diff --git a/packages/crowdstrike/_dev/deploy/docker/files/config-alert.yml b/packages/crowdstrike/_dev/deploy/docker/files/config-alert.yml index 3857adee1a5..cafff27992e 100644 --- a/packages/crowdstrike/_dev/deploy/docker/files/config-alert.yml +++ b/packages/crowdstrike/_dev/deploy/docker/files/config-alert.yml @@ -236,7 +236,16 @@ rules: "type": "ldt", "updated_timestamp": "2023-11-03T19:00:23.985007341Z", "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425", - "user_name": "mohit.jha" + "user_name": "mohit.jha", + "anode_indicators": [ + { + "explanation_metrics_v2": { + "expected_category_distribution_values": [0.1428, 0.0, 0.8569], + "current_category_distribution_values": [0.05, 0.15, 0.8], + "category_distribution_difference_values": [0.0928, -0.15, 0.0569] + } + } + ] } ] } diff --git a/packages/crowdstrike/changelog.yml b/packages/crowdstrike/changelog.yml index 00364fbad60..b8f9118f39b 100644 --- a/packages/crowdstrike/changelog.yml +++ b/packages/crowdstrike/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "4.4.1" + changes: + - description: Declare the ANODE anomaly-indicator numeric leaves as `float` in the `falcon`, `fdr`, and `alert` data streams. These values are polymorphic (usually fractional, occasionally whole numbers), so leaving them undeclared let dynamic mapping lock them to `long` on integer-first indices and reject later fractional values to the failure store. + type: bugfix + link: https://github.com/elastic/integrations/pull/20305 - version: "4.4.0" changes: - description: >- diff --git a/packages/crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log b/packages/crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log index 63cacae598e..0647a5f11ae 100644 --- a/packages/crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log +++ b/packages/crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log @@ -1,4 +1,4 @@ -{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} +{"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"has_script_or_module_ioc":"true","id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"is_synthetic_quarantine_disposition":true,"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","overwatch_note":"Activity Notice: OverWatch has observed XYZ","overwatch_note_timestamp":"2025-03-01T15:31:00Z","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"rule_group_id":"1b27b7f123c44e15a13fe7f44801d123","rule_group_name":"Windows Group","rule_instance_created_by":"myuser@mydomain.com","rule_instance_id":"123","rule_instance_name":"INSTANCE-1","rule_instance_version":"1","scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha","anode_indicators":[{"explanation_metrics_v2":{"expected_category_distribution_values":[0.1428,0.0,0.8569],"current_category_distribution_values":[0.05,0.15,0.8],"category_distribution_difference_values":[0.0928,-0.15,0.0569]}}]} {"agent_id":"38293534662e48c99f33c61631b3536d","aggregate_id":"aggind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","cid":"4446934rf3fdb64ec3056ddfb96e","composite_id":"874694c2ff8c43fdb64ef3056ddfb96d:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","confidence":80,"context_timestamp":"2024-08-16T18:43:44.242Z","crawled_timestamp":"2024-08-16T18:49:02.798354466Z","created_timestamp":"2024-08-16T18:45:02.987127397Z","data_domains":["Identity"],"description":"A user denied a policy identity verification request","display_name":"Identity verification denied","end_time":"2024-08-16T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","idp_policy_mfa_factor_type":"32769","idp_policy_mfa_provider":"14","idp_policy_rule_id":"1B82F2DE-2A08-49E0-8F85-AD46996F9A65","idp_policy_rule_name":"admin - RDP Access to TIER-0 Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"Gain Access","pattern_id":51143,"poly_id":"AAB3RpTC74xD_bZOwwVt37ltWwicqVJrn1DHb_UVfrn1QAAATiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"High","show_in_ui":true,"source_account_azure_id":"65ddx-c454-45f9-9034-Fdf34353","source_account_domain":"NET.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1567733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"E436B3F0-078C-4629-9437-D3E3169147C0","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293534662e48c99f33c61631b3536d","source_products":["Falcon Identity Protection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-16T18:43:44.242Z","status":"new","tactic":"Credential Access","tactic_id":"TA0006","technique":"Brute Force","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8E6E","target_endpoint_account_object_sid":"S-1-5-21-746137067-1844237615-1801674531-298236","target_endpoint_host_name":"GH787.net.example.com","target_endpoint_sensor_id":"ac89a368e77a4fa5837b53c7f11fc9e7","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge 126.0.0","activity_device":"LAPTOP-AP7299QV","activity_os":"Windows","active_directory_authentication_method":"5","activity_id":"2A8A7C96-0F17-412C-8105-94542784E00D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":340726,"location_longitude_as_int":-1182610,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"9F2CE16C-4A78-42E6-8565-87147707EE79","source_endpoint_account_object_sid":"S-1-5-21-111111111-2222222-1417001333-101158","source_endpoint_ip_reputation":"128","source_ip_isp_classification":"9","source_ip_isp_domain":"sioru.com","target_domain_controller_host_name":"APINTAL19DC01","target_domain_controller_object_guid":"45A24DB7-6CD3-48C5-974F-A97159E7E2B2","target_domain_controller_object_sid":"S-1-5-21-111111111-2222222-1417001333-85512","target_service_access_identifier":"HOST/admin.example.com"} {"aggregate_id":"aggind:4444934rf3fdb64ec2059dmmb96e:5876E98M-F91K-48AW-8FFC-1191C663A1E9","agent_id":"58293534772e48c99f33c61631b3536d","cid":"4446934rf3fdb64ec3056ddfb96e","context_timestamp":"2024-08-19T18:43:44.242Z","composite_id":"874594c2ff8c23fdf64ef3086ddfb03e:ind:4441934rf3mmb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9","crawled_timestamp":"2024-08-19T18:49:02.798354466Z","created_timestamp":"2024-08-19T18:45:02.987127397Z","data_domains":["Identity"],"description":"Auserdeniedapolicyidentityverificationrequest","display_name":"Identityverificationdenied","end_time":"2024-08-19T18:43:44.242Z","falcon_host_link":"https://falcon.crowdstrike.com/identity-protection/detections/4446934rf3fdb64ec3056ddfb96e:ind:4446934rf3fdb64ec3056ddfb96e:5876E98F-D91B-48AC-8FFC-1191C663A1E9?_cid=g0300034lfy3zjobdz7ewb4xjqyjsy5a","id":"ind:4446934rf3fdb64ec3056ddfb96e:87934F-M00B-48CC-0AAC-dfafd3429","idp_policy_mfa_factor_type":"42669","idp_policy_mfa_provider":"11","idp_policy_rule_id":"123324-343-4dfa9E0-8F85-dfaa3242","idp_policy_rule_name":"admin-RDPAccesstoTIER-0Servers","name":"IdpPolicyIdentityVerificationDenied","objective":"GainAccess","pattern_id":45897,"poly_id":"MJdfafdB3RpTC74xD_bZOwwVt37erewrewdWwicqVJrn1DHb_UVfrn1QTiE4zCVgvIYhKPq8wZOGu5S3BVMzfSm_y5pv8n9CypfRuw==","product":"idp","scenario":"suspicious_activity","seconds_to_resolved":0,"seconds_to_triaged":0,"severity":79,"severity_name":"Medium","show_in_ui":true,"source_account_azure_id":"65ddx-c454-324d-9034-Fdf34353","source_account_domain":"BCD.example.com","source_account_name":"admin.example","source_account_object_sid":"S-14-5424-21-dfaf3-234343-3434-1117733","source_account_sam_account_name":"admin.abcdef","source_account_upn":"admin.abcdef@example.com","source_endpoint_account_object_guid":"FDHJJ343-098C-4629-9437-DD3424GHJ","source_endpoint_address_ip4":"81.2.69.144","source_endpoint_host_name":"ABDC454.net.example.com","source_endpoint_ip_address":"81.2.69.144","source_endpoint_sensor_id":"38293523261gh48c99ffd234c6190123536e","source_products":["FalconIdentityProtection"],"source_vendors":["CrowdStrike"],"start_time":"2024-08-19T18:43:44.242Z","status":"new","tactic":"CredentialAccess","tactic_id":"TA0006","technique":"BruteForce","technique_id":"T1110","tags":["falcon_complete"],"target_account_name":"HFJFJFFFFFFF$","target_endpoint_account_object_guid":"AAAAAAAA-0000-FFFFF-000000-A302EFCC8M4536","target_endpoint_account_object_sid":"S-1-5-21-HG43242JJ-1844237615-18dfa1674531-298236","target_endpoint_host_name":"GH787.abc.example.com","target_endpoint_sensor_id":"afdsasf3423432nndv3432v","timestamp":"2024-08-19T18:44:01.1Z","type":"idp-user-endpoint-app-info","updated_timestamp":"2024-08-19T18:49:02.798344752Z","user_name":"admin.abcdef","activity_browser":"Edge126.0.0","activity_device":"LAPTOP-ADFVEJM234V","activity_os":"Windows","active_directory_authentication_method":"4","activity_id":"3A7H7C00-FFF2344-23FFFF-9199905-91245754E10099D","alert_attributes":"0","location_country_code":"US","location_latitude_as_int":320316,"location_longitude_as_int":-12729080,"model_anomaly_indicators":["ACCOUNT_IMPOSSIBLE_VELOCITY","ENVIRONMENT_UNUSUAL_IP","ENVIRONMENT_UNUSUAL_ISP_DOMAIN","ISP_DATACENTER_CLASSIFICATION"],"ldap_search_query_attack":"16","protocol_anomaly_classification":"1","source_account_object_guid":"78HF9842-HGG5-324F-9565-GJD47324","source_endpoint_account_object_sid":"S-1-4-21-111111111-2222222-14171121333-1045999","source_endpoint_ip_reputation":"118","source_ip_isp_classification":"8","source_ip_isp_domain":"abc.com","target_domain_controller_host_name":"GHPOTAL12578","target_domain_controller_object_guid":"59B24AA7-4GH8-f7H0-994F-B90159E7M2K1","target_domain_controller_object_sid":"S-2-8-21-333333-2222222-3431-95511","target_service_access_identifier":"HOST/root.demo.com"} {"agent_id":"2ce412d17b334ad4adc8c1c54dbfec4b","aggregate_id":"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","alleged_filetype":"exe","cid":"92012896127c4a948236ba7601b886b0","cloud_indicator":"false","cmdline":"\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"","composite_id":"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","confidence":10,"context_timestamp":"2023-11-03T18:00:31Z","control_graph_id":"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778","crawl_edge_ids":{"Sensor":["KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N","KZcZA__;?\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\"__\"59K'R?_=`'`rK/'hA\"r+L5i-*Ut5PI!!*'!","N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\"%MDAR=fo41Z]rXc\"J-\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr","N6CUF__;K!d$:\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\"X'\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\"<_/?I'[##WMh'H[Rcl+!!<<'","N6L[G__;K!d\"qhT7k?[D\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\"d.&=To@9kS!prs8N"]},"crawl_vertex_ids":{"Sensor":["aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778","ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600","mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135","pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993","quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425"]},"crawled_timestamp":"2023-11-03T19:00:23.985020992Z","created_timestamp":"2023-11-03T18:01:23.995794943Z","data_domains":["Endpoint"],"description":"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.","device":{"agent_load_flags":"0","agent_local_time":"2023-10-12T03:45:57.753Z","agent_version":"7.04.17605.0","bios_manufacturer":"ABC","bios_version":"F8CN42WW(V2.05)","cid":"92012896127c4a948236ba7601b886b0","config_id_base":"65994763","config_id_build":"17605","config_id_platform":"3","device_id":"2ce412d17b334ad4adc8c1c54dbfec4b","external_ip":"81.2.69.142","first_seen":"2023-04-07T09:36:36Z","groups":["18704e21288243b58e4c76266d38caaf"],"hostinfo":{"active_directory_dn_display":["WinComputers","WinComputers\\ABC"],"domain":"ABC.LOCAL"},"hostname":"ABC709-1175","last_seen":"2023-11-03T17:51:42Z","local_ip":"81.2.69.142","mac_address":"ab-21-48-61-05-b2","machine_domain":"ABC.LOCAL","major_version":"10","minor_version":"0","modified_timestamp":"2023-11-03T17:53:43Z","os_version":"Windows11","ou":["ABC","WinComputers"],"platform_id":"0","platform_name":"Windows","pod_labels":null,"product_type":"1","product_type_desc":"Workstation","site_name":"Default-First-Site-Name","status":"normal","system_manufacturer":"LENOVO","system_product_name":"20VE"},"falcon_host_link":"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","filename":"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","filepath":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","grandparent_details":{"cmdline":"C:\\Windows\\system32\\userinit.exe","filename":"userinit.