Crowdstrike.fdr: map CommandHistory events to ECS process fields by chemamartinez · Pull Request #20285 · elastic/integrations

chemamartinez · 2026-07-22T14:22:31Z

Proposed commit message

crowdstrike.fdr: map CommandHistory events to ECS process fields

Parse CommandHistory events in the FDR ingest pipeline to populate
ECS process fields. The CommandHistory string (commands delimited by
the pilcrow character ¶) is mapped to process.command_line and split
into an array stored at crowdstrike.CommandHistory.

CrowdStrike uses U+00B6 PILCROW SIGN (¶) as the separator between 
individual commands in the CommandHistory field.
This character has no formal documentation from CrowdStrike,
but it is consistently observed in FDR CommandHistory events collected
in real scenarios.

The UserName field is copied to process.user.name for CommandHistory
events. A new script processor derives process.interactive from LogonType,
treating types 2 (Interactive), 10 (RemoteInteractive), 11 (CachedInteractive)
and 12 (CachedRemoteInteractive) as interactive sessions.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

infra-vault-gh-plugin-prod · 2026-07-22T14:23:16Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

github-actions · 2026-07-22T14:24:26Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

vera-review-bot · 2026-07-22T14:33:16Z

+  - script:
+      tag: script_process_interactive_logon_type_9b3d6c7a
+      description: Set process.interactive from crowdstrike.LogonType; types 2 (Interactive), 10 (RemoteInteractive), and 11 (CachedInteractive) indicate an interactive shell session.
+      if: ctx.crowdstrike?.LogonType instanceof String && ctx.crowdstrike.LogonType != ''


Severity: 🟡 Medium confidence: medium path: packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml:1148

The process.interactive script fires on any event carrying a LogonType, so authentication events (UserLogon/UserLogoff) get a bare process.interactive with no process context; gate it on an established process instead.

Details

The new script's condition is only ctx.crowdstrike?.LogonType instanceof String && ctx.crowdstrike.LogonType != '', which is not scoped to process events. LogonType is present on Windows authentication events, so this stamps process.interactive onto documents that have no process. This is observable in the regenerated fixtures: in test-fdr.log-expected.json a UserLogoff event (event.category: ["authentication"]) now gains a lone process: { "interactive": false } object, and test-user-map / test-windows show the same on non-process events. The effect is also broader than the changelog entry ("Map CommandHistory events to ECS process fields") describes. Attaching a process attribute to an authentication event is semantically misleading and creates a process object where none belongs.

Recommendation:

Gate the script on an already-established process so it only applies to genuine process events (CommandHistory and ProcessRollup set process.entity_id from TargetProcessId earlier in the pipeline; authentication events do not):

- script: tag: script_process_interactive_logon_type_9b3d6c7a description: Set process.interactive from crowdstrike.LogonType; types 2 (Interactive), 10 (RemoteInteractive), and 11 (CachedInteractive) indicate an interactive shell session. if: >- ctx.crowdstrike?.LogonType instanceof String && ctx.crowdstrike.LogonType != '' && ctx.process?.entity_id != null source: |- def logonType = ctx.crowdstrike.LogonType; ctx.process.interactive = (logonType == '2' || logonType == '10' || logonType == '11'); on_failure: - append: field: error.message value: "Failed to set process.interactive from LogonType: {{{_ingest.on_failure_message}}}"

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

elastic-vault-github-plugin-prod · 2026-07-22T15:33:17Z

🚀 Benchmarks report

Package `crowdstrike` 👍(8) 💚(4) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
`falcon`	4878.05	3316.75	-1561.3 (-32.01%)	💔
`identity_protection_assessment`	25000	18726.59	-6273.41 (-25.09%)	💔

To see the full report comment with /test benchmark fullreport

efd6 · 2026-07-23T00:06:55Z

+                "version": "1007.3.0021003.10"
+            },
+            "process": {
+                "command_line": "sc stop CSFalconService¶Stop-Service -Name CSFalconService -Force",


Is this right? I've looked for the any documentation for the semantics of this character and have found none. I think we need some explanation of how we are interpreting it in the commit message.

