_id: first part of access key. -
secret_access_key: second part of access key. -
session_token: required when using temporary security credentials. -
credential_profile_name: profile name in shared credentials file. -
shared_credential_file: directory of the shared credentials file. -
endpoint: URL of the entry point for an AWS web service. -
role_arn: AWS IAM Role to assume.
There are three types of AWS credentials can be used:
- access keys,
- temporary security credentials, and
- IAM role ARN.
AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are the two parts of access keys.
They are long-term credentials for an IAM user, or the AWS account root user.
Please see AWS Access Keys and Secret Access Keys
for more details.
Temporary security credentials has a limited lifetime and consists of an
access key ID, a secret access key, and a security token which typically returned
from GetSessionToken.
MFA-enabled IAM users would need to submit an MFA code
while calling GetSessionToken. default_region identifies the AWS Region
whose servers you want to send your first API request to by default.
This is typically the Region closest to you, but it can be any Region. Please see Temporary Security Credentials for more details.
sts get-session-token AWS CLI can be used to generate temporary credentials.
For example. with MFA-enabled:
aws> sts get-session-token --serial-number arn:aws:iam::1234:mfa/your-email@example.com --duration-seconds 129600 --token-code 123456
Because temporary security credentials are short term, after they expire, the
user needs to generate new ones and manually update the package configuration in
order to continue collecting aws metrics.
This will cause data loss if the configuration is not updated with new credentials before the old ones expire.
An IAM role is an IAM identity that you can create in your account that has specific permissions that determine what the identity can and cannot do in AWS.
A role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session. IAM role Amazon Resource Name (ARN) can be used to specify which AWS IAM role to assume to generate temporary credentials.
Please see AssumeRole API documentation for more details.
-
Use access keys: Access keys include
access_key_id,secret_access_keyand/orsession_token. -
Use
role_arn:role_arnis used to specify which AWS IAM role to assume for generating temporary credentials. Ifrole_arnis given, the package will check if access keys are given. If not, the package will check for credential profile name. If neither is given, default credential profile will be used.
Please make sure credentials are given under either a credential profile or
access keys.
3. Use credential_profile_name and/or shared_credential_file:
If access_key_id, secret_access_key and role_arn are all not given, then
the package will check for credential_profile_name.
If you use different credentials for different tools or applications, you can use profiles to
configure multiple access keys in the same configuration file.
If there is no credential_profile_name given, the default profile will be used.
shared_credential_file is optional to specify the directory of your shared
credentials file.
If it’s empty, the default directory will be used.
In Windows, shared credentials file is at C:\Users<yourUserName>.aws\credentials.
For Linux, macOS or Unix, the file locates at ~/.aws/credentials.
Please seehttps://docs.aws.amazon.com/ses/latest/DeveloperGuide/create-shared-credentials-file.html[Create Shared Credentials File]
for more details.
Exported fields
| Field | Description | Type |
|---|---|---|
@timestamp |
Event timestamp. |
date |
crowdstrike.AccountType |
keyword |
|
crowdstrike.ActiveDirectoryAuthenticationMethod |
keyword |
|
crowdstrike.ActivityId |
keyword |
|
crowdstrike.AgentIdString |
keyword |
|
crowdstrike.AgentLoadFlags |
keyword |
|
crowdstrike.AgentLocalTime |
date |
|
crowdstrike.AgentTimeOffset |
float |
|
crowdstrike.AgentVersion |
keyword |
|
crowdstrike.AllocateVirtualMemoryCount |
long |
|
crowdstrike.ApiReturnValue |
keyword |
|
crowdstrike.ArchiveFileWrittenCount |
long |
|
crowdstrike.AsepWrittenCount |
long |
|
crowdstrike.AssociatedFile |
keyword |
|
crowdstrike.AttemptNumber |
long |
|
crowdstrike.AuthenticationActivityId |
keyword |
|
crowdstrike.AuthenticationId |
keyword |
|
crowdstrike.AuthenticationPackage |
keyword |
|
crowdstrike.AuthenticationUuid |
keyword |
|
crowdstrike.AuthenticationUuidAsString |
keyword |
|
crowdstrike.BinaryExecutableWrittenCount |
long |
|
crowdstrike.BiosManufacturer |
keyword |
|
crowdstrike.BiosReleaseDate |
date |
|
crowdstrike.BiosVersion |
keyword |
|
crowdstrike.BootArgs |
keyword |
|
crowdstrike.BootTimeFunctionalityLevel |
keyword |
|
crowdstrike.BoundedCount |
long |
|
crowdstrike.BundleID |
keyword |
|
crowdstrike.CLICreationCount |
long |
|
crowdstrike.CallStackModuleNames |
keyword |
|
crowdstrike.CallStackModuleNamesVersion |
version |
|
crowdstrike.ChannelDiffStatus |
keyword |
|
crowdstrike.ChannelId |
keyword |
|
crowdstrike.ChannelVersion |
keyword |
|
crowdstrike.ChannelVersionRequired |
keyword |
|
crowdstrike.ChasisManufacturer |
keyword |
|
crowdstrike.ChassisType |
keyword |
|
crowdstrike.ClientComputerName |
keyword |
|
crowdstrike.CommandHistory |
keyword |
|
crowdstrike.CommandHistory.text |
Multi-field of |
match_only_text |
crowdstrike.CompletionEventId |
keyword |
|
crowdstrike.ConHostId |
keyword |
|
crowdstrike.ConHostProcessId |
keyword |
|
crowdstrike.ConfigBuild |
keyword |
|
crowdstrike.ConfigIDBase |
keyword |
|
crowdstrike.ConfigIDBuild |
keyword |
|
crowdstrike.ConfigIDPlatform |
keyword |
|
crowdstrike.ConfigStateData |
text |
|
crowdstrike.ConfigStateHash |
keyword |
|
crowdstrike.ConfigurationVersion |
keyword |
|
crowdstrike.ConnectTime |
date |
|
crowdstrike.ConnectType |
keyword |
|
crowdstrike.ConnectionFlags |
keyword |
|
crowdstrike.ContextProcessId |
keyword |
|
crowdstrike.ContextTimeStamp |
System local time of event creation. |
date |
crowdstrike.CpuClockSpeed |
keyword |
|
crowdstrike.CpuFeaturesMask |
keyword |
|
crowdstrike.CpuProcessorName |
keyword |
|
crowdstrike.CpuSignature |
keyword |
|
crowdstrike.CpuVendor |
keyword |
|
crowdstrike.CreateProcessCount |
long |
|
crowdstrike.CreateProcessType |
keyword |
|
crowdstrike.CurrentFunctionalityLevel |
keyword |
|
crowdstrike.CurrentLocalIP |
ip |
|
crowdstrike.CustomerIdString |
keyword |
|
crowdstrike.CycleTime |
long |
|
crowdstrike.DesiredAccess |
keyword |
|
crowdstrike.DetectDescription |
keyword |
|
crowdstrike.DetectId |
keyword |
|
crowdstrike.DetectName |
keyword |
|
crowdstrike.DeviceId |
keyword |
|
crowdstrike.DirectoryCreatedCount |
long |
|
crowdstrike.DirectoryEnumeratedCount |
long |
|
crowdstrike.DnsRequestCount |
long |
|
crowdstrike.DocumentFileWrittenCount |
long |
|
crowdstrike.DownloadPath |
keyword |
|
crowdstrike.DownloadPort |
long |
|
crowdstrike.DownloadServer |
keyword |
|
crowdstrike.DualRequest |
keyword |
|
crowdstrike.ELFSubType |
keyword |
|
crowdstrike.EffectiveTransmissionClass |
keyword |
|
crowdstrike.EnabledPrivilegesBitmask |
keyword |
|
crowdstrike.EndTime |
date |
|
crowdstrike.Entitlements |
keyword |
|
crowdstrike.ErrorCode |
keyword |
|
crowdstrike.ErrorStatus |
keyword |
|
crowdstrike.EtwRawThreadId |
long |
|
crowdstrike.EventType |
keyword |
|
crowdstrike.EventUUID |
keyword |
|
crowdstrike.ExeAndServiceCount |
long |
|
crowdstrike.ExecutableDeletedCount |
long |
|
crowdstrike.ExternalApiType |
keyword |
|
crowdstrike.FXFileSize |
keyword |
|
crowdstrike.Facility |
keyword |
|
crowdstrike.FailedConnectCount |
long |
|
crowdstrike.FalconGroupingTags |
keyword |
