Skip to content

Commit 196fbb5

Browse files
andrewkrohandrewkroh
committed
Keep original sentinel_one.alert.info.event_type
Don't set event.type with the raw evenType value because it won't conform to ECS's allowed values. After we have real alert samples then this value can be used to inform the event.category and event.type values.
1 parent 9543b47 commit 196fbb5

5 files changed

Lines changed: 20 additions & 4 deletions

File tree

‎packages/sentinel_one/data_stream/alert/_dev/test/pipeline/test-pipeline-alert.log-expected.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@
3434
"id": "123456789123456789",
3535
"kind": "event",
3636
"original": "{\"targetProcessInfo\":{\"tgtFileCreatedAt\":\"2018-02-27T04:49:26.257525Z\",\"tgtFileIsSigned\":\"string\",\"tgtFileOldPath\":\"string\",\"tgtProcImagePath\":\"string\",\"tgtProcSignedStatus\":\"string\",\"tgtFileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"tgtProcStorylineId\":\"string\",\"tgtProcPid\":\"12345\",\"tgtProcCmdLine\":\"string\",\"tgtProcName\":\"string\",\"tgtFileModifiedAt\":\"2018-02-27T04:49:26.257525Z\",\"tgtFileId\":\"string\",\"tgtProcIntegrityLevel\":\"unknown\",\"tgtFileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"tgtProcUid\":\"string\",\"tgtProcessStartTime\":\"2018-02-27T04:49:26.257525Z\",\"tgtFilePath\":\"string\"},\"alertInfo\":{\"createdAt\":\"2018-02-27T04:49:26.257525Z\",\"srcIp\":\"0.0.0.0\",\"incidentStatus\":\"string\",\"registryOldValue\":\"string\",\"alertId\":\"123456789123456789\",\"dstPort\":\"1234\",\"indicatorName\":\"string\",\"registryPath\":\"string\",\"loginType\":\"string\",\"dstIp\":\"0.0.0.0\",\"updatedAt\":\"2018-02-27T04:49:26.257525Z\",\"indicatorDescription\":\"string\",\"loginsUserName\":\"string\",\"loginIsSuccessful\":\"string\",\"indicatorCategory\":\"string\",\"modulePath\":\"string\",\"loginAccountSid\":\"string\",\"dnsResponse\":\"string\",\"netEventDirection\":\"string\",\"registryValue\":\"string\",\"srcMachineIp\":\"0.0.0.0\",\"registryOldValueType\":\"string\",\"eventType\":\"string\",\"analystVerdict\":\"string\",\"dvEventId\":\"string\",\"dnsRequest\":\"string\",\"loginIsAdministratorEquivalent\":\"string\",\"loginAccountDomain\":\"string\",\"tiIndicatorType\":\"string\",\"moduleSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"source\":\"string\",\"srcPort\":\"string\",\"tiIndicatorValue\":\"string\",\"tiIndicatorSource\":\"string\",\"reportedAt\":\"2018-02-27T04:49:26.257525Z\",\"registryKeyPath\":\"string\",\"tiIndicatorComparisonMethod\":\"string\",\"hitType\":\"Events\"},\"sourceProcessInfo\":{\"integrityLevel\":\"unknown\",\"pid\":\"12345\",\"fileHashMd5\":\"5d41402abc4b2a76b9719d911017c592\",\"filePath\":\"string\",\"fileSignerIdentity\":\"string\",\"pidStarttime\":\"2018-02-27T04:49:26.257525Z\",\"storyline\":\"string\",\"fileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"uniqueId\":\"string\",\"user\":\"string\",\"commandline\":\"string\",\"name\":\"string\",\"fileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"subsystem\":\"unknown\"},\"ruleInfo\":{\"severity\":\"Low\",\"treatAsThreat\":\"UNDEFINED\",\"id\":\"string\",\"scopeLevel\":\"string\",\"name\":\"string\",\"description\":\"string\"},\"sourceParentProcessInfo\":{\"integrityLevel\":\"unknown\",\"pid\":\"12345\",\"fileHashMd5\":\"5d41402abc4b2a76b9719d911017c592\",\"filePath\":\"string\",\"fileSignerIdentity\":\"string\",\"pidStarttime\":\"2018-02-27T04:49:26.257525Z\",\"storyline\":\"string\",\"fileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"uniqueId\":\"string\",\"user\":\"string\",\"commandline\":\"string\",\"name\":\"string\",\"fileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"subsystem\":\"unknown\"},\"agentDetectionInfo\":{\"osFamily\":\"string\",\"uuid\":\"string\",\"osName\":\"string\",\"version\":\"3.x.x.x\",\"siteId\":\"123456789123456789\",\"name\":\"string\",\"machineType\":\"string\",\"osRevision\":\"string\"},\"kubernetesInfo\":{\"controllerName\":\"string\",\"node\":\"string\",\"namespace\":\"string\",\"namespaceLabels\":\"string\",\"pod\":\"string\",\"controllerLabels\":\"string\",\"controllerKind\":\"string\",\"cluster\":\"string\",\"podLabels\":\"string\"},\"containerInfo\":{\"id\":\"string\",\"name\":\"string\",\"image\":\"string\",\"labels\":\"string\"}}",
37-
"type": "string"
37+
"type": [
38+
"info"
39+
]
3840
},
3941
"file": {
4042
"created": "2018-02-27T04:49:26.257Z",
@@ -145,6 +147,7 @@
145147
"dns": {
146148
"response": "string"
147149
},
150+
"event_type": "string",
148151
"hit": {
149152
"type": "Events"
150153
},