I've added an explanation in the commit message. The use of this character has been observed in several real log samples.

So how does that work with process.command_line? The string that its holding is not the "Full command line that started the process, including the absolute path to the executable, and all arguments."

efd6 · 2026-07-23T00:10:06Z

+        if (ctx.process == null) {
+          ctx.process = new HashMap();
+        }


Suggested change

if (ctx.process == null) {

ctx.process = new HashMap();

}

ctx.process = ctx.process ?: [:];

efd6 · 2026-07-23T00:12:23Z

+      source: |-
+        def logonType = ctx.crowdstrike.LogonType;
+        if (ctx.process == null) ctx.process = new HashMap();
+        ctx.process.interactive = (logonType == '2' || logonType == '10' || logonType == '11');


I think this wants a comment explaining the logon types.

…story

elastic-vault-github-plugin-prod · 2026-07-23T11:05:53Z

✅ All changelog entries have the correct PR link.

vera-review-bot · 2026-07-23T11:50:07Z

No issues across the latest commits 61ccfa3…7d507a3 (17 commits).

Review summary

Issues found across earlier commits d0257c7 — 1 medium

🟡 The process.interactive script fires on any event carrying a LogonType, so authentication events (UserLogon/UserLogoff) get a bare process.interactive with no process context (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

infra-vault-gh-plugin-prod · 2026-07-23T11:55:03Z

💚 Build Succeeded

Buildkite Build
Commit: 7d507a3

History

💚 Build #46512 succeeded e083da1
💚 Build #46476 succeeded d0257c7

cc @chemamartinez

Map CommandHistory events to ECS process fields

3be10c8

chemamartinez self-assigned this Jul 22, 2026

chemamartinez added enhancement New feature or request Integration:crowdstrike CrowdStrike Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Jul 22, 2026

Update changelog

d0257c7

chemamartinez marked this pull request as ready for review July 22, 2026 14:23

chemamartinez requested review from a team as code owners July 22, 2026 14:23

vera-review-bot Bot reviewed Jul 22, 2026

View reviewed changes

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jul 22, 2026

efd6 reviewed Jul 23, 2026

View reviewed changes

Address review comments

e083da1

chemamartinez requested a review from efd6 July 23, 2026 06:34

Merge branch 'main' into crowdstrike-fdr-map-process-fields-commandhi…

7d507a3

…story

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Crowdstrike.fdr: map CommandHistory events to ECS process fields#20285

Crowdstrike.fdr: map CommandHistory events to ECS process fields#20285
chemamartinez wants to merge 4 commits into
elastic:mainfrom
chemamartinez:crowdstrike-fdr-map-process-fields-commandhistory

chemamartinez commented Jul 22, 2026 •

edited

Loading

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

vera-review-bot Bot Jul 22, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

efd6 Jul 23, 2026

Uh oh!

chemamartinez Jul 23, 2026

Uh oh!

efd6 Jul 23, 2026

Uh oh!

efd6 Jul 23, 2026

Uh oh!

efd6 Jul 23, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 23, 2026

Uh oh!

vera-review-bot Bot commented Jul 23, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

chemamartinez commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 22, 2026

✅ Elastic Docs Style Checker (Vale)

Uh oh!

vera-review-bot Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Package crowdstrike 👍(8) 💚(4) 💔(2)

Uh oh!

efd6 Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

chemamartinez Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

efd6 Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

efd6 Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

efd6 Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 23, 2026

Uh oh!

vera-review-bot Bot commented Jul 23, 2026

Review summary

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 23, 2026

💚 Build Succeeded

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

chemamartinez commented Jul 22, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Jul 22, 2026 •

edited

Loading

Package `crowdstrike` 👍(8) 💚(4) 💔(2)