|
crowdstrike.FalconHostLink |
keyword |
|
crowdstrike.FeatureExtractionVersion |
keyword |
|
crowdstrike.FeatureVector |
match_only_text |
|
crowdstrike.File |
keyword |
|
crowdstrike.FileAttributes |
keyword |
|
crowdstrike.FileDeletedCount |
long |
|
crowdstrike.FileEcpBitmask |
keyword |
|
crowdstrike.FileName |
keyword |
|
crowdstrike.FileObject |
keyword |
|
crowdstrike.FilePath |
keyword |
|
crowdstrike.FirmwareAnalysisEclConsumerInterfaceVersion |
keyword |
|
crowdstrike.FirmwareAnalysisEclControlInterfaceVersion |
keyword |
|
crowdstrike.FirstDiscoveredDate |
date |
|
crowdstrike.FirstSeen |
date |
|
crowdstrike.Flags |
keyword |
|
crowdstrike.GenericFileWrittenCount |
long |
|
crowdstrike.GrandParentBaseFileName |
keyword |
|
crowdstrike.GrandparentCommandLine |
keyword |
|
crowdstrike.GrandparentCommandLine.text |
Multi-field of |
match_only_text |
crowdstrike.GrandparentImageFileName |
keyword |
|
crowdstrike.HostGroups |
keyword |
|
crowdstrike.HostHiddenStatus |
keyword |
|
crowdstrike.IOCType |
keyword |
|
crowdstrike.IOCValue |
keyword |
|
crowdstrike.IOServiceClass |
keyword |
|
crowdstrike.IOServiceName |
keyword |
|
crowdstrike.IOServicePath |
keyword |
|
crowdstrike.ImageSubsystem |
keyword |
|
crowdstrike.InContext |
keyword |
|
crowdstrike.InDiscards |
keyword |
|
crowdstrike.InErrors |
keyword |
|
crowdstrike.InMulticastPkts |
keyword |
|
crowdstrike.InOctets |
keyword |
|
crowdstrike.InUcastPkts |
keyword |
|
crowdstrike.InUnknownProtos |
keyword |
|
crowdstrike.Information |
keyword |
|
crowdstrike.InjectedDllCount |
long |
|
crowdstrike.InjectedThreadCount |
long |
|
crowdstrike.IntegrityLevel |
keyword |
|
crowdstrike.InterfaceAlias |
keyword |
|
crowdstrike.InterfaceGuid |
keyword |
|
crowdstrike.InterfaceIndex |
long |
|
crowdstrike.InterfaceType |
keyword |
|
crowdstrike.InterfaceVersion |
keyword |
|
crowdstrike.IrpFlags |
keyword |
|
crowdstrike.IsOnNetwork |
keyword |
|
crowdstrike.IsOnRemovableDisk |
keyword |
|
crowdstrike.IsTransactedFile |
keyword |
|
crowdstrike.KernelTime |
long |
|
crowdstrike.LastDiscoveredBy |
keyword |
|
crowdstrike.LastLoggedOnHost |
keyword |
|
crowdstrike.LfoUploadFlags |
keyword |
|
crowdstrike.LightningLatencyState |
keyword |
|
crowdstrike.Line |
keyword |
|
crowdstrike.LocalAddressIP4 |
ip |
|
crowdstrike.LocalAddressIP6 |
ip |
|
crowdstrike.LocalAdminAccess |
keyword |
|
crowdstrike.LocalIP |
ip |
|
crowdstrike.LogicalCoreCount |
long |
|
crowdstrike.LoginSessionId |
keyword |
|
crowdstrike.LogoffTime |
date |
|
crowdstrike.LogonDomain |
keyword |
|
crowdstrike.LogonId |
keyword |
|
crowdstrike.LogonInfo |
keyword |
|
crowdstrike.LogonServer |
keyword |
|
crowdstrike.LogonTime |
date |
|
crowdstrike.LogonType |
keyword |
|
crowdstrike.MACAddress |
keyword |
|
crowdstrike.MACPrefix |
keyword |
|
crowdstrike.MD5String |
keyword |
|
crowdstrike.MLModelVersion |
keyword |
|
crowdstrike.MachOSubType |
keyword |
|
crowdstrike.MajorFunction |
keyword |
|
crowdstrike.MajorVersion |
keyword |
|
crowdstrike.Malicious |
keyword |
|
crowdstrike.MaxThreadCount |
long |
|
crowdstrike.MemoryTotal |
keyword |
|
crowdstrike.MicrocodeSignature |
keyword |
|
crowdstrike.MinorFunction |
keyword |
|
crowdstrike.MinorVersion |
keyword |
|
crowdstrike.MoboManufacturer |
keyword |
|
crowdstrike.MoboProductName |
keyword |
|
crowdstrike.ModelPrediction |
keyword |
|
crowdstrike.ModuleLoadCount |
long |
|
crowdstrike.NDRoot |
keyword |
|
crowdstrike.NeighborList |
keyword |
|
crowdstrike.NeighborName |
keyword |
|
crowdstrike.NetLuidIndex |
long |
|
crowdstrike.NetworkBindCount |
long |
|
crowdstrike.NetworkCapableAsepWriteCount |
long |
|
crowdstrike.NetworkCloseCount |
long |
|
crowdstrike.NetworkConnectCount |
long |
|
crowdstrike.NetworkConnectCountUdp |
long |
|
crowdstrike.NetworkContainmentState |
keyword |
|
crowdstrike.NetworkListenCount |
long |
|
crowdstrike.NetworkModuleLoadCount |
long |
|
crowdstrike.NetworkRecvAcceptCount |
long |
|
crowdstrike.NewExecutableWrittenCount |
long |
|
crowdstrike.NewFileIdentifier |
keyword |
|
crowdstrike.Nonce |
integer |
|
crowdstrike.OSVersionFileData |
match_only_text |
|
crowdstrike.OSVersionFileName |
keyword |
|
crowdstrike.OU |
keyword |
|
crowdstrike.Objective |
keyword |
|
crowdstrike.OperationFlags |
keyword |
|
crowdstrike.Options |
keyword |
|
crowdstrike.OutErrors |
keyword |
|
crowdstrike.OutMulticastPkts |
keyword |
|
crowdstrike.OutOctets |
keyword |
|
crowdstrike.OutUcastPkts |
keyword |
|
crowdstrike.Parameter1 |
keyword |
|
crowdstrike.Parameter2 |
keyword |
|
crowdstrike.Parameter3 |
keyword |
|
crowdstrike.ParentAuthenticationId |
keyword |
|
crowdstrike.ParentCommandLine |
keyword |
|
crowdstrike.ParentCommandLine.text |
Multi-field of |
match_only_text |
crowdstrike.ParentImageFileName |
keyword |
|
crowdstrike.PasswordLastSet |
keyword |
|
crowdstrike.PatternDispositionDescription |
keyword |
|
crowdstrike.PatternDispositionFlags.BlockingUnsupportedOrDisabled |
boolean |
|
crowdstrike.PatternDispositionFlags.BootupSafeguardEnabled |
boolean |
|
crowdstrike.PatternDispositionFlags.CriticalProcessDisabled |
boolean |
|
crowdstrike.PatternDispositionFlags.Detect |
boolean |
|
crowdstrike.PatternDispositionFlags.FsOperationBlocked |
boolean |
|
crowdstrike.PatternDispositionFlags.HandleOperationDowngraded |
boolean |
|
crowdstrike.PatternDispositionFlags.InddetMask |
boolean |
|
crowdstrike.PatternDispositionFlags.Indicator |
boolean |
|
crowdstrike.PatternDispositionFlags.KillActionFailed |
boolean |
|
crowdstrike.PatternDispositionFlags.KillParent |
boolean |
|
crowdstrike.PatternDispositionFlags.KillProcess |
boolean |
|
crowdstrike.PatternDispositionFlags.KillSubProcess |
boolean |
|
crowdstrike.PatternDispositionFlags.OperationBlocked |
boolean |
|
crowdstrike.PatternDispositionFlags.PolicyDisabled |
boolean |
|
crowdstrike.PatternDispositionFlags.ProcessBlocked |
boolean |
|
crowdstrike.PatternDispositionFlags.QuarantineFile |
boolean |
|
crowdstrike.PatternDispositionFlags.QuarantineMachine |
boolean |
|
crowdstrike.PatternDispositionFlags.RegistryOperationBlocked |
boolean |
|
crowdstrike.PatternDispositionFlags.Rooting |
boolean |
|
crowdstrike.PatternDispositionFlags.SensorOnly |
boolean |
|
crowdstrike.PatternDispositionFlags.SuspendParent |
boolean |
|
crowdstrike.PatternDispositionFlags.SuspendProcess |
boolean |
|
crowdstrike.PatternDispositionValue |
long |
|
crowdstrike.PciAttachmentState |
keyword |
|
crowdstrike.PhysicalAddress |
keyword |
|
crowdstrike.PhysicalAddressLength |
long |
|
crowdstrike.PhysicalCoreCount |
long |
|
crowdstrike.PointerSize |
keyword |
|
crowdstrike.PreviousConnectTime |
date |
|
crowdstrike.PrivilegedProcessHandleCount |
long |
|
crowdstrike.PrivilegesBitmask |
keyword |
|
crowdstrike.ProcessCount |
long |
|
crowdstrike.ProcessCreateFlags |
keyword |
|
crowdstrike.ProcessId |
long |
|
crowdstrike.ProcessParameterFlags |
keyword |
|
crowdstrike.ProcessSxsFlags |
keyword |
|
crowdstrike.ProcessorPackageCount |
long |
|
crowdstrike.ProductType |
keyword |
|
crowdstrike.ProtectVirtualMemoryCount |
long |
|
crowdstrike.ProvisionState |
keyword |
|
crowdstrike.PupAdwareConfidence |
keyword |
|
crowdstrike.PupAdwareDecisionValue |
keyword |
|
crowdstrike.QueueApcCount |
long |
|
crowdstrike.RFMState |
keyword |
|
crowdstrike.RGID |
keyword |
|
crowdstrike.RUID |
keyword |
|
crowdstrike.ReasonOfFunctionalityLevel |
keyword |
|
crowdstrike.RegKeySecurityDecreasedCount |
long |
|
crowdstrike.RemoteAccount |
keyword |
|
crowdstrike.RemovableDiskFileWrittenCount |
long |
|
crowdstrike.RequestType |
keyword |
|
crowdstrike.RpcClientProcessId |
keyword |
|
crowdstrike.RpcClientThreadId |
keyword |
|
crowdstrike.RpcNestingLevel |
keyword |
|
crowdstrike.RpcOpNum |
keyword |
|
crowdstrike.RunDllInvocationCount |
long |
|
crowdstrike.SHA1String |
keyword |
|
crowdstrike.SHA256String |
keyword |
|
crowdstrike.SVGID |
keyword |
|
crowdstrike.SVUID |
keyword |
|
crowdstrike.ScreenshotsTakenCount |
long |
|
crowdstrike.ScriptEngineInvocationCount |
long |
|
crowdstrike.SensorGroupingTags |
keyword |
|
crowdstrike.SensorId |
keyword |
|
crowdstrike.SensorStateBitMap |
keyword |
|
crowdstrike.ServiceDisplayName |
keyword |
|
crowdstrike.ServiceEventCount |
long |
|
crowdstrike.ServicePackMajor |
keyword |
|
crowdstrike.SessionId |
keyword |
|
crowdstrike.SessionProcessId |
keyword |
|
crowdstrike.SetThreadContextCount |
long |
|
crowdstrike.Severity |
integer |
|
crowdstrike.SeverityName |
keyword |
|
crowdstrike.ShareAccess |
keyword |
|
crowdstrike.SiteName |
keyword |
|
crowdstrike.Size |
long |
|
crowdstrike.SnapshotFileOpenCount |
long |
|
crowdstrike.SourceAccountDomain |
keyword |
|
crowdstrike.SourceAccountObjectGuid |
keyword |
|
crowdstrike.SourceAccountObjectSid |
keyword |
|
crowdstrike.SourceAccountSamAccountName |
keyword |
|
crowdstrike.SourceEndpointAccountObjectGuid |
keyword |
|
crowdstrike.SourceEndpointAccountObjectSid |
keyword |
|
crowdstrike.SourceEndpointAddressIP4 |
keyword |
|
crowdstrike.SourceEndpointHostName |
keyword |
|
crowdstrike.SourceEndpointNetworkTag |
keyword |
|
crowdstrike.SourceEndpointNetworkType |
keyword |
|
crowdstrike.SourceFileName |
keyword |
|
crowdstrike.SourceProcessId |
keyword |
|
crowdstrike.SourceThreadId |
keyword |
|
crowdstrike.StartTime |
date |
|
crowdstrike.Status |
keyword |
|
crowdstrike.SubStatus |
keyword |
|
crowdstrike.SuppressType |
keyword |
|
crowdstrike.SuspectStackCount |
long |
|
crowdstrike.SuspiciousCredentialModuleLoadCount |
long |
|
crowdstrike.SuspiciousDnsRequestCount |
long |
|
crowdstrike.SuspiciousFontLoadCount |
long |
|
crowdstrike.SuspiciousRawDiskReadCount |
long |
|
crowdstrike.SyntheticPR2Flags |
keyword |
|
crowdstrike.SystemManufacturer |
keyword |
|
crowdstrike.SystemProductName |
keyword |
|
crowdstrike.SystemSerialNumber |
keyword |
|
crowdstrike.SystemSku |
keyword |
|
crowdstrike.SystemTableIndex |
long |
|
crowdstrike.Tactic |
keyword |
|
crowdstrike.Tags |
keyword |
|
crowdstrike.TargetDomainControllerObjectGuid |
keyword |
|
crowdstrike.TargetDomainControllerObjectSid |
keyword |
|
crowdstrike.TargetFileName |
keyword |
|
crowdstrike.TargetThreadId |
keyword |
|
crowdstrike.Technique |
keyword |
|
crowdstrike.Timeout |
long |
|
crowdstrike.TokenType |
keyword |
|
crowdstrike.USN |
keyword |
|
crowdstrike.UnixMode |
keyword |
|
crowdstrike.UnsignedModuleLoadCount |
long |
|
crowdstrike.UploadId |
keyword |
|
crowdstrike.User |
keyword |
|
crowdstrike.UserFlags |
keyword |
|
crowdstrike.UserGroupsBitmask |
keyword |
|
crowdstrike.UserLogoffType |
keyword |
|
crowdstrike.UserLogonFlags |
keyword |
|
crowdstrike.UserLogonFlags_decimal |
keyword |
|
crowdstrike.UserMemoryAllocateExecutableCount |
long |
|
crowdstrike.UserMemoryAllocateExecutableRemoteCount |
long |
|
crowdstrike.UserMemoryProtectExecutableCount |
long |
|
crowdstrike.UserMemoryProtectExecutableRemoteCount |
long |
|
crowdstrike.UserName |
keyword |
|
crowdstrike.UserSid |
keyword |
|
crowdstrike.UserSid_readable |
keyword |
|
crowdstrike.UserTime |
long |
|
crowdstrike.VerifiedCertificate |
keyword |
|
crowdstrike.VnodeModificationType |
keyword |
|
crowdstrike.VnodeType |
keyword |
|
crowdstrike.VolumeAppearanceTime |
keyword |
|
crowdstrike.VolumeBusName |
keyword |
|
crowdstrike.VolumeBusPath |
keyword |
|
crowdstrike.VolumeDeviceCharacteristics |
keyword |
|
crowdstrike.VolumeDeviceInternal |
keyword |
|
crowdstrike.VolumeDeviceModel |
keyword |
|
crowdstrike.VolumeDeviceObjectFlags |
keyword |
|
crowdstrike.VolumeDevicePath |
keyword |
|
crowdstrike.VolumeDeviceProtocol |
keyword |
|
crowdstrike.VolumeDeviceRevision |
keyword |
|
crowdstrike.VolumeDeviceType |
keyword |
|
crowdstrike.VolumeDriveLetter |
keyword |
|
crowdstrike.VolumeFileSystemDevice |
keyword |
|
crowdstrike.VolumeFileSystemDriver |
keyword |
|
crowdstrike.VolumeFileSystemType |
keyword |
|
crowdstrike.VolumeIsEncrypted |
keyword |
|
crowdstrike.VolumeIsNetwork |
keyword |
|
crowdstrike.VolumeMediaBSDMajor |
keyword |
|
crowdstrike.VolumeMediaBSDMinor |
keyword |
|
crowdstrike.VolumeMediaBSDName |
keyword |
|
crowdstrike.VolumeMediaBSDUnit |
keyword |
|
crowdstrike.VolumeMediaContent |
keyword |
|
crowdstrike.VolumeMediaEjectable |
keyword |
|
crowdstrike.VolumeMediaName |
keyword |
|
crowdstrike.VolumeMediaPath |
keyword |
|
crowdstrike.VolumeMediaRemovable |
keyword |
|
crowdstrike.VolumeMediaSize |
keyword |
|
crowdstrike.VolumeMediaUUID |
keyword |
|
crowdstrike.VolumeMediaWhole |
keyword |
|
crowdstrike.VolumeMediaWritable |
keyword |
|
crowdstrike.VolumeMountPoint |
keyword |
|
crowdstrike.VolumeName |
keyword |
|
crowdstrike.VolumeRealDeviceName |
keyword |
|
crowdstrike.VolumeSectorSize |
keyword |
|
crowdstrike.VolumeType |
keyword |
|
crowdstrike.VolumeUUID |
keyword |
|
crowdstrike.WindowFlags |
keyword |
|
crowdstrike.__mv_LocalAddressIP4 |
keyword |
|
crowdstrike.__mv_aip |
keyword |
|
crowdstrike.__mv_discoverer_aid |
keyword |
|
crowdstrike.aipCount |
integer |
|
crowdstrike.assessments.* |
flattened |
|
crowdstrike.cid |
keyword |
|
crowdstrike.discovererCount |
integer |
|
crowdstrike.discoverer_aid |
keyword |
|
crowdstrike.eid |
integer |
|
crowdstrike.hostname |
keyword |
|
crowdstrike.info.host.* |
Host information enriched from aidmaster data. |
object |
crowdstrike.info.user.* |
User information enriched from userinfo data. |
object |
crowdstrike.localipCount |
integer |
|
crowdstrike.monthsincereset |
keyword |
|
crowdstrike.name |
keyword |
|
crowdstrike.os_version |
keyword |
|
crowdstrike.product_type_desc |
keyword |
|
crowdstrike.scores.modified_time |
date |
|
crowdstrike.scores.os |
long |
|
crowdstrike.scores.overall |
long |
|
crowdstrike.scores.sensor |
long |
|
crowdstrike.scores.version |
keyword |
|
crowdstrike.subnet |
keyword |
|
data_stream.dataset |
Data stream dataset. |
constant_keyword |
data_stream.namespace |
Data stream namespace. |
constant_keyword |
data_stream.type |
Data stream type. |
constant_keyword |
destination.address |
Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the |
keyword |
destination.as.number |
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. |
long |
destination.as.organization.name |
Organization name. |
keyword |
destination.as.organization.name.text |
Multi-field of |
match_only_text |
destination.geo.city_name |
City name. |
keyword |
destination.geo.continent_name |
Name of the continent. |
keyword |
destination.geo.country_iso_code |
Country ISO code. |
keyword |
destination.geo.country_name |
Country name. |
keyword |
destination.geo.location |
Longitude and latitude. |
geo_point |
destination.geo.region_iso_code |
Region ISO code. |
keyword |
destination.geo.region_name |
Region name. |
keyword |
destination.ip |
IP address of the destination (IPv4 or IPv6). |
ip |
destination.port |
Port of the destination. |
long |
device.id |
The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. |
keyword |
dns.question.name |
The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. |
keyword |
dns.question.registered_domain |
The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". |
keyword |
dns.question.subdomain |
The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. |
keyword |
dns.question.top_level_domain |
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". |
keyword |
dns.question.type |
The type of record being queried. |
keyword |
dns.type |
The type of DNS event captured, query or answer. If your source of DNS events only gives you DNS queries, you should only create dns events of type |
keyword |
ecs.version |
ECS version this event conforms to. |
keyword |
event.action |
The action captured by the event. This describes the information in the event. It is more specific than |
keyword |
event.category |
This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. |
keyword |
event.created |
|
date |
event.dataset |
Event dataset |
constant_keyword |
event.id |
Unique ID to describe the event. |
keyword |
event.kind |
This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. |
keyword |
event.module |
Event module |
constant_keyword |
event.original |
Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from |
keyword |
event.outcome |
This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. |
keyword |
event.timezone |
This field should be populated when the event’s timestamp does not include timezone information already (e.g. default Syslog timestamps). It’s optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). |
keyword |
event.type |
This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. |
keyword |
file.device |
Device that is the source of the file. |
keyword |
file.directory |
Directory where the file is located. It should include the drive letter, when appropriate. |
keyword |
file.drive_letter |
Drive letter where the file is located. This field is only relevant on Windows. The value should be uppercase, and not include the colon. |
keyword |
file.extension |
File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). |
keyword |
file.hash.sha256 |
SHA256 hash. |
keyword |
file.inode |
Inode representing the file in the filesystem. |
keyword |
file.name |
Name of the file including the extension, without the directory. |
keyword |
file.path |
Full path to the file, including the file name. It should include the drive letter, when appropriate. |
keyword |
file.path.text |
Multi-field of |
match_only_text |
file.size |
File size in bytes. Only relevant when |
long |
file.type |
File type (file, dir, or symlink). |
keyword |
host.domain |
Name of the domain of which the host is a member. For example, on Windows this could be the host’s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host’s LDAP provider. |
keyword |
host.geo.city_name |
City name. |
keyword |
host.geo.continent_name |
Name of the continent. |
keyword |
host.geo.country_name |
Country name. |
keyword |
host.geo.timezone |
The time zone of the location, such as IANA time zone name. |
keyword |
host.hostname |
Hostname of the host. It normally contains what the |
keyword |
host.ip |
Host ip addresses. |
ip |
host.name |
Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. |
keyword |
host.os.type |
Use the |
keyword |
host.os.version |
Operating system version as a raw string. |
keyword |
input.type |
keyword |
|
log.file.path |
Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn’t read from a log file, do not populate this field. |
keyword |
log.offset |
long |
|
network.community_id |
A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. |
keyword |
network.direction |
Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host’s point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. |
keyword |
network.iana_number |
IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. |
keyword |
network.transport |
Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. |
keyword |
observer.address |
keyword |
|
observer.geo.city_name |
City name. |
keyword |
observer.geo.continent_name |
Name of the continent. |
keyword |
observer.geo.country_iso_code |
Country ISO code. |
keyword |
observer.geo.country_name |
Country name. |
keyword |
observer.geo.location |
Longitude and latitude. |
geo_point |
observer.geo.region_iso_code |
Region ISO code. |
keyword |
observer.geo.region_name |
Region name. |
keyword |
observer.ip |
IP addresses of the observer. |
ip |
observer.serial_number |
Observer serial number. |
keyword |
observer.type |
The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are |
keyword |
observer.vendor |
Vendor name of the observer. |
keyword |
observer.version |
Observer version. |
keyword |
process.args |
Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. |
keyword |
process.args_count |
Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. |
long |
process.command_line |
Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. |
wildcard |
process.command_line.text |
Multi-field of |
match_only_text |
process.end |
The time the process ended. |
date |
process.entity_id |
Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. |
keyword |
process.executable |
Absolute path to the process executable. |
keyword |
process.executable.text |
Multi-field of |
match_only_text |
process.exit_code |
The exit code of the process, if this is a termination event. The field should be absent if there is no exit code for the event (e.g. process start). |
long |
process.hash.md5 |
MD5 hash. |
keyword |
process.hash.sha256 |
SHA256 hash. |
keyword |
process.name |
Process name. Sometimes called program name or similar. |
keyword |
process.name.text |
Multi-field of |
match_only_text |
process.parent.entity_id |
Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. |
keyword |
process.parent.name |
Process name. Sometimes called program name or similar. |
keyword |
process.parent.name.text |
Multi-field of |
match_only_text |
process.pgid |
Deprecated for removal in next major version release. This field is superseded by |
long |
process.pid |
Process id. |
long |
process.start |
The time the process started. |
date |
process.thread.id |
Thread ID. |
long |
process.title |
Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. |
keyword |
process.title.text |
Multi-field of |
match_only_text |
process.uptime |
Seconds the process has been up. |
long |
related.hash |
All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you’re unsure what the hash algorithm is (and therefore which key name to search). |
keyword |
related.hosts |
All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. |
keyword |
related.ip |
All of the IPs seen on your event. |
ip |
related.user |
All the user names or other user identifiers seen on the event. |
keyword |
server.address |
Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the |
keyword |
server.domain |
The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. |
keyword |
server.registered_domain |
The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". |
keyword |
server.subdomain |
The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "http://www.east.mydomain.co.uk[www.east.mydomain.co.uk]" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. |
keyword |
server.top_level_domain |
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". |
keyword |
source.address |
Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the |
keyword |
source.as.number |
Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. |
long |
source.as.organization.name |
Organization name. |
keyword |
source.as.organization.name.text |
Multi-field of |
match_only_text |
source.geo.city_name |
City name. |
keyword |
source.geo.continent_name |
Name of the continent. |
keyword |
source.geo.country_iso_code |
Country ISO code. |
keyword |
source.geo.country_name |
Country name. |
keyword |
source.geo.location |
Longitude and latitude. |
geo_point |
source.geo.region_iso_code |
Region ISO code. |
keyword |
source.geo.region_name |
Region name. |
keyword |
