[crowdstrike] Declare ANODE anomaly numeric leaves as float (falcon, fdr, alert)

packages/crowdstrike/_dev/deploy/docker/files/config-alert.yml

@@ -236,7 +236,16 @@ rules:
                 "type": "ldt",
                 "updated_timestamp": "2023-11-03T19:00:23.985007341Z",
                 "user_id": "S-1-5-21-1909377054-3469629671-4104191496-4425",
-                "user_name": "mohit.jha"
+                "user_name": "mohit.jha",
+                "anode_indicators": [
+                  {
+                    "explanation_metrics_v2": {
+                      "expected_category_distribution_values": [0.1428, 0.0, 0.8569],
+                      "current_category_distribution_values": [0.05, 0.15, 0.8],
+                      "category_distribution_difference_values": [0.0928, -0.15, 0.0569]
+                    }
+                  }
+                ]
               }
             ]
           }

packages/crowdstrike/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "4.4.1"
+  changes:
+    - description: Declare the ANODE anomaly-indicator numeric leaves as `float` in the `falcon`, `fdr`, and `alert` data streams. These values are polymorphic (usually fractional, occasionally whole numbers), so leaving them undeclared let dynamic mapping lock them to `long` on integer-first indices and reject later fractional values to the failure store.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20305
 - version: "4.4.0"
   changes:
     - description: >-

packages/crowdstrike/data_stream/alert/fields/fields.yml

@@ -27,6 +27,21 @@
           type: long
         - name: alleged_filetype
           type: keyword
+        - name: anode_indicators
+          type: group
+          fields:
+            - name: explanation_metrics_v2
+              type: group
+              fields:
+                - name: expected_category_distribution_values
+                  type: float
+                  description: Expected ANODE category distribution values (polymorphic float/integer array).
+                - name: current_category_distribution_values
+                  type: float
+                  description: Observed ANODE category distribution values (polymorphic float/integer array).
+                - name: category_distribution_difference_values
+                  type: float
+                  description: Difference between expected and current ANODE category distribution values (polymorphic float/integer array).
         - name: assigned_to
           type: group
           fields:

packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/sample_logs/falcon-events.log

@@ -92,3 +92,4 @@
         "UTCTimestamp": 1593186952
     }
 }
+{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071491,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","Name":"Anomalous data egress detected","Description":"Bob uploaded an unusual volume to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","Destination":{"Channel":"web"},"UserName":"Bob","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","EgressSessionId":"abc","SessionStartTimestamp":1761915027,"SessionEndTimestamp":1761915027,"UserMapped":true,"FilesEgressedCount":12,"AnodeIndicators":[{"Detected":true,"Destination":"web","Entity":"Bob","Explanation":"Egress volume and file-category mix deviate from the user baseline","Name":"AnomalousDataEgress","Type":"data-volume","Score":0.9243,"DataVolumeIncreasePercentage":405.22,"FileCountIncreasePercentage":87.5,"FileCategoryDistributions":[{"ID":"4689d0386bdd4e2e9423a0fc19dcaccb","Name":"Document","CurrentPercentage":0.8569,"ExpectedPercentage":0.1428,"IncreasePercentage":5.0}]}]}}

packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log

@@ -1,2 +1,2 @@
 {"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressSessionId":"abc","SessionStartTimestamp":1761915027,"SessionEndTimestamp":1761915027,"UserMapped":true,"FilesEgressedCount":12}}
-{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressEventId":"180d01b9b65811f0a9f0c0892b3c995e","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"UserNotified":true,"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","IsClipboard":false,"ContentPatterns":[{"ID":"4392b1416c974a488c31fbc4c97e89f6","Name":"Credentials","ConfidenceLevel":3,"MatchCount":1}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","Filename":"sensitive_123.txt","FileType":{"Type":{"ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text","Description":"Plain Text (txt) File","CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document"}},"EventTimestamp":1761915027}}
+{"metadata":{"customerIDString":"2cc98db1a4xxxxxxxxxxc94d43bfab70","offset":689071490,"eventType":"DataProtectionDetectionSummaryEvent","eventCreationTime":1761895380000,"version":"1.0"},"event":{"AgentId":"5d77282ab4fxxxxxxxxxx65784cfa8f0","CompositeId":"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e","Name":"Test attempted to be uploaded to Google Gmail","Description":"Bob attempted to upload sensitive_123.txt to Google Gmail","Tactic":"Exfiltration","TacticId":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueId":"T1567","Severity":90,"SeverityName":"Critical","FalconHostLink":"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq","Destination":{"Channel":"web"},"UserName":"Bob","UserSid":"S-1-5-21-2123450692-2512345670-1234574870-1234","Hostname":"DESKTOP-OM905R2","PatternId":80005,"DataVolume":39,"DetectionType":"rule-based","Platform":"Windows","MitreAttack":[{"Tactic":"Exfiltration","TacticID":"TA0010","Technique":"Exfiltration Over Web Service","TechniqueID":"T1567"}],"EgressEventId":"180d01b9b65811f0a9f0c0892b3c995e","Policy":{"ID":"a6e6792845654b69a8a89e793421b77a","Name":"Data Protection Policy"},"MatchedClassification":{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"},"RelatedClassifications":[{"ID":"8318b19065af48fa839f9259022e5e0a","Name":"Test"}],"UserNotified":true,"ResponseAction":"blocked","RuleId":"7d81198e7da846b2a664afccc7f5d9e4","IsClipboard":false,"ContentPatterns":[{"ID":"4392b1416c974a488c31fbc4c97e89f6","Name":"Credentials","ConfidenceLevel":3,"MatchCount":1}],"ContentSha":"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08","Filename":"sensitive_123.txt","FileType":{"Type":{"ID":"48a7eca83afa42a78cf12b8f2f877eec","Name":"Plain Text","Description":"Plain Text (txt) File","CategoryID":"4689d0386bdd4e2e9423a0fc19dcaccb","CategoryName":"Document"}},"EventTimestamp":1761915027,"AnodeIndicators":[{"Detected":true,"Destination":"web","Entity":"Bob","Explanation":"Egress volume and file-category mix deviate from the user baseline","Name":"AnomalousDataEgress","Type":"data-volume","Score":0.9243,"DataVolumeIncreasePercentage":405.22,"FileCountIncreasePercentage":87.5,"FileCategoryDistributions":[{"ID":"4689d0386bdd4e2e9423a0fc19dcaccb","Name":"Document","CurrentPercentage":0.8569,"ExpectedPercentage":0.1428,"IncreasePercentage":5.0}]}]}}

packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-data-protection-detection-summary.log-expected.json

@@ -107,6 +107,28 @@
             "crowdstrike": {
                 "event": {
                     "AgentId": "5d77282ab4fxxxxxxxxxx65784cfa8f0",
+                    "AnodeIndicators": [
+                        {
+                            "DataVolumeIncreasePercentage": 405.22,
+                            "Destination": "web",
+                            "Detected": true,
+                            "Entity": "Bob",
+                            "Explanation": "Egress volume and file-category mix deviate from the user baseline",
+                            "FileCategoryDistributions": [
+                                {
+                                    "CurrentPercentage": 0.8569,
+                                    "ExpectedPercentage": 0.1428,
+                                    "ID": "4689d0386bdd4e2e9423a0fc19dcaccb",
+                                    "IncreasePercentage": 5.0,
+                                    "Name": "Document"
+                                }
+                            ],
+                            "FileCountIncreasePercentage": 87.5,
+                            "Name": "AnomalousDataEgress",
+                            "Score": 0.9243,
+                            "Type": "data-volume"
+                        }
+                    ],
                     "CompositeId": "2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e",
                     "ContentPatterns": [
                         {
@@ -174,7 +196,7 @@
                 "created": "2025-10-31T07:23:00.000Z",
                 "id": "180d01b9b65811f0a9f0c0892b3c995e",
                 "kind": "alert",
-                "original": "{\"metadata\":{\"customerIDString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"offset\":689071490,\"eventType\":\"DataProtectionDetectionSummaryEvent\",\"eventCreationTime\":1761895380000,\"version\":\"1.0\"},\"event\":{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"Name\":\"Test attempted to be uploaded to Google Gmail\",\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"Severity\":90,\"SeverityName\":\"Critical\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq\",\"Destination\":{\"Channel\":\"web\"},\"UserName\":\"Bob\",\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"Hostname\":\"DESKTOP-OM905R2\",\"PatternId\":80005,\"DataVolume\":39,\"DetectionType\":\"rule-based\",\"Platform\":\"Windows\",\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"EgressEventId\":\"180d01b9b65811f0a9f0c0892b3c995e\",\"Policy\":{\"ID\":\"a6e6792845654b69a8a89e793421b77a\",\"Name\":\"Data Protection Policy\"},\"MatchedClassification\":{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"},\"RelatedClassifications\":[{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"}],\"UserNotified\":true,\"ResponseAction\":\"blocked\",\"RuleId\":\"7d81198e7da846b2a664afccc7f5d9e4\",\"IsClipboard\":false,\"ContentPatterns\":[{\"ID\":\"4392b1416c974a488c31fbc4c97e89f6\",\"Name\":\"Credentials\",\"ConfidenceLevel\":3,\"MatchCount\":1}],\"ContentSha\":\"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08\",\"Filename\":\"sensitive_123.txt\",\"FileType\":{\"Type\":{\"ID\":\"48a7eca83afa42a78cf12b8f2f877eec\",\"Name\":\"Plain Text\",\"Description\":\"Plain Text (txt) File\",\"CategoryID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"CategoryName\":\"Document\"}},\"EventTimestamp\":1761915027}}",