‎packages/sentinel_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ processors:
1010
- set:
1111
field: event.category
1212
value: [malware]
13+
- set:
14+
field: event.type
15+
value: [info]
1316
- rename:
1417
field: message
1518
target_field: event.original
@@ -186,7 +189,7 @@ processors:
186189
ignore_missing: true
187190
- rename:
188191
field: json.alertInfo.eventType
189-
target_field: event.type
192+
target_field: sentinel_one.alert.info.event_type
190193
ignore_missing: true
191194
- rename:
192195
field: json.alertInfo.analystVerdict

‎packages/sentinel_one/data_stream/alert/fields/fields.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@
3434
- name: response
3535
type: keyword
3636
description: IP address, DNS, type, etc. in response.
37+
- name: event_type
38+
type: keyword
39+
description: Event type.
3740
- name: hit
3841
type: group
3942
fields:

‎packages/sentinel_one/data_stream/alert/sample_event.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,9 @@
5353
"ingested": "2022-05-09T12:54:52Z",
5454
"kind": "event",
5555
"original": "{\"agentDetectionInfo\":{\"machineType\":\"string\",\"name\":\"string\",\"osFamily\":\"string\",\"osName\":\"string\",\"osRevision\":\"string\",\"siteId\":\"123456789123456789\",\"uuid\":\"string\",\"version\":\"3.x.x.x\"},\"alertInfo\":{\"alertId\":\"123456789123456789\",\"analystVerdict\":\"string\",\"createdAt\":\"2018-02-27T04:49:26.257525Z\",\"dnsRequest\":\"string\",\"dnsResponse\":\"string\",\"dstIp\":\"0.0.0.0\",\"dstPort\":\"1234\",\"dvEventId\":\"string\",\"eventType\":\"string\",\"hitType\":\"Events\",\"incidentStatus\":\"string\",\"indicatorCategory\":\"string\",\"indicatorDescription\":\"string\",\"indicatorName\":\"string\",\"loginAccountDomain\":\"string\",\"loginAccountSid\":\"string\",\"loginIsAdministratorEquivalent\":\"string\",\"loginIsSuccessful\":\"string\",\"loginType\":\"string\",\"loginsUserName\":\"string\",\"modulePath\":\"string\",\"moduleSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"netEventDirection\":\"string\",\"registryKeyPath\":\"string\",\"registryOldValue\":\"string\",\"registryOldValueType\":\"string\",\"registryPath\":\"string\",\"registryValue\":\"string\",\"reportedAt\":\"2018-02-27T04:49:26.257525Z\",\"source\":\"string\",\"srcIp\":\"0.0.0.0\",\"srcMachineIp\":\"0.0.0.0\",\"srcPort\":\"string\",\"tiIndicatorComparisonMethod\":\"string\",\"tiIndicatorSource\":\"string\",\"tiIndicatorType\":\"string\",\"tiIndicatorValue\":\"string\",\"updatedAt\":\"2018-02-27T04:49:26.257525Z\"},\"containerInfo\":{\"id\":\"string\",\"image\":\"string\",\"labels\":\"string\",\"name\":\"string\"},\"kubernetesInfo\":{\"cluster\":\"string\",\"controllerKind\":\"string\",\"controllerLabels\":\"string\",\"controllerName\":\"string\",\"namespace\":\"string\",\"namespaceLabels\":\"string\",\"node\":\"string\",\"pod\":\"string\",\"podLabels\":\"string\"},\"ruleInfo\":{\"description\":\"string\",\"id\":\"string\",\"name\":\"string\",\"scopeLevel\":\"string\",\"severity\":\"Low\",\"treatAsThreat\":\"UNDEFINED\"},\"sourceParentProcessInfo\":{\"commandline\":\"string\",\"fileHashMd5\":\"5d41402abc4b2a76b9719d911017c592\",\"fileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"fileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"filePath\":\"string\",\"fileSignerIdentity\":\"string\",\"integrityLevel\":\"unknown\",\"name\":\"string\",\"pid\":\"12345\",\"pidStarttime\":\"2018-02-27T04:49:26.257525Z\",\"storyline\":\"string\",\"subsystem\":\"unknown\",\"uniqueId\":\"string\",\"user\":\"string\"},\"sourceProcessInfo\":{\"commandline\":\"string\",\"fileHashMd5\":\"5d41402abc4b2a76b9719d911017c592\",\"fileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"fileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"filePath\":\"string\",\"fileSignerIdentity\":\"string\",\"integrityLevel\":\"unknown\",\"name\":\"string\",\"pid\":\"12345\",\"pidStarttime\":\"2018-02-27T04:49:26.257525Z\",\"storyline\":\"string\",\"subsystem\":\"unknown\",\"uniqueId\":\"string\",\"user\":\"string\"},\"targetProcessInfo\":{\"tgtFileCreatedAt\":\"2018-02-27T04:49:26.257525Z\",\"tgtFileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"tgtFileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"tgtFileId\":\"string\",\"tgtFileIsSigned\":\"string\",\"tgtFileModifiedAt\":\"2018-02-27T04:49:26.257525Z\",\"tgtFileOldPath\":\"string\",\"tgtFilePath\":\"string\",\"tgtProcCmdLine\":\"string\",\"tgtProcImagePath\":\"string\",\"tgtProcIntegrityLevel\":\"unknown\",\"tgtProcName\":\"string\",\"tgtProcPid\":\"12345\",\"tgtProcSignedStatus\":\"string\",\"tgtProcStorylineId\":\"string\",\"tgtProcUid\":\"string\",\"tgtProcessStartTime\":\"2018-02-27T04:49:26.257525Z\"}}",
56-
"type": "string"
56+
"type": [
57+
"info"
58+
]
5759
},
5860
"file": {
5961
"created": "2018-02-27T04:49:26.257Z",
@@ -167,6 +169,7 @@
167169
"dns": {
168170
"response": "string"
169171
},
172+
"event_type": "string",
170173
"hit": {
171174
"type": "Events"
172175
},