source.ip |
IP address of the source (IPv4 or IPv6). |
ip |
source.mac |
MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. |
keyword |
source.port |
Port of the source. |
long |
tags |
List of keywords used to tag each event. |
keyword |
url.domain |
Domain of the url, such as "http://www.elastic.co[www.elastic.co]". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the |
keyword |
url.extension |
The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). |
keyword |
url.original |
Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. |
wildcard |
url.original.text |
Multi-field of |
match_only_text |
url.path |
Path of the request, such as "/search". |
wildcard |
url.registered_domain |
The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". |
keyword |
url.scheme |
Scheme of the request, such as "https". Note: The |
keyword |
url.subdomain |
The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "http://www.east.mydomain.co.uk[www.east.mydomain.co.uk]" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. |
keyword |
url.top_level_domain |
The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". |
keyword |
user.domain |
Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. |
keyword |
user.email |
User email address. |
keyword |
user.full_name |
User’s full name, if available. |
keyword |
user.full_name.text |
Multi-field of |
match_only_text |
user.group.id |
Unique identifier for the group on the system/platform. |
keyword |
user.id |
Unique identifier of the user. |
keyword |
user.name |
Short name or login of the user. |
keyword |
user.name.text |
Multi-field of |
match_only_text |
Example
An example event for fdr looks as following:
{
"@timestamp": "2020-10-01T09:58:32.519Z",
"agent": {
"ephemeral_id": "9eabd9f1-861b-4007-80d9-7ca2e4b6bb03",
"id": "8e3dcae6-8d1c-46c1-bed0-bf69fdde05e5",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.11.1"
},
"crowdstrike": {
"AuthenticationId": "3783389",
"ConfigStateHash": "3998263252",
"EffectiveTransmissionClass": "3",
"Entitlements": "15",
"ImageSubsystem": "2",
"IntegrityLevel": "4096",
"ParentAuthenticationId": "3783389",
"ProcessCreateFlags": "525332",
"ProcessParameterFlags": "16385",
"ProcessSxsFlags": "1600",
"RpcClientProcessId": "2439558094566",
"SessionId": "1",
"SourceProcessId": "2439558094566",
"SourceThreadId": "77538684027214",
"Tags": [
"41",
"12094627905582",
"12094627906234"
],
"TokenType": "2",
"WindowFlags": "128",
"cid": "ffffffff30a3407dae27d0503611022d",
"info": {
"host": {
"AgentLoadFlags": "1",
"AgentLocalTime": "1697775225",
"AgentTimeOffset": "15889.017",
"AgentVersion": "7.01.13922.0",
"BiosManufacturer": "Iris",
"BiosVersion": "vG17V.21040423/z64",
"ChassisType": "Other",
"City": "Chicago",
"ConfigBuild": "1007.3.0017312.1",
"ConfigIDBuild": "13922",
"Continent": "North America",
"Country": "United States of America",
"FalconGroupingTags": "'FalconGroupingTags/AMERICA'",
"FirstSeen": "1628678052.0",
"HostHiddenStatus": "Visible",
"MachineDomain": "groot.org",
"OU": "Servers;America;Offices",
"PointerSize": "8",
"ProductType": "3.0",
"ServicePackMajor": "0",
"SiteName": "BCL",
"SystemManufacturer": "Iris",
"SystemProductName": "IrOS",
"Time": "1697992719.22",
"Timezone": "America/Chicago",
"Version": "Windows Server 2021",
"cid": "ffffffff30a3407dae27d0503611022d",
"event_platform": "Win"
},
"user": {
"AccountType": "Domain User",
"LastLoggedOnHost": "COMPUTER1",
"LocalAdminAccess": "No",
"LogonInfo": "Domain User Logon",
"LogonTime": "1702546155.197",
"LogonType": "Interactive",
"PasswordLastSet": "1699971198.062",
"User": "DOMAIN\\BRADLEYA",
"UserIsAdmin": "0",
"UserLogonFlags_decimal": "0",
"_time": "1702546168.576",
"cid": "ffffffff15754bcfb5f9152ec7ac90ac",
"event_platform": "Win",
"monthsincereset": "1.0"
}
},
"name": "ProcessRollup2V18"
},
"data_stream": {
"dataset": "crowdstrike.fdr",
"namespace": "ep",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "8e3dcae6-8d1c-46c1-bed0-bf69fdde05e5",
"snapshot": false,
"version": "8.11.1"
},
"event": {
"action": "ProcessRollup2",
"agent_id_status": "verified",
"category": [
"process"
],
"created": "2020-10-01T09:58:32.519Z",
"dataset": "crowdstrike.fdr",
"id": "ffffffff-1111-11eb-8462-02ade3b2f949",
"ingested": "2023-12-19T11:18:43Z",
"kind": "event",
"original": "{\"AuthenticationId\":\"3783389\",\"CommandLine\":\"\\\"C:\\\\\WINDOWS\\\\\system32\\\\\backgroundTaskHost.exe\\\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca\",\"ConfigBuild\":\"1007.3.0012309.1\",\"ConfigStateHash\":\"3998263252\",\"EffectiveTransmissionClass\":\"3\",\"Entitlements\":\"15\",\"ImageFileName\":\"\\\\\Device\\\\\HarddiskVolume3\\\\\Windows\\\\\System32\\\\\backgroundTaskHost.exe\",\"ImageSubsystem\":\"2\",\"IntegrityLevel\":\"4096\",\"MD5HashData\":\"50d5fd1290d94d46acca0585311e74d5\",\"ParentAuthenticationId\":\"3783389\",\"ParentBaseFileName\":\"svchost.exe\",\"ParentProcessId\":\"2439558094566\",\"ProcessCreateFlags\":\"525332\",\"ProcessEndTime\":\"\",\"ProcessParameterFlags\":\"16385\",\"ProcessStartTime\":\"1604855181.648\",\"ProcessSxsFlags\":\"1600\",\"RawProcessId\":\"22272\",\"RpcClientProcessId\":\"2439558094566\",\"SHA1HashData\":\"0000000000000000000000000000000000000000\",\"SHA256HashData\":\"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37\",\"SessionId\":\"1\",\"SourceProcessId\":\"2439558094566\",\"SourceThreadId\":\"77538684027214\",\"Tags\":\"41, 12094627905582, 12094627906234\",\"TargetProcessId\":\"2450046082233\",\"TokenType\":\"2\",\"UserSid\":\"S-1-12-1-3697283754-1083485977-2164330645-2516515886\",\"WindowFlags\":\"128\",\"aid\":\"ffffffff655344736aca58d17fb570f0\",\"aip\":\"67.43.156.14\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"ProcessRollup2\",\"id\":\"ffffffff-1111-11eb-8462-02ade3b2f949\",\"name\":\"ProcessRollup2V18\",\"timestamp\":\"1601546312519\"}",
"outcome": "success",
"timezone": "+00:00",
"type": [
"start"
]
},
"host": {
"ip": [
"16.15.12.10"
],
"name": "FEVWSN1-234",
"os": {
"type": "windows"
}
},
"input": {
"type": "aws-s3"
},
"log": {
"file": {
"path": "https://elastic-package-crowdstrike-fdr-12701.s3.us-east-1.amazonaws.com/data"
},
"offset": 107991
},
"observer": {
"address": [
"67.43.156.14"
],
"geo": {
"continent_name": "Asia",
"country_iso_code": "BT",
"country_name": "Bhutan",
"location": {
"lat": 27.5,
"lon": 90.5
}
},
"ip": [
"67.43.156.14"
],
"serial_number": "ffffffff655344736aca58d17fb570f0",
"type": "agent",
"vendor": "crowdstrike",
"version": "1007.3.0012309.1"
},
"process": {
"args": [
"C:\\WINDOWS\\system32\\backgroundTaskHost.exe",
"-ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca"
],
"args_count": 2,
"command_line": "\"C:\\WINDOWS\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXnme9zjyebb2xnyygh6q9ev6p5d234br2.mca",
"entity_id": "2450046082233",
"executable": "\\Device\\HarddiskVolume3\\Windows\\System32\\backgroundTaskHost.exe",
"hash": {
"md5": "50d5fd1290d94d46acca0585311e74d5",
"sha256": "b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37"
},
"name": "backgroundTaskHost.exe",
"parent": {
"entity_id": "2439558094566",
"name": "svchost.exe"
},
"pid": 22272,
"start": "2020-11-08T17:06:21.648Z"
},
"related": {
"hash": [
"50d5fd1290d94d46acca0585311e74d5",
"b8e176fe76a1454a00c4af0f8bf8870650d9c33d3e333239a59445c5b35c9a37",
"3998263252"
],
"hosts": [
"FEVWSN1-234",
"COMPUTER1"
],
"ip": [
"67.43.156.14",
"16.15.12.10"
],
"user": [
"Alan-One",
"DOMAIN\\BRADLEYA"
]
},
"tags": [
"preserve_original_event",
"forwarded",
"crowdstrike-fdr"
],
"url": {
"scheme": "http"
},
"user": {
"id": "S-1-12-1-3697283754-1083485977-2164330645-2516515886",
"name": "Alan-One"
}
}
Host
editThis is the Host dataset.