+                "original": "{\"metadata\":{\"customerIDString\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70\",\"offset\":689071490,\"eventType\":\"DataProtectionDetectionSummaryEvent\",\"eventCreationTime\":1761895380000,\"version\":\"1.0\"},\"event\":{\"AgentId\":\"5d77282ab4fxxxxxxxxxx65784cfa8f0\",\"CompositeId\":\"2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e\",\"Name\":\"Test attempted to be uploaded to Google Gmail\",\"Description\":\"Bob attempted to upload sensitive_123.txt to Google Gmail\",\"Tactic\":\"Exfiltration\",\"TacticId\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueId\":\"T1567\",\"Severity\":90,\"SeverityName\":\"Critical\",\"FalconHostLink\":\"https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq\",\"Destination\":{\"Channel\":\"web\"},\"UserName\":\"Bob\",\"UserSid\":\"S-1-5-21-2123450692-2512345670-1234574870-1234\",\"Hostname\":\"DESKTOP-OM905R2\",\"PatternId\":80005,\"DataVolume\":39,\"DetectionType\":\"rule-based\",\"Platform\":\"Windows\",\"MitreAttack\":[{\"Tactic\":\"Exfiltration\",\"TacticID\":\"TA0010\",\"Technique\":\"Exfiltration Over Web Service\",\"TechniqueID\":\"T1567\"}],\"EgressEventId\":\"180d01b9b65811f0a9f0c0892b3c995e\",\"Policy\":{\"ID\":\"a6e6792845654b69a8a89e793421b77a\",\"Name\":\"Data Protection Policy\"},\"MatchedClassification\":{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"},\"RelatedClassifications\":[{\"ID\":\"8318b19065af48fa839f9259022e5e0a\",\"Name\":\"Test\"}],\"UserNotified\":true,\"ResponseAction\":\"blocked\",\"RuleId\":\"7d81198e7da846b2a664afccc7f5d9e4\",\"IsClipboard\":false,\"ContentPatterns\":[{\"ID\":\"4392b1416c974a488c31fbc4c97e89f6\",\"Name\":\"Credentials\",\"ConfidenceLevel\":3,\"MatchCount\":1}],\"ContentSha\":\"21cdfbea0d48077b93b4c4cccb23b7aadfea6f4e7fbb1237fdfd0caebf6efd08\",\"Filename\":\"sensitive_123.txt\",\"FileType\":{\"Type\":{\"ID\":\"48a7eca83afa42a78cf12b8f2f877eec\",\"Name\":\"Plain Text\",\"Description\":\"Plain Text (txt) File\",\"CategoryID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"CategoryName\":\"Document\"}},\"EventTimestamp\":1761915027,\"AnodeIndicators\":[{\"Detected\":true,\"Destination\":\"web\",\"Entity\":\"Bob\",\"Explanation\":\"Egress volume and file-category mix deviate from the user baseline\",\"Name\":\"AnomalousDataEgress\",\"Type\":\"data-volume\",\"Score\":0.9243,\"DataVolumeIncreasePercentage\":405.22,\"FileCountIncreasePercentage\":87.5,\"FileCategoryDistributions\":[{\"ID\":\"4689d0386bdd4e2e9423a0fc19dcaccb\",\"Name\":\"Document\",\"CurrentPercentage\":0.8569,\"ExpectedPercentage\":0.1428,\"IncreasePercentage\":5.0}]}]}}",
                 "outcome": "failure",
                 "reference": "https://falcon.crowdstrike.com/data-protection/detections/2cc98db1a4xxxxxxxxxxc94d43bfab70:data-protection:5d77282ab4fxxxxxxxxxx65784cfa8f0:180d01b9b65811f0a9f0c0892b3c995e?_cid=g04000alcexxxxxxxxxxnfyokz7bajkq",
                 "severity": 99,

packages/crowdstrike/data_stream/falcon/fields/fields.yml

@@ -889,6 +889,41 @@
         Commands run in a remote session.
     - name: AnodeIndicators
       type: nested
+      fields:
+        - name: Detected
+          type: boolean
+        - name: Destination
+          type: keyword
+        - name: Entity
+          type: keyword
+        - name: Explanation
+          type: keyword
+        - name: Name
+          type: keyword
+        - name: Type
+          type: keyword
+        - name: Score
+          type: float
+          description: Anomaly score for the indicator.
+        - name: DataVolumeIncreasePercentage
+          type: float
+          description: Observed data volume as a multiple of the entity's baseline.
+        - name: FileCountIncreasePercentage
+          type: float
+          description: Observed file count as a multiple of the entity's baseline.
+        - name: FileCategoryDistributions
+          type: group
+          fields:
+            - name: ID
+              type: keyword
+            - name: Name
+              type: keyword
+            - name: CurrentPercentage
+              type: float
+            - name: ExpectedPercentage
+              type: float
+            - name: IncreasePercentage
+              type: float
     - name: ContentPatterns
       type: group
       fields: