Skip to content

Commit 30233b6

Browse files
AsuNa-jpmagermarkintxgo
authored
[8.19/9.1]Add Winlog fields for the ETW security events (#633)
* initial commit * add winlog fields * add sample_event.json * fix typo * custom documentations * add generated files * fix format of sample_event.json * add generated file * change custom documentation * add generated files * Delete custom_documentation/doc/endpoint/security/windows/windows_security_auditing_added_user_account.md * Delete custom_documentation/doc/endpoint/security/windows/windows_security_auditing_group_membership_enumerated.md * Delete custom_documentation/doc/endpoint/security/windows/windows_security_auditing_network_share_object_added.md * Delete custom_documentation/doc/endpoint/security/windows/windows_security_auditing_scheduled_task_created.md * Delete custom_documentation/doc/endpoint/security/windows/windows_security_auditing_scheduled_task_updated.md * Delete custom_documentation/doc/endpoint/security/windows/windows_security_auditing_service_installed.md * Delete custom_documentation/doc/endpoint/security/windows/windows_security_auditing_user_member_enumerated.md * Delete custom_documentation/doc/endpoint/security/windows/windows_security_auditing_vault_credentials_were_read.md * update malicious behavior alert custom documentation * add generated file * Update custom_schemas/custom_winlog.yml Co-authored-by: Leszek Kubik <39905449+intxgo@users.noreply.github.com> * Update wording * added genereated files * removed unnessesary fields for index * add generated files * adjust the sample_event.jspn * updated custom documentation * add generated file --------- Co-authored-by: Mark Mager <42077975+magermark@users.noreply.github.com> Co-authored-by: Leszek Kubik <39905449+intxgo@users.noreply.github.com> Co-authored-by: Mark Mager <mark.mager@elastic.co>
1 parent b7872a0 commit 30233b6

File tree

16 files changed

+1419
-3
lines changed

16 files changed

+1419
-3
lines changed

‎custom_documentation/doc/endpoint/alerts/windows/windows_malicious_behavior_alert.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,4 +119,5 @@ This alert occurs when a Malicious Behavior alert occurs.
119119
| user.name |
120120
| user.target.domain |
121121
| user.target.name |
122+
| winlog.*<br /><br />winlog contains information about the Windows Event Log. |
122123

‎custom_documentation/doc/endpoint/security/windows/windows_security_auditing_log_off.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Windows User Log Off
2+
3+
- OS: Windows
4+
- Data Stream: `logs-endpoint.events.security-*`
5+
- KQL: `event.action : "log_off" and event.dataset : "endpoint.events.security" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Security-Auditing" and host.os.type : "windows"`
6+
7+
This event is generated when a user logs off from the computer.
8+
9+
| Field |
10+
|---|
11+
| @timestamp |
12+
| Target.process.Ext.authentication_id |
13+
| agent.id |
14+
| agent.type |
15+
| agent.version |
16+
| data_stream.dataset |
17+
| data_stream.namespace |
18+
| data_stream.type |
19+
| ecs.version |
20+
| elastic.agent.id |
21+
| event.action |
22+
| event.category |
23+
| event.code |
24+
| event.created |
25+
| event.dataset |
26+
| event.id |
27+
| event.kind |
28+
| event.module |
29+
| event.outcome |
30+
| event.provider |
31+
| event.sequence |
32+
| event.type |
33+
| host.id |
34+
| host.name |
35+
| host.os.type |
36+
| message |
37+
| process.Ext.authentication_id |
38+
| process.Ext.code_signature.exists |
39+
| process.Ext.code_signature.status |
40+
| process.Ext.session_info.logon_type |
41+
| process.code_signature.exists |
42+
| process.code_signature.status |
43+
| user.effective.domain |
44+
| user.effective.id |
45+
| user.effective.name |
46+

