Support Sysmon EventIDs 8,9,19,20,27,28,255 (#5511)

- EventID 8: CreateRemoteThread[1] | Sample Event[2] - EventID 9: RawAccessRead[3] | Sample Event[4] - EventID 19: WmiEventFilter activity detected[5] | Sample Event[6] - EventID 20: WmiEventConsumeractivity detected[7] | Sample Event[8] - EventID 27: FileBlockExecutable[9] - EventID 28: FileBlockShredding[10] - EventID 255: Error[11] [1]https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-8-createremotethread [2]https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90008 [3]https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-9-rawaccessread [4]https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90009 [5]https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected [6]https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90019 [7]https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected [8]https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90020 [9]https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-27-fileblockexecutable [10]https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-28-fileblockshredding [11]https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-255-error
elastic · Mar 14, 2023 · 4556514 · 4556514
1 parent 3fb1e14
commit 4556514
Show file tree

Hide file tree

Showing 7 changed files with 873 additions and 1 deletion.
diff --git a/packages/windows/changelog.yml b/packages/windows/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.19.0"
+  changes:
+    - description: Support Sysmon EventIDs - 8, 9, 19, 20, 27, 28, 255
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/5511
 - version: "1.18.0"
   changes:
     - description: Fix mapping/pipelines for winlog.time_created

diff --git a/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json b/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json
diff --git a/.../windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json-expected.json b/.../windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json-expected.json
diff --git a/packages/windows/data_stream/sysmon_operational/elasticsearch/ingest_pipeline/default.yml b/packages/windows/data_stream/sysmon_operational/elasticsearch/ingest_pipeline/default.yml
@@ -1226,6 +1226,13 @@ processors:
           ];
         }
 
+
+## Conformity
+  - rename:
+      field: winlog.event_data.TargetProcessGuid
+      target_field: winlog.event_data.TargetProcessGUID
+      if: ctx.winlog?.event_data?.TargetProcessGuid != null
+
 ## Cleanup
 
   - remove:

diff --git a/packages/windows/data_stream/sysmon_operational/fields/winlog.yml b/packages/windows/data_stream/sysmon_operational/fields/winlog.yml
@@ -87,6 +87,8 @@
           type: keyword
         - name: EventType
           type: keyword
+        - name: EventNamespace
+          type: keyword
         - name: ExtraInfo
           type: keyword
         - name: FailureName
@@ -143,12 +145,16 @@
           type: keyword
         - name: MinorVersion
           type: keyword
+        - name: Name
+          type: keyword
         - name: NewProcessId
           type: keyword
         - name: NewProcessName
           type: keyword
         - name: NewSchemeGuid
           type: keyword
+        - name: NewThreadId
+          type: keyword
         - name: NewTime
           type: keyword
         - name: NominalFrequency
@@ -159,6 +165,8 @@
           type: keyword
         - name: OldTime
           type: keyword
+        - name: Operation
+          type: keyword
         - name: OriginalFileName
           type: keyword
         - name: Path
@@ -187,6 +195,8 @@
           type: keyword
         - name: QfeVersion
           type: keyword
+        - name: Query
+          type: keyword
         - name: Reason
           type: keyword
         - name: SchemaVersion
@@ -211,6 +221,12 @@
           type: keyword
         - name: Signed
           type: keyword
+        - name: StartAddress
+          type: keyword
+        - name: StartFunction
+          type: keyword
+        - name: StartModule
+          type: keyword
         - name: StartTime
           type: keyword
         - name: State

diff --git a/packages/windows/docs/README.md b/packages/windows/docs/README.md
@@ -1073,6 +1073,7 @@ An example event for `sysmon_operational` looks as following:
 | winlog.event_data.DriverNameLength |  | keyword |
 | winlog.event_data.DwordVal |  | keyword |
 | winlog.event_data.EntryCount |  | keyword |
+| winlog.event_data.EventNamespace |  | keyword |
 | winlog.event_data.EventType |  | keyword |
 | winlog.event_data.ExtraInfo |  | keyword |
 | winlog.event_data.FailureName |  | keyword |
@@ -1102,14 +1103,17 @@ An example event for `sysmon_operational` looks as following:
 | winlog.event_data.MinimumPerformancePercent |  | keyword |
 | winlog.event_data.MinimumThrottlePercent |  | keyword |
 | winlog.event_data.MinorVersion |  | keyword |
+| winlog.event_data.Name |  | keyword |
 | winlog.event_data.NewProcessId |  | keyword |
 | winlog.event_data.NewProcessName |  | keyword |
 | winlog.event_data.NewSchemeGuid |  | keyword |
+| winlog.event_data.NewThreadId |  | keyword |
 | winlog.event_data.NewTime |  | keyword |
 | winlog.event_data.NominalFrequency |  | keyword |
 | winlog.event_data.Number |  | keyword |
 | winlog.event_data.OldSchemeGuid |  | keyword |
 | winlog.event_data.OldTime |  | keyword |
+| winlog.event_data.Operation |  | keyword |
 | winlog.event_data.OriginalFileName |  | keyword |
 | winlog.event_data.Path |  | keyword |
 | winlog.event_data.PerformanceImplementation |  | keyword |
@@ -1124,6 +1128,7 @@ An example event for `sysmon_operational` looks as following:
 | winlog.event_data.PuaCount |  | keyword |
 | winlog.event_data.PuaPolicyId |  | keyword |
 | winlog.event_data.QfeVersion |  | keyword |
+| winlog.event_data.Query |  | keyword |
 | winlog.event_data.Reason |  | keyword |
 | winlog.event_data.SchemaVersion |  | keyword |
 | winlog.event_data.ScriptBlockText |  | keyword |
@@ -1136,6 +1141,9 @@ An example event for `sysmon_operational` looks as following:
 | winlog.event_data.Signature |  | keyword |
 | winlog.event_data.SignatureStatus |  | keyword |
 | winlog.event_data.Signed |  | keyword |
+| winlog.event_data.StartAddress |  | keyword |
+| winlog.event_data.StartFunction |  | keyword |
+| winlog.event_data.StartModule |  | keyword |
 | winlog.event_data.StartTime |  | keyword |
 | winlog.event_data.State |  | keyword |
 | winlog.event_data.Status |  | keyword |

diff --git a/packages/windows/manifest.yml b/packages/windows/manifest.yml
@@ -1,6 +1,6 @@
 name: windows
 title: Windows
-version: 1.18.0
+version: 1.19.0
 description: Collect logs and metrics from Windows OS and services with Elastic Agent.
 type: integration
 categories: