Skip to content

File system type #361

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 13, 2023
Merged

File system type #361

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3e401c0
save code
Apr 13, 2023
19ca759
save code
Apr 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions custom_schemas/custom_dll.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,6 +182,17 @@
Disk File System
CD-ROM File System

- name: Ext.device.file_system_type
level: custom
type: keyword
short: Volume device file system type.
description: >
Volume device file system type.

Following are examples of the most frequently seen volume device file system types:
NTFS
UDF

- name: code_signature.exists
level: core
type: boolean
Expand Down
11 changes: 11 additions & 0 deletions custom_schemas/custom_file.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,6 +343,17 @@
Disk File System
CD-ROM File System

- name: Ext.device.file_system_type
level: custom
type: keyword
short: Volume device file system type.
description: >
Volume device file system type.

Following are examples of the most frequently seen volume device file system types:
NTFS
UDF

- name: code_signature.exists
level: core
type: boolean
Expand Down
11 changes: 11 additions & 0 deletions custom_schemas/custom_process.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -482,6 +482,17 @@
Disk File System
CD-ROM File System

- name: Ext.device.file_system_type
level: custom
type: keyword
short: Volume device file system type.
description: >
Volume device file system type.

Following are examples of the most frequently seen volume device file system types:
NTFS
UDF

- name: Ext.trusted
level: custom
type: boolean
Expand Down
4 changes: 4 additions & 0 deletions custom_subsets/elastic_endpoint/alerts/malware_event.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,6 +202,8 @@ fields:
product_id: {}
serial_number: {}
vendor_id: {}
file_system_type: {}
volume_device_type: {}
entropy: {}
entry_modified: {}
header_bytes: {}
Expand Down Expand Up @@ -350,6 +352,8 @@ fields:
product_id: {}
serial_number: {}
vendor_id: {}
file_system_type: {}
volume_device_type: {}
entropy: {}
entry_modified: {}
header_bytes: {}
Expand Down
1 change: 1 addition & 0 deletions custom_subsets/elastic_endpoint/file/file.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,4 +235,5 @@ fields:
serial_number: {}
vendor_id: {}
volume_device_type: {}
file_system_type: {}

1 change: 1 addition & 0 deletions custom_subsets/elastic_endpoint/library/library.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,5 +211,6 @@ fields:
serial_number: {}
vendor_id: {}
volume_device_type: {}
file_system_type: {}
relative_file_creation_time: {}
relative_file_name_modify_time: {}
1 change: 1 addition & 0 deletions custom_subsets/elastic_endpoint/process/process.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,7 @@ fields:
serial_number: {}
vendor_id: {}
volume_device_type: {}
file_system_type: {}
parent:
fields:
args: {}
Expand Down
32 changes: 32 additions & 0 deletions package/endpoint/data_stream/alerts/fields/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7708,6 +7708,14 @@
ignore_above: 1024
description: DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...
default_field: false
- name: enrichments.indicator.file.Ext.device.file_system_type
level: custom
type: keyword
ignore_above: 1024
description: 'Volume device file system type.

Following are examples of the most frequently seen volume device file system types: NTFS UDF'
default_field: false
- name: enrichments.indicator.file.Ext.device.nt_name
level: custom
type: keyword
Expand All @@ -7732,6 +7740,14 @@
ignore_above: 1024
description: VendorID of the device. It is provided by the vendor of the device.
default_field: false
- name: enrichments.indicator.file.Ext.device.volume_device_type
level: custom
type: keyword
ignore_above: 1024
description: 'Volume device type.

Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System'
default_field: false
- name: enrichments.indicator.file.Ext.entropy
level: custom
type: double
Expand Down Expand Up @@ -9089,6 +9105,14 @@
ignore_above: 1024
description: DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...
default_field: false
- name: indicator.file.Ext.device.file_system_type
level: custom
type: keyword
ignore_above: 1024
description: 'Volume device file system type.

Following are examples of the most frequently seen volume device file system types: NTFS UDF'
default_field: false
- name: indicator.file.Ext.device.nt_name
level: custom
type: keyword
Expand All @@ -9113,6 +9137,14 @@
ignore_above: 1024
description: VendorID of the device. It is provided by the vendor of the device.
default_field: false
- name: indicator.file.Ext.device.volume_device_type
level: custom
type: keyword
ignore_above: 1024
description: 'Volume device type.

Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System'
default_field: false
- name: indicator.file.Ext.entropy
level: custom
type: double
Expand Down
8 changes: 8 additions & 0 deletions package/endpoint/data_stream/file/fields/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -403,6 +403,14 @@
ignore_above: 1024
description: DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...
default_field: false
- name: Ext.device.file_system_type
level: custom
type: keyword
ignore_above: 1024
description: 'Volume device file system type.

Following are examples of the most frequently seen volume device file system types: NTFS UDF'
default_field: false
- name: Ext.device.nt_name
level: custom
type: keyword
Expand Down
8 changes: 8 additions & 0 deletions package/endpoint/data_stream/library/fields/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,14 @@
ignore_above: 1024
description: DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...
default_field: false
- name: Ext.device.file_system_type
level: custom
type: keyword
ignore_above: 1024
description: 'Volume device file system type.

Following are examples of the most frequently seen volume device file system types: NTFS UDF'
default_field: false
- name: Ext.device.nt_name
level: custom
type: keyword
Expand Down
8 changes: 8 additions & 0 deletions package/endpoint/data_stream/process/fields/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -785,6 +785,14 @@
ignore_above: 1024
description: DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...
default_field: false
- name: Ext.device.file_system_type
level: custom
type: keyword
ignore_above: 1024
description: 'Volume device file system type.

Following are examples of the most frequently seen volume device file system types: NTFS UDF'
default_field: false
- name: Ext.device.nt_name
level: custom
type: keyword
Expand Down
7 changes: 7 additions & 0 deletions package/endpoint/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1021,10 +1021,12 @@ sent by the endpoint.
| threat.enrichments.indicator.file.Ext.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean |
| threat.enrichments.indicator.file.Ext.device.bus_type | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | keyword |
| threat.enrichments.indicator.file.Ext.device.dos_name | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | keyword |
| threat.enrichments.indicator.file.Ext.device.file_system_type | Volume device file system type. Following are examples of the most frequently seen volume device file system types: NTFS UDF | keyword |
| threat.enrichments.indicator.file.Ext.device.nt_name | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | keyword |
| threat.enrichments.indicator.file.Ext.device.product_id | ProductID of the device. It is provided by the vendor of the device if any. | keyword |
| threat.enrichments.indicator.file.Ext.device.serial_number | Serial Number of the device. It is provided by the vendor of the device if any. | keyword |
| threat.enrichments.indicator.file.Ext.device.vendor_id | VendorID of the device. It is provided by the vendor of the device. | keyword |
| threat.enrichments.indicator.file.Ext.device.volume_device_type | Volume device type. Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | keyword |
| threat.enrichments.indicator.file.Ext.entropy | Entropy calculation of file's header and footer used to check file integrity. | double |
| threat.enrichments.indicator.file.Ext.entry_modified | Time of last status change. See `st_ctim` member of `struct stat`. | double |
| threat.enrichments.indicator.file.Ext.header_bytes | First 16 bytes of file used to check file integrity. | keyword |
Expand Down Expand Up @@ -1224,10 +1226,12 @@ sent by the endpoint.
| threat.indicator.file.Ext.code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. | boolean |
| threat.indicator.file.Ext.device.bus_type | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | keyword |
| threat.indicator.file.Ext.device.dos_name | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | keyword |
| threat.indicator.file.Ext.device.file_system_type | Volume device file system type. Following are examples of the most frequently seen volume device file system types: NTFS UDF | keyword |
| threat.indicator.file.Ext.device.nt_name | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | keyword |
| threat.indicator.file.Ext.device.product_id | ProductID of the device. It is provided by the vendor of the device if any. | keyword |
| threat.indicator.file.Ext.device.serial_number | Serial Number of the device. It is provided by the vendor of the device if any. | keyword |
| threat.indicator.file.Ext.device.vendor_id | VendorID of the device. It is provided by the vendor of the device. | keyword |
| threat.indicator.file.Ext.device.volume_device_type | Volume device type. Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | keyword |
| threat.indicator.file.Ext.entropy | Entropy calculation of file's header and footer used to check file integrity. | double |
| threat.indicator.file.Ext.entry_modified | Time of last status change. See `st_ctim` member of `struct stat`. | double |
| threat.indicator.file.Ext.header_bytes | First 16 bytes of file used to check file integrity. | keyword |
Expand Down Expand Up @@ -1486,6 +1490,7 @@ sent by the endpoint.
| file.Ext | Object for all custom defined fields to live in. | object |
| file.Ext.device.bus_type | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | keyword |
| file.Ext.device.dos_name | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | keyword |
| file.Ext.device.file_system_type | Volume device file system type. Following are examples of the most frequently seen volume device file system types: NTFS UDF | keyword |
| file.Ext.device.nt_name | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | keyword |
| file.Ext.device.product_id | ProductID of the device. It is provided by the vendor of the device if any. | keyword |
| file.Ext.device.serial_number | Serial Number of the device. It is provided by the vendor of the device if any. | keyword |
Expand Down Expand Up @@ -1667,6 +1672,7 @@ sent by the endpoint.
| dll.Ext.defense_evasions | List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump. | keyword |
| dll.Ext.device.bus_type | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | keyword |
| dll.Ext.device.dos_name | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | keyword |
| dll.Ext.device.file_system_type | Volume device file system type. Following are examples of the most frequently seen volume device file system types: NTFS UDF | keyword |
| dll.Ext.device.nt_name | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | keyword |
| dll.Ext.device.product_id | ProductID of the device. It is provided by the vendor of the device if any. | keyword |
| dll.Ext.device.serial_number | Serial Number of the device. It is provided by the vendor of the device if any. | keyword |
Expand Down Expand Up @@ -2081,6 +2087,7 @@ sent by the endpoint.
| process.Ext.defense_evasions | List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping. | keyword |
| process.Ext.device.bus_type | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | keyword |
| process.Ext.device.dos_name | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | keyword |
| process.Ext.device.file_system_type | Volume device file system type. Following are examples of the most frequently seen volume device file system types: NTFS UDF | keyword |
| process.Ext.device.nt_name | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | keyword |
| process.Ext.device.product_id | ProductID of the device. It is provided by the vendor of the device if any. | keyword |
| process.Ext.device.serial_number | Serial Number of the device. It is provided by the vendor of the device if any. | keyword |
Expand Down
56 changes: 56 additions & 0 deletions schemas/v1/alerts/malware_event.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

13 changes: 13 additions & 0 deletions schemas/v1/file/file.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

13 changes: 13 additions & 0 deletions schemas/v1/library/library.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

13 changes: 13 additions & 0 deletions schemas/v1/process/process.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.