‎custom_documentation/doc/endpoint/security/windows/windows_security_auditing_log_on.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# Windows User Log On
2+
3+
- OS: Windows
4+
- Data Stream: `logs-endpoint.events.security-*`
5+
- KQL: `event.action : "log_on" and event.dataset : "endpoint.events.security" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Security-Auditing" and host.os.type : "windows"`
6+
7+
This event is generated when a user logs on to the computer.
8+
9+
| Field |
10+
|---|
11+
| @timestamp |
12+
| Target.process.Ext.authentication_id |
13+
| agent.id |
14+
| agent.type |
15+
| agent.version |
16+
| data_stream.dataset |
17+
| data_stream.namespace |
18+
| data_stream.type |
19+
| ecs.version |
20+
| elastic.agent.id |
21+
| event.action |
22+
| event.category |
23+
| event.code |
24+
| event.created |
25+
| event.dataset |
26+
| event.id |
27+
| event.kind |
28+
| event.module |
29+
| event.outcome |
30+
| event.provider |
31+
| event.sequence |
32+
| event.type |
33+
| host.id |
34+
| host.name |
35+
| host.os.type |
36+
| message |
37+
| process.Ext.authentication_id |
38+
| process.Ext.code_signature.exists |
39+
| process.Ext.code_signature.status |
40+
| process.Ext.code_signature.subject_name |
41+
| process.Ext.code_signature.trusted |
42+
| process.Ext.protection |
43+
| process.Ext.session_info.authentication_package |
44+
| process.Ext.session_info.failure_reason |
45+
| process.Ext.session_info.logon_process_name |
46+
| process.Ext.session_info.logon_type |
47+
| process.Ext.token.elevation |
48+
| process.Ext.token.impersonation_level |
49+
| process.Ext.token.integrity_level_name |
50+
| process.code_signature.exists |
51+
| process.code_signature.status |
52+
| process.code_signature.subject_name |
53+
| process.code_signature.trusted |
54+
| process.command_line |
55+
| process.entity_id |
56+
| process.executable |
57+
| process.name |
58+
| process.parent.executable |
59+
| process.pid |
60+
| source.ip |
61+
| user.domain |
62+
| user.effective.domain |
63+
| user.effective.id |
64+
| user.effective.name |
65+
| user.id |
66+
| user.name |
67+
| user.target.domain |
68+
| user.target.name |
69+
| winlog.event_data.KeyLength |
70+
| winlog.event_data.LmPackageName |
71+
| winlog.event_data.LoginGuid |
72+
| winlog.event_data.PrivilegeList |
73+
| winlog.event_data.RestrictedAdminMode |
74+
| winlog.event_data.Status |
75+
| winlog.event_data.SubStatus |
76+
| winlog.event_data.TargetInfo |
77+
| winlog.event_data.TargetLinkedLogonId |
78+
| winlog.event_data.TargetLogonGuid |
79+
| winlog.event_data.TargetServerName |
80+
| winlog.event_data.TransmittedServices |
81+
| winlog.event_data.VirtualAccount |
82+
| winlog.event_data.WorkstationName |
83+

‎custom_documentation/doc/endpoint/security/windows/windows_security_auditing_workstation_locked.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# The workstation was locked.
2+
3+
- OS: Windows
4+
- Data Stream: `logs-endpoint.events.security-*`
5+
- KQL: `event.action : "workstation_locked" and event.dataset : "endpoint.events.security" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Security-Auditing" and host.os.type : "windows"`
6+
7+
This event is generated when the workstation was locked.
8+
9+
| Field |
10+
|---|
11+
| @timestamp |
12+
| Target.process.Ext.authentication_id |
13+
| agent.id |
14+
| agent.type |
15+
| agent.version |
16+
| data_stream.dataset |
17+
| data_stream.namespace |
18+
| data_stream.type |
19+
| ecs.version |
20+
| elastic.agent.id |
21+
| event.action |
22+
| event.category |
23+
| event.code |
24+
| event.created |
25+
| event.dataset |
26+
| event.id |
27+
| event.kind |
28+
| event.module |
29+
| event.outcome |
30+
| event.provider |
31+
| event.sequence |
32+
| event.type |
33+
| host.id |
34+
| host.name |
35+
| host.os.type |
36+
| message |
37+
| process.Ext.session_info.id |
38+
| user.effective.domain |
39+
| user.effective.id |
40+
| user.effective.name |
41+

‎custom_documentation/doc/endpoint/security/windows/windows_security_auditing_workstation_unlocked.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# The workstation was unlocked.
2+
3+
- OS: Windows
4+
- Data Stream: `logs-endpoint.events.security-*`
5+
- KQL: `event.action : "workstation_unlocked" and event.dataset : "endpoint.events.security" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Security-Auditing" and host.os.type : "windows"`
6+
7+
This event is generated when the workstation was unlocked.
8+
9+
| Field |
10+
|---|
11+
| @timestamp |
12+
| Target.process.Ext.authentication_id |
13+
| agent.id |
14+
| agent.type |
15+
| agent.version |
16+
| data_stream.dataset |
17+
| data_stream.namespace |
18+
| data_stream.type |
19+
| ecs.version |
20+
| elastic.agent.id |
21+
| event.action |
22+
| event.category |
23+
| event.code |
24+
| event.created |
25+
| event.dataset |
26+
| event.id |
27+
| event.kind |
28+
| event.module |
29+
| event.outcome |
30+
| event.provider |
31+
| event.sequence |
32+
| event.type |
33+
| host.id |
34+
| host.name |
35+
| host.os.type |
36+
| message |
37+
| process.Ext.session_info.id |
38+
| user.effective.domain |
39+
| user.effective.id |
40+
| user.effective.name |
41+

‎custom_documentation/src/endpoint/data_stream/alerts/windows/windows_malicious_behavior_alert.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ fields:
124124
- user.name
125125
- user.target.domain
126126
- user.target.name
127+
- winlog.*
127128
details:
128129
Events.*:
129130
description: 'Events is a list containing embedded copies of all events that
@@ -147,3 +148,5 @@ fields:
147148
description: 'registry contains the registry data from the primary event in
148149
Events. It can contain any fields that any other events includes within the
149150
registry fieldset. '
151+
winlog.*:
152+
description: 'winlog contains information about the Windows Event Log.'