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\System32\\userinit.exe","local_process_id":"4328","md5":"b07f77fd3f9828b2c9d61f8a36609741","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135","process_id":"392734873135","sha256":"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33","timestamp":"2023-10-30T16:49:19Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"yuvraj.mahajan"},"id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","indicator_id":"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600","ioc_context":[{"ioc_description":"\\Device\\HarddiskVolume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","ioc_source":"library_load","ioc_type":"hash_sha256","ioc_value":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","type":"module"}],"ioc_values":[],"local_process_id":"17076","logon_domain":"ABSYS","md5":"cdf9cfebb400ce89d5b6032bfcdc693b","name":"PrewittPupAdwareSensorDetect-Lowest","objective":"FalconDetectionMethod","parent_details":{"cmdline":"C:\\WINDOWS\\Explorer.EXE","filename":"explorer.exe","filepath":"\\Device\\HarddiskVolume3\\Windows\\explorer.exe","local_process_id":"1040","md5":"8cc3fcdd7d52d2d5221303c213e044ae","process_graph_id":"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876","process_id":"392736520876","sha256":"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4","timestamp":"2023-11-03T18:00:32Z","user_graph_id":"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"},"parent_process_id":"392736520876","pattern_disposition":2176,"pattern_disposition_description":"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.","pattern_disposition_details":{"blocking_unsupported_or_disabled":false,"bootup_safeguard_enabled":false,"critical_process_disabled":false,"detect":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"inddet_mask":false,"indicator":false,"kill_action_failed":false,"kill_parent":false,"kill_process":false,"kill_subprocess":false,"operation_blocked":false,"policy_disabled":false,"process_blocked":true,"quarantine_file":true,"quarantine_machine":false,"registry_operation_blocked":false,"rooting":false,"sensor_only":false,"suspend_parent":false,"suspend_process":false},"pattern_id":5761,"platform":"Windows","poly_id":"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==","process_end_time":"1699034421","process_id":"399748687993","process_start_time":"1699034413","product":"epp","quarantined_files":[{"filename":"\\Device\\Volume3\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe","id":"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","state":"quarantined"}],"scenario":"NGAV","severity":30,"sha1":"0000000000000000000000000000000000000000","sha256":"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd","show_in_ui":true,"source_products":["FalconInsight"],"source_vendors":["CrowdStrike"],"status":"new","tactic":"MachineLearning","tactic_id":"CSTA0004","technique":"Adware/PUP","technique_id":"CST0000","timestamp":"2023-11-03T18:00:22.328Z","tree_id":"1931778","tree_root":"38687993","triggering_process_graph_id":"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993","type":"ldt","updated_timestamp":"2023-11-03T19:00:23.985007341Z","user_id":"S-1-5-21-1909377054-3469629671-4104191496-4425","user_name":"mohit.jha"} diff --git a/packages/crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json b/packages/crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json index f3defee8d37..dca57ac55dc 100644 --- a/packages/crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json +++ b/packages/crowdstrike/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json @@ -7,6 +7,27 @@ "agent_id": "2ce412d17b334ad4adc8c1c54dbfec4b", "aggregate_id": "aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778", "alleged_filetype": "exe", + "anode_indicators": [ + { + "explanation_metrics_v2": { + "category_distribution_difference_values": [ + 0.0928, + -0.15, + 0.0569 + ], + "current_category_distribution_values": [ + 0.05, + 0.15, + 0.8 + ], + "expected_category_distribution_values": [ + 0.1428, + 0.0, + 0.8569 + ] + } + } + ], "cid": "92012896127c4a948236ba7601b886b0", "cloud_indicator": false, "cmdline": "\"C:\\Users\\yuvraj.mahajan\\AppData\\Local\\Temp\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\pfSenseFirewallOpenVPNClients\\Windows\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\"", @@ -241,7 +262,7 @@ ], "id": "ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600", "kind": "alert", - "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"overwatch_note\":\"Activity Notice: OverWatch has observed XYZ\",\"overwatch_note_timestamp\":\"2025-03-01T15:31:00Z\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"rule_group_id\":\"1b27b7f123c44e15a13fe7f44801d123\",\"rule_group_name\":\"Windows Group\",\"rule_instance_created_by\":\"myuser@mydomain.com\",\"rule_instance_id\":\"123\",\"rule_instance_name\":\"INSTANCE-1\",\"rule_instance_version\":\"1\",\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"}", + "original": "{\"agent_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"aggregate_id\":\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"alleged_filetype\":\"exe\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"cloud_indicator\":\"false\",\"cmdline\":\"\\\"C:\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\\\"\",\"composite_id\":\"92012896127c4a8236ba7601b886b0:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"confidence\":10,\"context_timestamp\":\"2023-11-03T18:00:31Z\",\"control_graph_id\":\"ctg:2ce4127b334ad4adc8c1c54dbfec4b:163208931778\",\"crawl_edge_ids\":{\"Sensor\":[\"KZcZ=__;K&cmqQ]Z=W,QK4W.9(rBfs\\\\gfmjTblqI^F-_oNnAWQ&-o0:dR/>>2JIVMD36[+=kiQDRm.bB?;d\\\"V0JaQlaltC59Iq6nM?6`>ZAs+LbOJ9p9A;9'WV9^H3XEMs8N\",\"KZcZA__;?\\\"cmott@m_k)MSZ^+C?.cg92t[f!>*b9WLY@H!V0N,BJsNSTD:?/+fY';ea%iM\\\"__\\\"59K'R?_=`'`rK/'hA\\\"r+L5i-*Ut5PI!!*'!\",\"N6CUF__;K!d$:[C93.?=/5(`5KnM]!L#UbnSY5HOHc#[6A&FE;(naXB4h/OG\\\"%MDAR=fo41Z]rXc\\\"J-\\\\&&V8UW.?I6V*G+,))Ztu_IuCMV#ZJ:QDJ_EjQmjiX#HENY'WD0rVAV$Gl6_+0e:2$8D)):.LUs+8-S$L!!!$!rr\",\"N6CUF__;K!d$:\\\\N43JV0AO56@6D0$!na(s)d.dQ'iI1*uiKt#j?r\\\"X'\\\\AtNML2_C__7ic6,8Dc[F<0NTUGtl%HD#?/Y)t8!1X.;G!*FQ9GP-ukQn`6I##&$^81(P+hN*-#rf/cUs)Wb\\\"<_/?I'[##WMh'H[Rcl+!!<<'\",\"N6L[G__;K!d\\\"qhT7k?[D\\\"Bk:5s%+=>#DM0j$_44ZjO9q*d!YLuHhkq!3>3tpi>OPYZp9]5f1#/AlRZL06`/I6cl\\\"d.&=To@9kS!prs8N\"]},\"crawl_vertex_ids\":{\"Sensor\":[\"aggind:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ctg:2ce412d17b334ad4adc8c1c54dbfec4b:163208931778\",\"ind:2ce412d17b34ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"mod:2ce412d17b4ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"mod:2ce412d17b334ad4adc8c1c54dbfec4b:caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"pid:2ce412d17b33d4adc8c1c54dbfec4b:392734873135\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993\",\"quf:2ce412d17b334ad4adc8c1c54dbfec4b:b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\"]},\"crawled_timestamp\":\"2023-11-03T19:00:23.985020992Z\",\"created_timestamp\":\"2023-11-03T18:01:23.995794943Z\",\"data_domains\":[\"Endpoint\"],\"description\":\"ThisfilemeetstheAdware/PUPAnti-malwareMLalgorithm'slowest-confidencethreshold.