Example
An example event for host looks as following:
{
"@timestamp": "2023-11-07T10:26:53.000Z",
"agent": {
"ephemeral_id": "0a68d2e5-292d-47a5-9b2f-3b34992483c2",
"id": "8f7b87ad-2943-4c25-88be-4eaac013beb6",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.13.0"
},
"crowdstrike": {
"host": {
"agent": {
"load_flags": "0",
"local_time": "2023-11-07T04:51:16.678Z",
"version": "7.05.17603.0"
},
"bios": {
"manufacturer": "ABCInc.",
"version": "2020.0.1.0.0(iBridge:22.11.000.0.0,0)"
},
"chassis_type": {
"desc": "Laptop",
"value": "9"
},
"cid": "92012896127c4948236ba7601b886b0",
"config_id": {
"base": "6594763",
"build": "1703",
"platform": "4"
},
"connection_ip": "81.2.69.192",
"cpu_signature": "460517",
"device_policies": {
"device_control": {
"applied": true,
"applied_date": "2023-06-20T08:45:26.341Z",
"assigned_date": "2023-06-20T08:43:47.736Z",
"policy_id": "2f88daf0177f467dae69262a5ce71775",
"policy_type": "device-control"
},
"firewall": {
"applied": true,
"applied_date": "2023-09-11T10:33:44.174Z",
"assigned_date": "2023-09-11T10:32:47.853Z",
"policy": {
"id": "1ee301f7e3e24e96ad6a23c73aaac1e3",
"type": "firewall"
},
"rule_set_id": "1ee301f7e3e24e96ad6a23c73aaac1e3"
},
"global_config": {
"applied": true,
"applied_date": "2023-11-07T04:52:59.515Z",
"assigned_date": "2023-11-07T04:51:18.946Z",
"policy": {
"id": "7e3078b60976486cac5dc998808d9135",
"type": "globalconfig"
},
"settings_hash": "f01def74"
},
"prevention": {
"applied": true,
"applied_date": "2023-06-08T10:04:47.643Z",
"assigned_date": "2023-06-08T10:03:49.505Z",
"policy": {
"id": "1024fac1b279424fa7300b8ac2d56be5",
"type": "prevention"
},
"settings_hash": "f7a54ca1"
},
"remote_response": {
"applied": true,
"applied_date": "2023-06-08T10:04:47.017Z",
"assigned_date": "2023-06-08T10:03:49.505Z",
"policy": {
"id": "dabb4def99034f11b9b3d52271584c9f",
"type": "remote-response"
},
"settings_hash": "8a548e5e"
},
"sensor_update": {
"applied": true,
"applied_date": "2023-11-07T04:52:59.659Z",
"assigned_date": "2023-11-07T04:47:43.342Z",
"policy": {
"id": "64bfa2bbcd4e46da92a66b107933da11",
"type": "sensor-update"
},
"settings_hash": "tagged|18;101",
"uninstall_protection": "ENABLED"
}
},
"external_ip": "81.2.69.192",
"first_seen": "2023-06-08T10:00:19.000Z",
"group_hash": "b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77",
"groups": [
"182388a8dbea4c44b5e019cfd32c2695"
],
"hostname": "CLM101-131.local",
"id": "3114433dbce478ca48d9a828b9b34be",
"kernel_version": "22.6.0",
"last_seen": "2023-11-07T10:25:24.000Z",
"local_ip": "81.2.69.142",
"mac_address": "14-7D-DA-AD-AC-71",
"machine_domain": "SYS",
"major_version": "22",
"meta": {
"version": "6002",
"version_string": "7:43570272778"
},
"minor_version": "6",
"modified_timestamp": "2023-11-07T10:26:53.000Z",
"os": {
"build": "22G120",
"version": "Ventura(13)"
},
"platform": {
"id": "1",
"name": "Mac"
},
"policies": [
{
"applied": true,
"applied_date": "2023-06-08T10:04:47.643Z",
"assigned_date": "2023-06-08T10:03:49.505Z",
"policy": {
"id": "1024fac1b279424fa7300b8ac2d56be5",
"type": "prevention"
},
"settings_hash": "f7a54ca1"
}
],
"product_type_desc": "Workstation",
"provision_status": "Provisioned",
"reduced_functionality_mode": "no",
"serial_number": "FVFDH73HMNHX",
"site_name": "Default-First-Site-Name",
"status": "normal",
"system": {
"manufacturer": "ABCInc.",
"product_name": "Air,1"
},
"tags": [
"tags"
]
}
},
"data_stream": {
"dataset": "crowdstrike.host",
"namespace": "42315",
"type": "logs"
},
"device": {
"id": "3114433dbce478ca48d9a828b9b34be"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "8f7b87ad-2943-4c25-88be-4eaac013beb6",
"snapshot": false,
"version": "8.13.0"
},
"event": {
"agent_id_status": "verified",
"category": [
"host"
],
"dataset": "crowdstrike.host",
"ingested": "2024-08-08T07:14:40Z",
"kind": "event",
"original": "{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-11-07T04:51:16.678Z\",\"agent_version\":\"7.05.17603.0\",\"bios_manufacturer\":\"ABCInc.\",\"bios_version\":\"2020.0.1.0.0(iBridge:22.11.000.0.0,0)\",\"chassis_type\":\"9\",\"chassis_type_desc\":\"Laptop\",\"cid\":\"92012896127c4948236ba7601b886b0\",\"config_id_base\":\"6594763\",\"config_id_build\":\"1703\",\"config_id_platform\":\"4\",\"connection_ip\":\"81.2.69.192\",\"cpu_signature\":\"460517\",\"device_id\":\"3114433dbce478ca48d9a828b9b34be\",\"device_policies\":{\"device_control\":{\"applied\":true,\"applied_date\":\"2023-06-20T08:45:26.341093915Z\",\"assigned_date\":\"2023-06-20T08:43:47.736146738Z\",\"policy_id\":\"2f88daf0177f467dae69262a5ce71775\",\"policy_type\":\"device-control\"},\"firewall\":{\"applied\":true,\"applied_date\":\"2023-09-11T10:33:44.174488832Z\",\"assigned_date\":\"2023-09-11T10:32:47.853976945Z\",\"policy_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\",\"policy_type\":\"firewall\",\"rule_set_id\":\"1ee301f7e3e24e96ad6a23c73aaac1e3\"},\"global_config\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.515775409Z\",\"assigned_date\":\"2023-11-07T04:51:18.94671252Z\",\"policy_id\":\"7e3078b60976486cac5dc998808d9135\",\"policy_type\":\"globalconfig\",\"settings_hash\":\"f01def74\"},\"prevention\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"},\"remote_response\":{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.01735027Z\",\"assigned_date\":\"2023-06-08T10:03:49.505163572Z\",\"policy_id\":\"dabb4def99034f11b9b3d52271584c9f\",\"policy_type\":\"remote-response\",\"settings_hash\":\"8a548e5e\"},\"sensor_update\":{\"applied\":true,\"applied_date\":\"2023-11-07T04:52:59.659583066Z\",\"assigned_date\":\"2023-11-07T04:47:43.342175341Z\",\"policy_id\":\"64bfa2bbcd4e46da92a66b107933da11\",\"policy_type\":\"sensor-update\",\"settings_hash\":\"tagged|18;101\",\"uninstall_protection\":\"ENABLED\"}},\"external_ip\":\"81.2.69.192\",\"first_seen\":\"2023-06-08T10:00:19Z\",\"group_hash\":\"b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77\",\"groups\":[\"182388a8dbea4c44b5e019cfd32c2695\"],\"hostname\":\"CLM101-131.local\",\"kernel_version\":\"22.6.0\",\"last_seen\":\"2023-11-07T10:25:24Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"14-7d-da-ad-ac-71\",\"machine_domain\":\"SYS\",\"major_version\":\"22\",\"meta\":{\"version\":\"6002\",\"version_string\":\"7:43570272778\"},\"minor_version\":\"6\",\"modified_timestamp\":\"2023-11-07T10:26:53Z\",\"os_build\":\"22G120\",\"os_version\":\"Ventura(13)\",\"platform_id\":\"1\",\"platform_name\":\"Mac\",\"policies\":[{\"applied\":true,\"applied_date\":\"2023-06-08T10:04:47.643357971Z\",\"assigned_date\":\"2023-06-08T10:03:49.505180252Z\",\"policy_id\":\"1024fac1b279424fa7300b8ac2d56be5\",\"policy_type\":\"prevention\",\"rule_groups\":[],\"settings_hash\":\"f7a54ca1\"}],\"product_type_desc\":\"Workstation\",\"provision_status\":\"Provisioned\",\"reduced_functionality_mode\":\"no\",\"serial_number\":\"FVFDH73HMNHX\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"ABCInc.\",\"system_product_name\":\"Air,1\",\"tags\":[\"tags\"]}",
"type": [
"info"
]
},
"host": {
"geo": {
"city_name": "London",
"continent_name": "Europe",
"country_iso_code": "GB",
"country_name": "United Kingdom",
"location": {
"lat": 51.5142,
"lon": -0.0931
},
"region_iso_code": "GB-ENG",
"region_name": "England"
},
"hostname": "CLM101-131.local",
"ip": [
"81.2.69.192"
],
"mac": [
"14-7D-DA-AD-AC-71"
],
