diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index df31d3c7471..57f8fae237d 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -163,6 +163,7 @@ /packages/beat @elastic/stack-monitoring /packages/beelzebub @elastic/security-service-integrations @elastic/sit-crest-contractors /packages/beyondinsight_password_safe @elastic/security-service-integrations @elastic/sit-crest-contractors +/packages/beyondtrust_epm @elastic/security-service-integrations /packages/beyondtrust_isi @elastic/security-service-integrations @elastic/sit-crest-contractors /packages/beyondtrust_pra @elastic/security-service-integrations @elastic/sit-crest-contractors /packages/bitdefender @elastic/security-service-integrations @elastic/sit-crest-contractors diff --git a/packages/beyondtrust_epm/_dev/build/build.yml b/packages/beyondtrust_epm/_dev/build/build.yml new file mode 100644 index 00000000000..32921896292 --- /dev/null +++ b/packages/beyondtrust_epm/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@v9.3.0 diff --git a/packages/beyondtrust_epm/_dev/build/docs/README.md b/packages/beyondtrust_epm/_dev/build/docs/README.md new file mode 100644 index 00000000000..d80176d0663 --- /dev/null +++ b/packages/beyondtrust_epm/_dev/build/docs/README.md @@ -0,0 +1,146 @@ +# BeyondTrust EPM Integration for Elastic + +## Overview + +[BeyondTrust Endpoint Privilege Management (EPM)](https://www.beyondtrust.com/products/endpoint-privilege-management) is a security solution that enforces least-privilege policies across endpoints, controls application usage, audits privileged activity, and tracks event activity. It helps organizations reduce their attack surface by managing and monitoring privilege escalation, application control, event activity, and configuration changes across users and devices. + +The BeyondTrust EPM integration for Elastic collects audit and event logs using the **BeyondTrust EPM Management API** or through **AWS S3/SQS** cloud storage, and visualizes them in Kibana. + +### Compatibility + +The BeyondTrust EPM integration is compatible with BeyondTrust EPM version **26.1** and Management API version **v3**. + +### How it works + +This integration supports two collection methods: + +- **Direct API polling** via CEL input, which periodically queries the BeyondTrust EPM Management API using OAuth 2.0 (Client Credentials) authentication. +- **Cloud storage** via AWS S3/SQS, for organizations that export audit and event logs from BeyondTrust EPM to an AWS S3 bucket using the built-in SIEM integration. + +## What data does this integration collect? + +This integration collects log messages of the following type: + +- `Audit`: Collects audit logs via the **BeyondTrust EPM Management API** (endpoint: `/management-api/v3/ActivityAudits/Details`) or via **AWS S3/SQS** for organizations that export logs from BeyondTrust EPM to an S3 bucket. +- `Event`: Collects event logs via the **BeyondTrust EPM Management API** (endpoint: `/management-api/v3/Events/search`) or via **AWS S3/SQS** for organizations that export logs from BeyondTrust EPM to an S3 bucket. + +### Supported use cases + +Integrating BeyondTrust EPM with Elastic provides centralized visibility into privileged activity and configuration changes across your endpoints, enabling efficient monitoring, investigation, and compliance reporting within Kibana dashboards. + +## What do I need to use this integration? + +### From BeyondTrust EPM (API collection) + +To collect data via the Management API, you need a **Client ID** and **Client Secret** with OAuth 2.0 Client Credentials authentication. + +1. Sign in to `app.beyondtrust.io`. +2. Navigate to **Configuration** > **API Registration**. +3. Create or select an API client and copy the **Client ID** and **Client Secret**. + +For more information on configuring API registration in BeyondTrust EPM, refer to the [API Settings guide](https://docs.beyondtrust.com/epm-wm/docs/pathfinder-epm-api-settings) in the BeyondTrust documentation. + +### From BeyondTrust EPM (AWS S3 collection) + +To collect data using AWS S3, configure BeyondTrust EPM to export logs to an S3 bucket, then point Elastic at that bucket. + +#### Step 1: Set up AWS infrastructure: + +1. Create an **S3 bucket** and