\",\"device\":{\"agent_load_flags\":\"0\",\"agent_local_time\":\"2023-10-12T03:45:57.753Z\",\"agent_version\":\"7.04.17605.0\",\"bios_manufacturer\":\"ABC\",\"bios_version\":\"F8CN42WW(V2.05)\",\"cid\":\"92012896127c4a948236ba7601b886b0\",\"config_id_base\":\"65994763\",\"config_id_build\":\"17605\",\"config_id_platform\":\"3\",\"device_id\":\"2ce412d17b334ad4adc8c1c54dbfec4b\",\"external_ip\":\"81.2.69.142\",\"first_seen\":\"2023-04-07T09:36:36Z\",\"groups\":[\"18704e21288243b58e4c76266d38caaf\"],\"hostinfo\":{\"active_directory_dn_display\":[\"WinComputers\",\"WinComputers\\\\ABC\"],\"domain\":\"ABC.LOCAL\"},\"hostname\":\"ABC709-1175\",\"last_seen\":\"2023-11-03T17:51:42Z\",\"local_ip\":\"81.2.69.142\",\"mac_address\":\"ab-21-48-61-05-b2\",\"machine_domain\":\"ABC.LOCAL\",\"major_version\":\"10\",\"minor_version\":\"0\",\"modified_timestamp\":\"2023-11-03T17:53:43Z\",\"os_version\":\"Windows11\",\"ou\":[\"ABC\",\"WinComputers\"],\"platform_id\":\"0\",\"platform_name\":\"Windows\",\"pod_labels\":null,\"product_type\":\"1\",\"product_type_desc\":\"Workstation\",\"site_name\":\"Default-First-Site-Name\",\"status\":\"normal\",\"system_manufacturer\":\"LENOVO\",\"system_product_name\":\"20VE\"},\"falcon_host_link\":\"https://falcon.us-2.crowdstrike.com/activity-v2/detections/dhjffg:ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"filename\":\"openvpn-abc-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"grandparent_details\":{\"cmdline\":\"C:\\\\Windows\\\\system32\\\\userinit.exe\",\"filename\":\"userinit.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\System32\\\\userinit.exe\",\"local_process_id\":\"4328\",\"md5\":\"b07f77fd3f9828b2c9d61f8a36609741\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392734873135\",\"process_id\":\"392734873135\",\"sha256\":\"caef4ae19056eeb122a0540508fa8984cea960173ada0dc648cb846d6ef5dd33\",\"timestamp\":\"2023-10-30T16:49:19Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"yuvraj.mahajan\"},\"has_script_or_module_ioc\":\"true\",\"id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"indicator_id\":\"ind:2ce412d17b334ad4adc8c1c54dbfec4b:399748687993-5761-42627600\",\"ioc_context\":[{\"ioc_description\":\"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"ioc_source\":\"library_load\",\"ioc_type\":\"hash_sha256\",\"ioc_value\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"type\":\"module\"}],\"ioc_values\":[],\"is_synthetic_quarantine_disposition\":true,\"local_process_id\":\"17076\",\"logon_domain\":\"ABSYS\",\"md5\":\"cdf9cfebb400ce89d5b6032bfcdc693b\",\"name\":\"PrewittPupAdwareSensorDetect-Lowest\",\"objective\":\"FalconDetectionMethod\",\"overwatch_note\":\"Activity Notice: OverWatch has observed XYZ\",\"overwatch_note_timestamp\":\"2025-03-01T15:31:00Z\",\"parent_details\":{\"cmdline\":\"C:\\\\WINDOWS\\\\Explorer.EXE\",\"filename\":\"explorer.exe\",\"filepath\":\"\\\\Device\\\\HarddiskVolume3\\\\Windows\\\\explorer.exe\",\"local_process_id\":\"1040\",\"md5\":\"8cc3fcdd7d52d2d5221303c213e044ae\",\"process_graph_id\":\"pid:2ce412d17b334ad4adc8c1c54dbfec4b:392736520876\",\"process_id\":\"392736520876\",\"sha256\":\"0b25d56bd2b4d8a6df45beff7be165117fbf7ba6ba2c07744f039143866335e4\",\"timestamp\":\"2023-11-03T18:00:32Z\",\"user_graph_id\":\"uid:2ce412d17b334ad4adc8c1c54dbfec4b:S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\"},\"parent_process_id\":\"392736520876\",\"pattern_disposition\":2176,\"pattern_disposition_description\":\"Prevention/Quarantine,processwasblockedfromexecutionandquarantinewasattempted.\",\"pattern_disposition_details\":{\"blocking_unsupported_or_disabled\":false,\"bootup_safeguard_enabled\":false,\"critical_process_disabled\":false,\"detect\":false,\"fs_operation_blocked\":false,\"handle_operation_downgraded\":false,\"inddet_mask\":false,\"indicator\":false,\"kill_action_failed\":false,\"kill_parent\":false,\"kill_process\":false,\"kill_subprocess\":false,\"operation_blocked\":false,\"policy_disabled\":false,\"process_blocked\":true,\"quarantine_file\":true,\"quarantine_machine\":false,\"registry_operation_blocked\":false,\"rooting\":false,\"sensor_only\":false,\"suspend_parent\":false,\"suspend_process\":false},\"pattern_id\":5761,\"platform\":\"Windows\",\"poly_id\":\"AACSASiWEnxKlIIaw8LWC-8XINBatE2uYZaWqRAAATiEEfPFwhoY4opnh1CQjm0tvUQp4Lu5eOAx29ZVj-qrGrA==\",\"process_end_time\":\"1699034421\",\"process_id\":\"399748687993\",\"process_start_time\":\"1699034413\",\"product\":\"epp\",\"quarantined_files\":[{\"filename\":\"\\\\Device\\\\Volume3\\\\Users\\\\yuvraj.mahajan\\\\AppData\\\\Local\\\\Temp\\\\Temp3cc4c329-2896-461f-9dea-88009eb2e8fb_pfSenseFirewallOpenVPNClients-20230823T120504Z-001.zip\\\\pfSenseFirewallOpenVPNClients\\\\Windows\\\\openvpn-cds-pfSense-UDP4-1194-pfsense-install-2.6.5-I001-amd64.exe\",\"id\":\"2ce412d17b334ad4adc8c1c54dbfec4b_b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"state\":\"quarantined\"}],\"rule_group_id\":\"1b27b7f123c44e15a13fe7f44801d123\",\"rule_group_name\":\"Windows Group\",\"rule_instance_created_by\":\"myuser@mydomain.com\",\"rule_instance_id\":\"123\",\"rule_instance_name\":\"INSTANCE-1\",\"rule_instance_version\":\"1\",\"scenario\":\"NGAV\",\"severity\":30,\"sha1\":\"0000000000000000000000000000000000000000\",\"sha256\":\"b26a6791b72753d2317efd5e1363d93fdd33e611c8b9e08a3b24ea4d755b81fd\",\"show_in_ui\":true,\"source_products\":[\"FalconInsight\"],\"source_vendors\":[\"CrowdStrike\"],\"status\":\"new\",\"tactic\":\"MachineLearning\",\"tactic_id\":\"CSTA0004\",\"technique\":\"Adware/PUP\",\"technique_id\":\"CST0000\",\"timestamp\":\"2023-11-03T18:00:22.328Z\",\"tree_id\":\"1931778\",\"tree_root\":\"38687993\",\"triggering_process_graph_id\":\"pid:2ce4124ad4adc8c1c54dbfec4b:399748687993\",\"type\":\"ldt\",\"updated_timestamp\":\"2023-11-03T19:00:23.985007341Z\",\"user_id\":\"S-1-5-21-1909377054-3469629671-4104191496-4425\",\"user_name\":\"mohit.jha\",\"anode_indicators\":[{\"explanation_metrics_v2\":{\"expected_category_distribution_values\":[0.1428,0.0,0.8569],\"current_category_distribution_values\":[0.05,0.15,0.8],\"category_distribution_difference_values\":[0.0928,-0.15,0.0569]}}]}", "severity": 21, "type": [ "start" diff --git a/packages/crowdstrike/data_stream/alert/fields/fields.yml b/packages/crowdstrike/data_stream/alert/fields/fields.yml index f05a58eb9d5..958b8f8f656 100644 --- a/packages/crowdstrike/data_stream/alert/fields/fields.yml +++ b/packages/crowdstrike/data_stream/alert/fields/fields.yml @@ -27,6 +27,21 @@ type: long - name: alleged_filetype type: keyword + - name: anode_indicators + type: group + fields: + - name: explanation_metrics_v2 + type: group + fields: + - name: expected_category_distribution_values + type: float + description: Expected ANODE category distribution values (polymorphic float/integer array). + - name: current_category_distribution_values + type: float + description: Observed ANODE category distribution values (polymorphic float/integer array). + - name: category_distribution_difference_values + type: float + description: Difference between expected and current ANODE category distribution values (polymorphic float/integer array). - name: assigned_to type: group fields: diff --git a/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log b/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log index 0980bf0fb60..c76a75e84bc 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log +++ b/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log @@ -92,3 +92,4 @@ "UTCTimestamp": 1593186952 } } +{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071491,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","Name":"Anomalous data egress detected","Description":"Bob uploaded an unusual volume to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","Destination":{"Channel":"web"},"UserName":"Bob","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","EgressSessionId":"abc","SessionStartTimestamp":1761915027,"SessionEndTimestamp":1761915027,"UserMapped":true,"FilesEgressedCount":12,"AnodeIndicators":[{"Detected":true,"Destination":"web","Entity":"Bob","Explanation":"Egress volume and file-category mix deviate from the user baseline","Name":"AnomalousDataEgress","Type":"data-volume","Score":0.9243,"DataVolumeIncreasePercentage":405.22,"FileCountIncreasePercentage":87.5,"FileCategoryDistributions":[{"ID":"4689d0386bdd4e2e9423a0fc19dcaccb","Name":"Document","CurrentPercentage":0.8569,"ExpectedPercentage":0.1428,"IncreasePercentage":5.0}]}]}} diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log index 7471623ccb2..d0d2854e32a 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log @@ -1,2 +1,2 @@ {"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressSessionId":"abc","SessionStartTimestamp":1761915027,"SessionEndTimestamp":1761915027,"UserMapped":true,"FilesEgressedCount":12}} -{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressEventId":"180d01b9b65811f0a9f0c0892b3c995e","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"UserNotified":true,"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","IsClipboard":false,"ContentPatterns":[{"ID":"4392b1416c974a488c31fbc4c97e89f6","Name":"Credentials","ConfidenceLevel":3,"MatchCount":1}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","Filename":"sensitive_123.txt","FileType":{"Type":{"ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text","Description":"Plain Text (txt) File","CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document"}},"EventTimestamp":1761915027}} +{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressEventId":"180d01b9b65811f0a9f0c0892b3c995e","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"UserNotified":true,"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","IsClipboard":false,"ContentPatterns":[{"ID":"4392b1416c974a488c31fbc4c97e89f6","Name":"Credentials","ConfidenceLevel":3,"MatchCount":1}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","Filename":"sensitive_123.txt","FileType":{"Type":{"ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text","Description":"Plain Text (txt) File","CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document"}},"EventTimestamp":1761915027,"AnodeIndicators":[{"Detected":true,"Destination":"web","Entity":"Bob","Explanation":"Egress volume and file-category mix deviate from the user baseline","Name":"AnomalousDataEgress","Type":"data-volume","Score":0.9243,"DataVolumeIncreasePercentage":405.22,"FileCountIncreasePercentage":87.5,"FileCategoryDistributions":[{"ID":"4689d0386bdd4e2e9423a0fc19dcaccb","Name":"Document","CurrentPercentage":0.8569,"ExpectedPercentage":0.1428,"IncreasePercentage":5.0}]}]}} diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json index c3a5e409378..aa38dfb41d4 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json @@ -107,6 +107,28 @@ "crowdstrike": { "event": { "AgentId": "5d77282ab4fxxxxxxxxxx65784cfa8f0", + "AnodeIndicators": [ + { + "DataVolumeIncreasePercentage": 405.22, + "Destination": "web", + "Detected": true, + "Entity": "Bob", + "Explanation": "Egress volume and file-category mix deviate from the user baseline", + "FileCategoryDistributions": [ + { + "CurrentPercentage": 0.8569, + "ExpectedPercentage": 0.1428, + "ID": "4689d0386bdd4e2e9423a0fc19dcaccb", + "IncreasePercentage": 5.0, + "Name": "Document" + } + ], + "FileCountIncreasePercentage": 87.5, + "Name": "AnomalousDataEgress", + "Score": 0.9243, + "Type": "data-volume" + } + ], "CompositeId": "2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e", "ContentPatterns": [ { @@ -174,7 +196,7 @@ "created": "2025-10-31T07:23:00.000Z", "id": "180d01b9b65811f0a9f0c0892b3c995e", "kind": "alert", - "original": "{\"metadata\":{\"customerIDString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"offset\":689071490,\"eventType\":\"DataProtectionDetectionSummaryEvent\",\"eventCreationTime\":1761895380000,\"version\":\"1.0\"},\"event\":{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"Name\":\"Test attempted to be uploaded to Google Gmail\",\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"Severity\":90,\"SeverityName\":\"Critical\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq\",\"Destination\":{\"Channel\":\"web\"},\"UserName\":\"Bob\",\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"Hostname\":\"DESKTOP-OM905R2\",\"PatternId\":80005,\"DataVolume\":39,\"DetectionType\":\"rule-based\",\"Platform\":\"Windows\",\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"EgressEventId\":\"180d01b9b65811f0a9f0c0892b3c995e\",\"Policy\":{\"ID\":\"a6e6792845654b69a8a89e793421b77a\",\"Name\":\"Data Protection Policy\"},\"MatchedClassification\":{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"},\"RelatedClassifications\":[{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"}],\"UserNotified\":true,\"ResponseAction\":\"blocked\",\"RuleId\":\"7d81198e7da846b2a664afccc7f5d9e4\",\"IsClipboard\":false,\"ContentPatterns\":[{\"ID\":\"4392b1416c974a488c31fbc4c97e89f6\",\"Name\":\"Credentials\",\"ConfidenceLevel\":3,\"MatchCount\":1}],\"ContentSha\":\"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08\",\"Filename\":\"sensitive_123.txt\",\"FileType\":{\"Type\":{\"ID\":\"48a7eca83afa42a78cf12b8f2f877eec\",\"Name\":\"Plain Text\",\"Description\":\"Plain