‎packages/sentinel_one/docs/README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -647,7 +647,9 @@ An example event for `alert` looks as following:
647647
"ingested": "2022-05-09T12:54:52Z",
648648
"kind": "event",
649649
"original": "{\"agentDetectionInfo\":{\"machineType\":\"string\",\"name\":\"string\",\"osFamily\":\"string\",\"osName\":\"string\",\"osRevision\":\"string\",\"siteId\":\"123456789123456789\",\"uuid\":\"string\",\"version\":\"3.x.x.x\"},\"alertInfo\":{\"alertId\":\"123456789123456789\",\"analystVerdict\":\"string\",\"createdAt\":\"2018-02-27T04:49:26.257525Z\",\"dnsRequest\":\"string\",\"dnsResponse\":\"string\",\"dstIp\":\"0.0.0.0\",\"dstPort\":\"1234\",\"dvEventId\":\"string\",\"eventType\":\"string\",\"hitType\":\"Events\",\"incidentStatus\":\"string\",\"indicatorCategory\":\"string\",\"indicatorDescription\":\"string\",\"indicatorName\":\"string\",\"loginAccountDomain\":\"string\",\"loginAccountSid\":\"string\",\"loginIsAdministratorEquivalent\":\"string\",\"loginIsSuccessful\":\"string\",\"loginType\":\"string\",\"loginsUserName\":\"string\",\"modulePath\":\"string\",\"moduleSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"netEventDirection\":\"string\",\"registryKeyPath\":\"string\",\"registryOldValue\":\"string\",\"registryOldValueType\":\"string\",\"registryPath\":\"string\",\"registryValue\":\"string\",\"reportedAt\":\"2018-02-27T04:49:26.257525Z\",\"source\":\"string\",\"srcIp\":\"0.0.0.0\",\"srcMachineIp\":\"0.0.0.0\",\"srcPort\":\"string\",\"tiIndicatorComparisonMethod\":\"string\",\"tiIndicatorSource\":\"string\",\"tiIndicatorType\":\"string\",\"tiIndicatorValue\":\"string\",\"updatedAt\":\"2018-02-27T04:49:26.257525Z\"},\"containerInfo\":{\"id\":\"string\",\"image\":\"string\",\"labels\":\"string\",\"name\":\"string\"},\"kubernetesInfo\":{\"cluster\":\"string\",\"controllerKind\":\"string\",\"controllerLabels\":\"string\",\"controllerName\":\"string\",\"namespace\":\"string\",\"namespaceLabels\":\"string\",\"node\":\"string\",\"pod\":\"string\",\"podLabels\":\"string\"},\"ruleInfo\":{\"description\":\"string\",\"id\":\"string\",\"name\":\"string\",\"scopeLevel\":\"string\",\"severity\":\"Low\",\"treatAsThreat\":\"UNDEFINED\"},\"sourceParentProcessInfo\":{\"commandline\":\"string\",\"fileHashMd5\":\"5d41402abc4b2a76b9719d911017c592\",\"fileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"fileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"filePath\":\"string\",\"fileSignerIdentity\":\"string\",\"integrityLevel\":\"unknown\",\"name\":\"string\",\"pid\":\"12345\",\"pidStarttime\":\"2018-02-27T04:49:26.257525Z\",\"storyline\":\"string\",\"subsystem\":\"unknown\",\"uniqueId\":\"string\",\"user\":\"string\"},\"sourceProcessInfo\":{\"commandline\":\"string\",\"fileHashMd5\":\"5d41402abc4b2a76b9719d911017c592\",\"fileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"fileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"filePath\":\"string\",\"fileSignerIdentity\":\"string\",\"integrityLevel\":\"unknown\",\"name\":\"string\",\"pid\":\"12345\",\"pidStarttime\":\"2018-02-27T04:49:26.257525Z\",\"storyline\":\"string\",\"subsystem\":\"unknown\",\"uniqueId\":\"string\",\"user\":\"string\"},\"targetProcessInfo\":{\"tgtFileCreatedAt\":\"2018-02-27T04:49:26.257525Z\",\"tgtFileHashSha1\":\"aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d\",\"tgtFileHashSha256\":\"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\",\"tgtFileId\":\"string\",\"tgtFileIsSigned\":\"string\",\"tgtFileModifiedAt\":\"2018-02-27T04:49:26.257525Z\",\"tgtFileOldPath\":\"string\",\"tgtFilePath\":\"string\",\"tgtProcCmdLine\":\"string\",\"tgtProcImagePath\":\"string\",\"tgtProcIntegrityLevel\":\"unknown\",\"tgtProcName\":\"string\",\"tgtProcPid\":\"12345\",\"tgtProcSignedStatus\":\"string\",\"tgtProcStorylineId\":\"string\",\"tgtProcUid\":\"string\",\"tgtProcessStartTime\":\"2018-02-27T04:49:26.257525Z\"}}",
650-
"type": "string"
650+
"type": [
651+
"info"
652+
]
651653
},
652654
"file": {
653655
"created": "2018-02-27T04:49:26.257Z",
@@ -761,6 +763,7 @@ An example event for `alert` looks as following:
761763
"dns": {
762764
"response": "string"
763765
},
766+
"event_type": "string",
764767
"hit": {
765768
"type": "Events"
766769
},
@@ -974,6 +977,7 @@ An example event for `alert` looks as following:
974977
| sentinel_one.alert.container.info.labels | Container info labels. | keyword |
975978
| sentinel_one.alert.dv_event.id | DV event id. | keyword |
976979
| sentinel_one.alert.info.dns.response | IP address, DNS, type, etc. in response. | keyword |
980+
| sentinel_one.alert.info.event_type | Event type. | keyword |
977981
| sentinel_one.alert.info.hit.type | Type of hit reported from agent. | keyword |
978982
| sentinel_one.alert.info.indicator.category | Indicator categories for this process. | keyword |
979983
| sentinel_one.alert.info.indicator.description | Indicator_description. | keyword |

0 commit comments

Comments
 (0)