‎custom_documentation/src/endpoint/data_stream/security/windows/windows_security_auditing_log_off.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
overview:
2+
name: Windows User Log Off
3+
description: 'This event is generated when a user logs off from the computer.'
4+
identification:
5+
filter:
6+
event.action: log_off
7+
event.dataset: endpoint.events.security
8+
event.module: endpoint
9+
event.provider: Microsoft-Windows-Security-Auditing
10+
host.os.type: windows
11+
os:
12+
- windows
13+
data_stream: logs-endpoint.events.security-*
14+
fields:
15+
endpoint:
16+
- '@timestamp'
17+
- Target.process.Ext.authentication_id
18+
- agent.id
19+
- agent.type
20+
- agent.version
21+
- data_stream.dataset
22+
- data_stream.namespace
23+
- data_stream.type
24+
- ecs.version
25+
- elastic.agent.id
26+
- event.action
27+
- event.category
28+
- event.code
29+
- event.created
30+
- event.dataset
31+
- event.id
32+
- event.kind
33+
- event.module
34+
- event.outcome
35+
- event.provider
36+
- event.sequence
37+
- event.type
38+
- host.id
39+
- host.name
40+
- host.os.type
41+
- message
42+
- process.Ext.authentication_id
43+
- process.Ext.code_signature.exists
44+
- process.Ext.code_signature.status
45+
- process.Ext.session_info.logon_type
46+
- process.code_signature.exists
47+
- process.code_signature.status
48+
- user.effective.domain
49+
- user.effective.id
50+
- user.effective.name

‎custom_documentation/src/endpoint/data_stream/security/windows/windows_security_auditing_log_on.yaml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
overview:
2+
name: Windows User Log On
3+
description: 'This event is generated when a user logs on to the computer.'
4+
identification:
5+
filter:
6+
event.action: log_on
7+
event.dataset: endpoint.events.security
8+
event.module: endpoint
9+
event.provider: Microsoft-Windows-Security-Auditing
10+
host.os.type: windows
11+
os:
12+
- windows
13+
data_stream: logs-endpoint.events.security-*
14+
fields:
15+
endpoint:
16+
- '@timestamp'
17+
- Target.process.Ext.authentication_id
18+
- agent.id
19+
- agent.type
20+
- agent.version
21+
- data_stream.dataset
22+
- data_stream.namespace
23+
- data_stream.type
24+
- ecs.version
25+
- elastic.agent.id
26+
- event.action
27+
- event.category
28+
- event.code
29+
- event.created
30+
- event.dataset
31+
- event.id
32+
- event.kind
33+
- event.module
34+
- event.outcome
35+
- event.provider
36+
- event.sequence
37+
- event.type
38+
- host.id
39+
- host.name
40+
- host.os.type
41+
- message
42+
- process.Ext.authentication_id
43+
- process.Ext.code_signature.exists
44+
- process.Ext.code_signature.status
45+
- process.Ext.code_signature.subject_name
46+
- process.Ext.code_signature.trusted
47+
- process.Ext.protection
48+
- process.Ext.session_info.authentication_package
49+
- process.Ext.session_info.failure_reason
50+
- process.Ext.session_info.logon_process_name
51+
- process.Ext.session_info.logon_type
52+
- process.Ext.token.elevation
53+
- process.Ext.token.impersonation_level
54+
- process.Ext.token.integrity_level_name
55+
- process.code_signature.exists
56+
- process.code_signature.status
57+
- process.code_signature.subject_name
58+
- process.code_signature.trusted
59+
- process.command_line
60+
- process.entity_id
61+
- process.executable
62+
- process.name
63+
- process.parent.executable
64+
- process.pid
65+
- source.ip
66+
- user.domain
67+
- user.effective.domain
68+
- user.effective.id
69+
- user.effective.name
70+
- user.id
71+
- user.name
72+
- user.target.domain
73+
- user.target.name
74+
- winlog.event_data.KeyLength
75+
- winlog.event_data.LmPackageName
76+
- winlog.event_data.LoginGuid
77+
- winlog.event_data.PrivilegeList
78+
- winlog.event_data.RestrictedAdminMode
79+
- winlog.event_data.Status
80+
- winlog.event_data.SubStatus
81+
- winlog.event_data.TargetInfo
82+
- winlog.event_data.TargetLinkedLogonId
83+
- winlog.event_data.TargetLogonGuid
84+
- winlog.event_data.TargetServerName
85+
- winlog.event_data.TransmittedServices
86+
- winlog.event_data.VirtualAccount
87+
- winlog.event_data.WorkstationName

0 commit comments

Comments
 (0)