Text (txt) File\",\"CategoryID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"CategoryName\":\"Document\"}},\"EventTimestamp\":1761915027}}", + "original": "{\"metadata\":{\"customerIDString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"offset\":689071490,\"eventType\":\"DataProtectionDetectionSummaryEvent\",\"eventCreationTime\":1761895380000,\"version\":\"1.0\"},\"event\":{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"Name\":\"Test attempted to be uploaded to Google Gmail\",\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"Severity\":90,\"SeverityName\":\"Critical\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq\",\"Destination\":{\"Channel\":\"web\"},\"UserName\":\"Bob\",\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"Hostname\":\"DESKTOP-OM905R2\",\"PatternId\":80005,\"DataVolume\":39,\"DetectionType\":\"rule-based\",\"Platform\":\"Windows\",\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"EgressEventId\":\"180d01b9b65811f0a9f0c0892b3c995e\",\"Policy\":{\"ID\":\"a6e6792845654b69a8a89e793421b77a\",\"Name\":\"Data Protection Policy\"},\"MatchedClassification\":{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"},\"RelatedClassifications\":[{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"}],\"UserNotified\":true,\"ResponseAction\":\"blocked\",\"RuleId\":\"7d81198e7da846b2a664afccc7f5d9e4\",\"IsClipboard\":false,\"ContentPatterns\":[{\"ID\":\"4392b1416c974a488c31fbc4c97e89f6\",\"Name\":\"Credentials\",\"ConfidenceLevel\":3,\"MatchCount\":1}],\"ContentSha\":\"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08\",\"Filename\":\"sensitive_123.txt\",\"FileType\":{\"Type\":{\"ID\":\"48a7eca83afa42a78cf12b8f2f877eec\",\"Name\":\"Plain Text\",\"Description\":\"Plain Text (txt) File\",\"CategoryID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"CategoryName\":\"Document\"}},\"EventTimestamp\":1761915027,\"AnodeIndicators\":[{\"Detected\":true,\"Destination\":\"web\",\"Entity\":\"Bob\",\"Explanation\":\"Egress volume and file-category mix deviate from the user baseline\",\"Name\":\"AnomalousDataEgress\",\"Type\":\"data-volume\",\"Score\":0.9243,\"DataVolumeIncreasePercentage\":405.22,\"FileCountIncreasePercentage\":87.5,\"FileCategoryDistributions\":[{\"ID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"Name\":\"Document\",\"CurrentPercentage\":0.8569,\"ExpectedPercentage\":0.1428,\"IncreasePercentage\":5.0}]}]}}", "outcome": "failure", "reference": "https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq", "severity": 99, diff --git a/packages/crowdstrike/data_stream/falcon/fields/fields.yml b/packages/crowdstrike/data_stream/falcon/fields/fields.yml index 3a45ba2ca50..ca0c8b6337d 100644 --- a/packages/crowdstrike/data_stream/falcon/fields/fields.yml +++ b/packages/crowdstrike/data_stream/falcon/fields/fields.yml @@ -889,6 +889,41 @@ Commands run in a remote session. - name: AnodeIndicators type: nested + fields: + - name: Detected + type: boolean + - name: Destination + type: keyword + - name: Entity + type: keyword + - name: Explanation + type: keyword + - name: Name + type: keyword + - name: Type + type: keyword + - name: Score + type: float + description: Anomaly score for the indicator. + - name: DataVolumeIncreasePercentage + type: float + description: Observed data volume as a multiple of the entity's baseline. + - name: FileCountIncreasePercentage + type: float + description: Observed file count as a multiple of the entity's baseline. + - name: FileCategoryDistributions + type: group + fields: + - name: ID + type: keyword + - name: Name + type: keyword + - name: CurrentPercentage + type: float + - name: ExpectedPercentage + type: float + - name: IncreasePercentage + type: float - name: ContentPatterns type: group fields: diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log index 4441a6449ee..286a466a5f9 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log @@ -1 +1 @@ -{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","AgentIdString":"5d77282ab4fxxxxxxxxxx65784cfa8f0","cid":"2cc98db1a4xxxxxxxxxxc94d43bfab70","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","ContentPatterns":[{"ConfidenceLevel":3,"ID":"4392b1416c974a488c31fbc4c97e89f6","MatchCount":1,"Name":"Credentials"}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","CustomerIdString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","DataVolume":39,"Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Destination":{"Channel":"web"},"DetectionType":"rule-based","EgressEventId":"89282731b67811f0a9f0c0892b3c995e","eid":118,"EventTimestamp":1761929044,"EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_DataProtectionDetectionSummaryEvent","FalconHostLink":"https://falcon.us-2.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:89282731b67811f0a9f0c0892b3c995e?_cid\u003dg04000alcexxxxxxxxxxnfyokz7bajkq","Filename":"sensitive_123.txt","FileType":{"Type":{"CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document","Description":"Plain Text (txt) File","ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text"}},"Hostname":"DESKTOP-OM905R2","IsClipboard":false,"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"Name":"Test attempted to be uploaded to Google Drive","Nonce":3100301192206752520,"PatternId":80005,"Platform":"Windows","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","Severity":90,"SeverityName":"Critical","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","timestamp":"2025-10-31T11:16:38Z","UserName":"Bob","UserNotified":true,"UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","UTCTimestamp":1761909398} +{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","AgentIdString":"5d77282ab4fxxxxxxxxxx65784cfa8f0","cid":"2cc98db1a4xxxxxxxxxxc94d43bfab70","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","ContentPatterns":[{"ConfidenceLevel":3,"ID":"4392b1416c974a488c31fbc4c97e89f6","MatchCount":1,"Name":"Credentials"}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","CustomerIdString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","DataVolume":39,"Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Destination":{"Channel":"web"},"DetectionType":"rule-based","EgressEventId":"89282731b67811f0a9f0c0892b3c995e","eid":118,"EventTimestamp":1761929044,"EventType":"Event_ExternalApiEvent","ExternalApiType":"Event_DataProtectionDetectionSummaryEvent","FalconHostLink":"https://falcon.us-2.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:89282731b67811f0a9f0c0892b3c995e?_cid\u003dg04000alcexxxxxxxxxxnfyokz7bajkq","Filename":"sensitive_123.txt","FileType":{"Type":{"CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document","Description":"Plain Text (txt) File","ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text"}},"Hostname":"DESKTOP-OM905R2","IsClipboard":false,"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"Name":"Test attempted to be uploaded to Google Drive","Nonce":3100301192206752520,"PatternId":80005,"Platform":"Windows","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","Severity":90,"SeverityName":"Critical","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","timestamp":"2025-10-31T11:16:38Z","UserName":"Bob","UserNotified":true,"UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","UTCTimestamp":1761909398,"AnodeIndicators":[{"Detected":true,"Destination":"web","Entity":"Bob","Explanation":"Egress volume and file-category mix deviate from the user baseline","Name":"AnomalousDataEgress","Type":"data-volume","Score":0.9243,"DataVolumeIncreasePercentage":405.22,"FileCountIncreasePercentage":87.5,"FileCategoryDistributions":[{"ID":"4689d0386bdd4e2e9423a0fc19dcaccb","Name":"Document","CurrentPercentage":0.8569,"ExpectedPercentage":0.1428,"IncreasePercentage":5.0}]}]} diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log-expected.json index cdb340a5bd2..b4cbf8a817d 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr-data-protection-detection-summary.log-expected.json @@ -4,6 +4,28 @@ "@timestamp": "2025-10-31T11:16:38.000Z", "crowdstrike": { "AgentIdString": "5d77282ab4fxxxxxxxxxx65784cfa8f0", + "AnodeIndicators": [ + { + "DataVolumeIncreasePercentage": 405.22, + "Destination": "web", + "Detected": true, + "Entity": "Bob", + "Explanation": "Egress volume and file-category mix deviate from the user baseline", + "FileCategoryDistributions": [ + { + "CurrentPercentage": 0.8569, + "ExpectedPercentage": 0.1428, + "ID": "4689d0386bdd4e2e9423a0fc19dcaccb", + "IncreasePercentage": 5.0, + "Name": "Document" + } + ], + "FileCountIncreasePercentage": 87.5, + "Name": "AnomalousDataEgress", + "Score": 0.9243, + "Type": "data-volume" + } + ], "CompositeId": "2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e", "ContentPatterns": [ { @@ -63,7 +85,7 @@ "created": "2025-10-31T11:16:38.000Z", "id": "||2cc98db1a4xxxxxxxxxxc94d43bfab70", "kind": "alert", - "original": "{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"AgentIdString\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"cid\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"ContentPatterns\":[{\"ConfidenceLevel\":3,\"ID\":\"4392b1416c974a488c31fbc4c97e89f6\",\"MatchCount\":1,\"Name\":\"Credentials\"}],\"ContentSha\":\"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08\",\"CustomerIdString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"DataVolume\":39,\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Destination\":{\"Channel\":\"web\"},\"DetectionType\":\"rule-based\",\"EgressEventId\":\"89282731b67811f0a9f0c0892b3c995e\",\"eid\":118,\"EventTimestamp\":1761929044,\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_DataProtectionDetectionSummaryEvent\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:89282731b67811f0a9f0c0892b3c995e?_cid\\u003dg04000alcexxxxxxxxxxnfyokz7bajkq\",\"Filename\":\"sensitive_123.txt\",\"FileType\":{\"Type\":{\"CategoryID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"CategoryName\":\"Document\",\"Description\":\"Plain Text (txt) File\",\"ID\":\"48a7eca83afa42a78cf12b8f2f877eec\",\"Name\":\"Plain Text\"}},\"Hostname\":\"DESKTOP-OM905R2\",\"IsClipboard\":false,\"MatchedClassification\":{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"},\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"Name\":\"Test attempted to be uploaded to Google Drive\",\"Nonce\":3100301192206752520,\"PatternId\":80005,\"Platform\":\"Windows\",\"Policy\":{\"ID\":\"a6e6792845654b69a8a89e793421b77a\",\"Name\":\"Data Protection Policy\"},\"RelatedClassifications\":[{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"}],\"ResponseAction\":\"blocked\",\"RuleId\":\"7d81198e7da846b2a664afccc7f5d9e4\",\"Severity\":90,\"SeverityName\":\"Critical\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"timestamp\":\"2025-10-31T11:16:38Z\",\"UserName\":\"Bob\",\"UserNotified\":true,\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"UTCTimestamp\":1761909398}", + "original": "{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"AgentIdString\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"cid\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"ContentPatterns\":[{\"ConfidenceLevel\":3,\"ID\":\"4392b1416c974a488c31fbc4c97e89f6\",\"MatchCount\":1,\"Name\":\"Credentials\"}],\"ContentSha\":\"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08\",\"CustomerIdString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"DataVolume\":39,\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Destination\":{\"Channel\":\"web\"},\"DetectionType\":\"rule-based\",\"EgressEventId\":\"89282731b67811f0a9f0c0892b3c995e\",\"eid\":118,\"EventTimestamp\":1761929044,\"EventType\":\"Event_ExternalApiEvent\",\"ExternalApiType\":\"Event_DataProtectionDetectionSummaryEvent\",\"FalconHostLink\":\"https://falcon.us-2.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:89282731b67811f0a9f0c0892b3c995e?_cid\\u003dg04000alcexxxxxxxxxxnfyokz7bajkq\",\"Filename\":\"sensitive_123.txt\",\"FileType\":{\"Type\":{\"CategoryID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"CategoryName\":\"Document\",\"Description\":\"Plain Text (txt) File\",\"ID\":\"48a7eca83afa42a78cf12b8f2f877eec\",\"Name\":\"Plain Text\"}},\"Hostname\":\"DESKTOP-OM905R2\",\"IsClipboard\":false,\"MatchedClassification\":{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"},\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"Name\":\"Test attempted to be uploaded to Google Drive\",\"Nonce\":3100301192206752520,\"PatternId\":80005,\"Platform\":\"Windows\",\"Policy\":{\"ID\":\"a6e6792845654b69a8a89e793421b77a\",\"Name\":\"Data Protection Policy\"},\"RelatedClassifications\":[{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"}],\"ResponseAction\":\"blocked\",\"RuleId\":\"7d81198e7da846b2a664afccc7f5d9e4\",\"Severity\":90,\"SeverityName\":\"Critical\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"timestamp\":\"2025-10-31T11:16:38Z\",\"UserName\":\"Bob\",\"UserNotified\":true,\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"UTCTimestamp\":1761909398,\"AnodeIndicators\":[{\"Detected\":true,\"Destination\":\"web\",\"Entity\":\"Bob\",\"Explanation\":\"Egress volume and file-category mix deviate from the user baseline\",\"Name\":\"AnomalousDataEgress\",\"Type\":\"data-volume\",\"Score\":0.9243,\"DataVolumeIncreasePercentage\":405.22,\"FileCountIncreasePercentage\":87.5,\"FileCategoryDistributions\":[{\"ID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"Name\":\"Document\",\"CurrentPercentage\":0.8569,\"ExpectedPercentage\":0.1428,\"IncreasePercentage\":5.0}]}]}", "outcome": "failure", "reference": "https://falcon.us-2.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:89282731b67811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq", "severity": 99, diff --git a/packages/crowdstrike/data_stream/fdr/fields/fields.yml b/packages/crowdstrike/data_stream/fdr/fields/fields.yml index 11218e21ca4..ce486a0408f 100644 --- a/packages/crowdstrike/data_stream/fdr/fields/fields.yml +++ b/packages/crowdstrike/data_stream/fdr/fields/fields.yml @@ -2021,6 +2021,41 @@ type: keyword - name: AnodeIndicators type: nested + fields: + - name: Detected + type: boolean + - name: Destination + type: keyword + - name: Entity + type: keyword + - name: Explanation + type: keyword + - name: Name + type: keyword + - name: Type + type: keyword + - name: Score + type: float + description: Anomaly score for the indicator. + - name: DataVolumeIncreasePercentage + type: float + description: Observed data volume as a multiple of the entity's baseline. + - name: FileCountIncreasePercentage + type: float + description: Observed file count as a multiple of the entity's baseline. + - name: FileCategoryDistributions + type: group + fields: + - name: ID + type: keyword + - name: Name + type: keyword + - name: CurrentPercentage + type: float + - name: ExpectedPercentage + type: float + - name: IncreasePercentage + type: float - name: ContentPatterns type: group fields: diff --git a/packages/crowdstrike/docs/README.md b/packages/crowdstrike/docs/README.md index b5cbd13df6d..7609bd345d7 100644 --- a/packages/crowdstrike/docs/README.md +++ b/packages/crowdstrike/docs/README.md @@ -823,6 +823,9 @@ An example event for `alert` looks as following: | crowdstrike.alert.aggregate_id | | keyword | | crowdstrike.alert.alert_attributes | | long | | crowdstrike.alert.alleged_filetype | | keyword | +| crowdstrike.alert.anode_indicators.explanation_metrics_v2.category_distribution_difference_values | Difference between expected and current ANODE category distribution values (polymorphic float/integer array). | float | +| crowdstrike.alert.anode_indicators.explanation_metrics_v2.current_category_distribution_values | Observed ANODE category distribution values (polymorphic float/integer array). | float | +| crowdstrike.alert.anode_indicators.explanation_metrics_v2.expected_category_distribution_values | Expected ANODE category distribution values (polymorphic float/integer array). | float | | crowdstrike.alert.assigned_to.name | | keyword | | crowdstrike.alert.assigned_to.uid | | keyword | | crowdstrike.alert.assigned_to.uuid | | keyword | @@ -1281,7 +1284,20 @@ An example event for `falcon` looks as following: | crowdstrike.event.AgentId | | keyword | | crowdstrike.event.AgentIdString | | keyword | | crowdstrike.event.AggregateId | | keyword | -| crowdstrike.event.AnodeIndicators | | nested | +| crowdstrike.event.AnodeIndicators.DataVolumeIncreasePercentage | Observed data volume as a multiple of the entity's baseline. | float | +| crowdstrike.event.AnodeIndicators.Destination | | keyword | +| crowdstrike.event.AnodeIndicators.Detected | | boolean | +| crowdstrike.event.AnodeIndicators.Entity | | keyword | +| crowdstrike.event.AnodeIndicators.Explanation | | keyword | +| crowdstrike.event.AnodeIndicators.FileCategoryDistributions.CurrentPercentage | | float | +| crowdstrike.event.AnodeIndicators.FileCategoryDistributions.ExpectedPercentage | | float | +| crowdstrike.event.AnodeIndicators.FileCategoryDistributions.ID | | keyword | +| crowdstrike.event.AnodeIndicators.FileCategoryDistributions.IncreasePercentage | | float | +| crowdstrike.event.AnodeIndicators.FileCategoryDistributions.Name | | keyword | +| crowdstrike.event.AnodeIndicators.FileCountIncreasePercentage | Observed file count as a multiple of the entity's baseline. | float | +| crowdstrike.event.AnodeIndicators.Name | | keyword | +| crowdstrike.event.AnodeIndicators.Score | Anomaly score for the indicator. | float | +| crowdstrike.event.AnodeIndicators.Type | | keyword | | crowdstrike.event.AnomalousTicketContentClassification | Ticket signature analysis. | keyword | | crowdstrike.event.AssociatedFile | The file associated with the triggering indicator. | keyword | | crowdstrike.event.Attributes | JSON objects containing additional information about the event. | flattened | @@ -1834,7 +1850,20 @@ An example event for `fdr` looks as following: | crowdstrike.AggregateId | | keyword | | crowdstrike.AllocateVirtualMemoryCount | | long | | crowdstrike.AllowlistingFilterId | | keyword | -| crowdstrike.AnodeIndicators | | nested | +| crowdstrike.AnodeIndicators.DataVolumeIncreasePercentage | Observed data volume as a multiple of the entity's baseline. | float | +| crowdstrike.AnodeIndicators.Destination | | keyword | +| crowdstrike.AnodeIndicators.Detected | | boolean | +| crowdstrike.AnodeIndicators.Entity | | keyword | +| crowdstrike.AnodeIndicators.Explanation | | keyword | +| crowdstrike.AnodeIndicators.FileCategoryDistributions.CurrentPercentage | | float | +| crowdstrike.AnodeIndicators.FileCategoryDistributions.ExpectedPercentage | | float | +| crowdstrike.AnodeIndicators.FileCategoryDistributions.ID | | keyword | +| crowdstrike.AnodeIndicators.FileCategoryDistributions.IncreasePercentage | | float | +| crowdstrike.AnodeIndicators.FileCategoryDistributions.Name | | keyword | +| crowdstrike.AnodeIndicators.FileCountIncreasePercentage | Observed file count as a multiple of the entity's baseline. | float | +| crowdstrike.AnodeIndicators.Name | | keyword | +| crowdstrike.AnodeIndicators.Score | Anomaly score for the indicator. | float | +| crowdstrike.AnodeIndicators.Type | | keyword | | crowdstrike.AntiTamperStateFlag | | keyword | | crowdstrike.ApiReturnValue | | keyword | | crowdstrike.ApplicationName | | match_only_text | diff --git a/packages/crowdstrike/manifest.yml b/packages/crowdstrike/manifest.yml index 91d994e852e..d94feaddba1 100644 --- a/packages/crowdstrike/manifest.yml +++ b/packages/crowdstrike/manifest.yml @@ -1,6 +1,6 @@ name: crowdstrike title: CrowdStrike -version: "4.4.0" +version: "4.4.1" description: Collect logs from Crowdstrike with Elastic Agent. type: integration format_version: "3.4.0"