"os": {
"full": "Ventura(13)",
"platform": "Mac"
}
},
"input": {
"type": "cel"
},
"related": {
"hash": [
"f01def74",
"f7a54ca1",
"8a548e5e",
"tagged|18;101",
"b607fe25348a46d421ff46e19741b0caf5bbc70bb6da1637f56e97b4e1454d77"
],
"hosts": [
"CLM101-131.local",
"SYS"
],
"ip": [
"81.2.69.192",
"81.2.69.142"
]
},
"tags": [
"preserve_original_event",
"preserve_duplicate_custom_fields",
"forwarded",
"crowdstrike-host"
]
}
Exported fields
| Field | Description | Type |
|---|---|---|
@timestamp |
Event timestamp. |
date |
crowdstrike.host.agent.load_flags |
Any errors associated with the incident. |
keyword |
crowdstrike.host.agent.local_time |
The fine score associated with the incident. |
date |
crowdstrike.host.agent.version |
The list of host IDs associated with the incident. |
keyword |
crowdstrike.host.bios.manufacturer |
Flags indicating the load status of the agent on the host. |
keyword |
crowdstrike.host.bios.version |
The local time on the host where the agent is running. |
keyword |
crowdstrike.host.chassis_type.desc |
The version of the agent running on the host. |
keyword |
crowdstrike.host.chassis_type.value |
The manufacturer of the BIOS on the host. |
keyword |
crowdstrike.host.cid |
The version of the BIOS on the host. |
keyword |
crowdstrike.host.config_id.base |
The customer ID associated with the host. |
keyword |
crowdstrike.host.config_id.build |
The base configuration ID associated with the host. |
keyword |
crowdstrike.host.config_id.platform |
The build configuration ID associated with the host. |
keyword |
crowdstrike.host.connection_ip |
The platform configuration ID associated with the host. |
ip |
crowdstrike.host.cpu_signature |
The device ID associated with the host. |
keyword |
crowdstrike.host.device_policies.device_control.applied |
Timestamp indicating when the host was first seen. |
boolean |
crowdstrike.host.device_policies.device_control.applied_date |
The groups associated with the host. |
date |
crowdstrike.host.device_policies.device_control.assigned_date |
Timestamp indicating when the host was last seen. |
date |
crowdstrike.host.device_policies.device_control.policy_id |
The local IP address of the host. |
keyword |
crowdstrike.host.device_policies.device_control.policy_type |
The domain to which the machine belongs. |
keyword |
crowdstrike.host.device_policies.firewall.applied |
The major version of the operating system on the host. |
boolean |
crowdstrike.host.device_policies.firewall.applied_date |
The minor version of the operating system on the host. |
date |
crowdstrike.host.device_policies.firewall.assigned_date |
Timestamp indicating when the host information was last modified. |
date |
crowdstrike.host.device_policies.firewall.policy.id |
The organizational units associated with the host. |
keyword |
crowdstrike.host.device_policies.firewall.policy.type |
The platform ID of the host. |
keyword |
crowdstrike.host.device_policies.firewall.rule_set_id |
The platform name of the host. |
keyword |
crowdstrike.host.device_policies.global_config.applied |
The description of the product type of the host. |
boolean |
crowdstrike.host.device_policies.global_config.applied_date |
The product type of the host. |
date |
crowdstrike.host.device_policies.global_config.assigned_date |
The site name associated with the host. |
date |
crowdstrike.host.device_policies.global_config.policy.id |
The status of the host. |
keyword |
crowdstrike.host.device_policies.global_config.policy.type |
The manufacturer of the system on the host. |
keyword |
crowdstrike.host.device_policies.global_config.settings_hash |
The product name of the system on the host. |
keyword |
crowdstrike.host.device_policies.prevention.applied |
The objectives associated with the incident. |
boolean |
crowdstrike.host.device_policies.prevention.applied_date |
The state of the incident, whether open or closed. |
date |
crowdstrike.host.device_policies.prevention.assigned_date |
The status of the incident. |
date |
crowdstrike.host.device_policies.prevention.policy.id |
The tactics associated with the incident. |
keyword |
crowdstrike.host.device_policies.prevention.policy.type |
The techniques associated with the incident. |
keyword |
crowdstrike.host.device_policies.prevention.rule_groups |
The type of incident. |
keyword |
crowdstrike.host.device_policies.prevention.settings_hash |
The users associated with the incident. |
keyword |
crowdstrike.host.device_policies.remote_response.applied |
boolean |
|
crowdstrike.host.device_policies.remote_response.applied_date |
date |
|
crowdstrike.host.device_policies.remote_response.assigned_date |
date |
|
crowdstrike.host.device_policies.remote_response.policy.id |
keyword |
|
crowdstrike.host.device_policies.remote_response.policy.type |
keyword |
|
crowdstrike.host.device_policies.remote_response.settings_hash |
keyword |
|
crowdstrike.host.device_policies.sensor_update.applied |
boolean |
|
crowdstrike.host.device_policies.sensor_update.applied_date |
date |
|
crowdstrike.host.device_policies.sensor_update.assigned_date |
date |
|
crowdstrike.host.device_policies.sensor_update.policy.id |
keyword |
|
crowdstrike.host.device_policies.sensor_update.policy.type |
keyword |
|
crowdstrike.host.device_policies.sensor_update.settings_hash |
keyword |
|
crowdstrike.host.device_policies.sensor_update.uninstall_protection |
keyword |
|
crowdstrike.host.external_ip |
The external IP address of the host. |
ip |
crowdstrike.host.first_seen |
date |
|
crowdstrike.host.group_hash |
keyword |
|
crowdstrike.host.groups |
keyword |
|
crowdstrike.host.hostname |
The hostname of the host. |
keyword |
crowdstrike.host.id |
Timestamp indicating when the incident started. |
keyword |
crowdstrike.host.kernel_version |
keyword |
|
crowdstrike.host.last_seen |
date |
|
crowdstrike.host.local_ip |
ip |
|
crowdstrike.host.mac_address |
The MAC address of the host. |
keyword |
crowdstrike.host.machine_domain |
keyword |
|
crowdstrike.host.major_version |
keyword |
|
crowdstrike.host.meta.version |
keyword |
|
crowdstrike.host.meta.version_string |
keyword |
|
crowdstrike.host.minor_version |
keyword |
|
crowdstrike.host.modified_timestamp |
Timestamp indicating when the incident was created. |
date |
crowdstrike.host.os.build |
keyword |
|
crowdstrike.host.os.version |
The version of the operating system on the host. |
keyword |
crowdstrike.host.platform.id |
keyword |
|
crowdstrike.host.platform.name |
The identifier associated with the customer. |
keyword |
crowdstrike.host.policies.applied |
boolean |
|
crowdstrike.host.policies.applied_date |
date |
|
crowdstrike.host.policies.assigned_date |
date |
|
crowdstrike.host.policies.policy.id |
keyword |
|
crowdstrike.host.policies.policy.type |
keyword |
|
crowdstrike.host.policies.rule_groups |
keyword |
|
crowdstrike.host.policies.settings_hash |
keyword |
|
crowdstrike.host.product_type_desc |
keyword |
|
crowdstrike.host.provision_status |
keyword |
|
crowdstrike.host.reduced_functionality_mode |
keyword |
|
crowdstrike.host.serial_number |
keyword |
|
crowdstrike.host.site_name |
keyword |
|
crowdstrike.host.status |
keyword |
|
crowdstrike.host.system.manufacturer |
keyword |
|
crowdstrike.host.system.product_name |
keyword |
|
crowdstrike.host.tags |
keyword |
|
data_stream.dataset |
Data stream dataset. |
constant_keyword |
data_stream.namespace |
Data stream namespace. |
constant_keyword |
data_stream.type |
Data stream type. |
constant_keyword |
event.dataset |
Event dataset. |
constant_keyword |
event.module |
Event module. |
constant_keyword |
input.type |
Type of filebeat input. |
keyword |
log.offset |
Log offset. |
long |
tags |
List of keywords used to tag each event. |
keyword |
Changelog
editChangelog
| Version | Details | Kibana version(s) |
|---|---|---|
1.49.0 |
Enhancement (View pull request) |
8.16.0 or higher |
1.48.0 |
Enhancement (View pull request) |
8.16.0 or higher |
1.47.0 |
Enhancement (View pull request) |
8.16.0 or higher |
1.46.0 |
Enhancement (View pull request) Bug fix (View pull request) |
8.13.0 or higher |
1.45.1 |
Bug fix (View pull request) Bug fix (View pull request) Bug fix (View pull request) Bug fix (View pull request) |
8.13.0 or higher |
1.45.0 |
Enhancement (View pull request) |
8.13.0 or higher |
1.44.0 |
Enhancement (View pull request) |
8.13.0 or higher |
1.43.0 |
Enhancement (View pull request) |
8.13.0 or higher |
1.42.2 |
Bug fix (View pull request) |
8.13.0 or higher |
1.42.1 |
Bug fix (View pull request) |
8.13.0 or higher |
1.42.0 |
Enhancement (View pull request) |
8.13.0 or higher |
1.41.1 |
Bug fix (View pull request) |
8.13.0 or higher |
1.41.0 |
Enhancement (View pull request) |
8.13.0 or higher |
1.40.1 |
Bug fix (View pull request) Bug fix (View pull request) |
8.13.0 or higher |
1.40.0 |
Enhancement (View pull request) |
8.13.0 or higher |
1.39.3 |
Bug fix (View pull request) |
8.13.0 or higher |
1.39.2 |
Bug fix (View pull request) |
8.13.0 or higher |
1.39.1 |
Bug fix (View pull request) |
8.13.0 or higher |
1.39.0 |
Enhancement (View pull request) |
8.13.0 or higher |
1.38.0 |
Enhancement (View pull request) |
8.13.0 or higher |
1.37.1 |
Bug fix (View pull request) |
8.13.0 or higher |
1.37.0 |
Enhancement (View pull request) |
8.13.0 or higher |
1.36.0 |
Enhancement (View pull request) |
8.12.0 or higher |
1.35.0 |
Enhancement (View pull request) |
8.12.0 or higher |
1.34.3 |
Bug fix (View pull request) |
8.12.0 or higher |
1.34.2 |
Bug fix (View pull request) |
8.12.0 or higher |
1.34.1 |
Bug fix (View pull request) |
8.12.0 or higher |
1.34.0 |
Enhancement (View pull request) |
8.12.0 or higher |
1.33.0 |
Enhancement (View pull request) |
8.12.0 or higher |
1.32.2 |
Bug fix (View pull request) |
8.12.0 or higher |
1.32.1 |
Bug fix (View pull request) |
8.12.0 or higher |
1.32.0 |
Enhancement (View pull request) |
8.12.0 or higher |
1.31.0 |
Enhancement (View pull request) |
8.12.0 or higher |
1.30.0 |
Enhancement (View pull request) |
8.12.0 or higher |
1.29.0 |
Enhancement (View pull request) |
8.11.0 or higher |
1.28.3 |
Bug fix (View pull request) |
8.11.0 or higher |
1.28.2 |
Bug fix (View pull request) |
8.11.0 or higher |
1.28.1 |
Enhancement (View pull request) |
8.11.0 or higher |
1.28.0 |
Enhancement (View pull request) Enhancement (View pull request) |
8.11.0 or higher |
1.27.0 |
Enhancement (View pull request) |
8.11.0 or higher |
1.26.2 |
Bug fix (View pull request) |
8.11.0 or higher |
1.26.1 |
Bug fix (View pull request) |
8.11.0 or higher |
1.26.0 |
Enhancement (View pull request) |
8.11.0 or higher |
1.25.1 |
Enhancement (View pull request) |
8.7.1 or higher |
1.25.0 |
Enhancement (View pull request) |
8.7.1 or higher |
1.24.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.23.1 |
Bug fix (View pull request) |
8.0.0 or higher |
1.23.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.22.1 |
Bug fix (View pull request) |
8.0.0 or higher |
1.22.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.21.0 |
Bug fix (View pull request) |
8.0.0 or higher |
1.20.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.19.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.18.3 |
Bug fix (View pull request) |
8.0.0 or higher |
1.18.2 |
Bug fix (View pull request) |
8.0.0 or higher |
1.18.1 |
Bug fix (View pull request) |
8.0.0 or higher |
1.18.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.17.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.16.1 |
Bug fix (View pull request) |
8.0.0 or higher |
1.16.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.15.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.14.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.13.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.12.1 |
Bug fix (View pull request) |
8.0.0 or higher |
1.12.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.11.2 |
Bug fix (View pull request) |
8.0.0 or higher |
1.11.1 |
Bug fix (View pull request) |
8.0.0 or higher |
1.11.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.10.2 |
Bug fix (View pull request) |
8.0.0 or higher |
1.10.1 |
Enhancement (View pull request) |
8.0.0 or higher |
1.10.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.9.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.8.2 |
Bug fix (View pull request) |
8.0.0 or higher |
1.8.1 |
Bug fix (View pull request) |
8.0.0 or higher |
1.8.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.7.0 |
Enhancement (View pull request) |
8.0.0 or higher |
1.6.1 |
Enhancement (View pull request) |
7.17.0 or higher |
1.6.0 |
Enhancement (View pull request) |
7.17.0 or higher |
1.5.1 |
Bug fix (View pull request) |
7.17.0 or higher |
1.5.0 |
Enhancement (View pull request) |
7.17.0 or higher |
1.4.2 |
Bug fix (View pull request) |
7.17.0 or higher |
1.4.1 |
Enhancement (View pull request) |
7.17.0 or higher |
1.4.0 |
Enhancement (View pull request) |
7.17.0 or higher |
1.3.4 |
Bug fix (View pull request) |
7.17.0 or higher |
1.3.3 |
Bug fix (View pull request) |
7.17.0 or higher |
1.3.2 |
Bug fix (View pull request) |
7.16.0 or higher |
1.3.1 |
Enhancement (View pull request) |
7.16.0 or higher |
1.3.0 |
Enhancement (View pull request) |
— |
1.2.7 |
Enhancement (View pull request) |
7.16.0 or higher |
1.2.6 |
Enhancement (View pull request) |
7.16.0 or higher |
1.2.5 |
Bug fix (View pull request) |
7.16.0 or higher |
1.2.4 |
Bug fix (View pull request) |
— |
1.2.3 |
Bug fix (View pull request) |
7.16.0 or higher |
1.2.2 |
Bug fix (View pull request) |
7.16.0 or higher |
1.2.1 |
Bug fix (View pull request) |
7.16.0 or higher |
1.2.0 |
Enhancement (View pull request) |
— |
1.1.2 |
Bug fix (View pull request) |
7.16.0 or higher |
1.1.1 |
Bug fix (View pull request) |
— |
1.1.0 |
Enhancement (View pull request) |
7.16.0 or higher |
1.0.4 |
Bug fix (View pull request) Bug fix (View pull request) |
7.16.0 or higher |
1.0.3 |
Enhancement (View pull request) |
7.16.0 or higher |
1.0.2 |
Enhancement (View pull request) |
7.16.0 or higher |
1.0.1 |
Bug fix (View pull request) |
— |
1.0.0 |
Enhancement (View pull request) |
— |
0.9.0 |
Enhancement (View pull request) |
— |
0.8.1 |
Enhancement (View pull request) |
— |
0.8.0 |
Enhancement (View pull request) Enhancement (View pull request) Enhancement (View pull request) |
— |
0.7.1 |
Enhancement (View pull request) |
— |
0.7.0 |
Enhancement (View pull request) |
— |
0.6.0 |
Enhancement (View pull request) |
— |
0.5.0 |
Enhancement (View pull request) |
— |
0.4.1 |
Enhancement (View pull request) |
— |
0.4.0 |
Enhancement (View pull request) |
— |
0.3.1 |
Bug fix (View pull request) |
— |
0.1.0 |
Enhancement (View pull request) |
— |