note the bucket name and region. +2. Create an **IAM access policy** with these permissions: + - List: `ListAllMyBuckets` + - Write: `PutObject` + - Read: `GetBucketAcl`, `GetBucketLocation`, `GetUser`, `SimulatePrincipalPolicy` +3. Create an **IAM user** with programmatic access, attach the policy, and save the **Access Key ID** and **Secret Access Key**. + +#### Step 2: Configure SIEM export in BeyondTrust EPM: + +1. Sign in to **app.beyondtrust.io**. +2. Navigate to **Endpoint Privilege Management for Windows and Mac** > **Configuration** > **SIEM Settings**. +3. Select **Enable SIEM Integration**, then choose **S3** as the Integration Type. +4. Enter the **Access Key ID**, **Secret Access Key**, **Bucket** name, and **Region**. +5. Set the data format to **ECS - Elastic Common Schema**. +6. Click **Validate Settings**, then **Save Settings**. + +> **Note:** Only one SIEM integration can be configured at a time. Events are batched and exported to S3 in one-minute intervals in JSON format. + +For more information on configuring SIEM settings in BeyondTrust EPM, refer to the [SIEM Settings guide](https://docs.beyondtrust.com/epm-wm/docs/pathfinder-epm-siem-settings) in the BeyondTrust documentation. + +## How do I deploy this integration? + +This integration supports both Elastic Agentless-based and Agent-based installations. + +### Agentless-based installation + +Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). + +Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. + +### Agent-based installation + +Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host. + +### Configure + +1. In the top search bar in Kibana, search for **Integrations**. +2. In the search bar, type **BeyondTrust EPM**. +3. Select the **BeyondTrust EPM** integration from the search results. +4. Select **Add BeyondTrust EPM** to add the integration. +5. Enable and configure only the collection methods which you will use. + + * To **Collect logs using BeyondTrust EPM API (CEL)**: + + - Set the **URL** to the base URL of your BeyondTrust EPM instance (e.g., `https://app.beyondtrust.io`). + - Set the **Client ID** and **Client Secret** obtained from API Registration. + - Optionally adjust **Initial Interval**, **Interval**, **Page Size**, and **HTTP Client Timeout**. + + * To **Collect logs using AWS S3**: + + - Set the **Bucket ARN** of the S3 bucket configured in BeyondTrust EPM SIEM Settings. + - Set **AWS Access Key ID** and **Secret Access Key** for an IAM user with read access to the bucket. + - Optionally configure **Queue URL** (SQS) if using event-driven notifications instead of bucket polling. + +6. Select **Save and continue** to save the integration. + +## Troubleshooting + +For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems). + +### Validation + +#### Dashboard populated + +1. In the top search bar in Kibana, search for **Dashboards**. +2. In the search bar, type **BeyondTrust EPM**, and verify the dashboard information is populated. + +## Scaling + +For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation. + +## Reference + +### Audit + +#### Audit fields + +{{fields "audit"}} + +### Example event + +#### Audit + +{{event "audit"}} + +### Inputs used + +These inputs are used in the integration: + +- [CEL](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-cel) +- [AWS S3](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-aws-s3) + +### API usage + +This integration dataset uses the following API: + +* List Activity Audit Details (endpoint: `/management-api/v3/ActivityAudits/Details`) +* List Event Details (endpoint: `/management-api/v3/Events/search`) diff --git a/packages/beyondtrust_epm/changelog.yml b/packages/beyondtrust_epm/changelog.yml new file mode 100644 index 00000000000..9dc23e281d5 --- /dev/null +++ b/packages/beyondtrust_epm/changelog.yml @@ -0,0 +1,15 @@ +# newer versions go on top +- version: 0.1.0 + changes: + - description: Initial release of package. + type: enhancement + link: https://github.com/elastic/integrations/pull/20010 + - description: Add support for Event Data Stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/18707 + - description: Remove `preserve_duplicate_custom_fields` config param and add `access_point_arn` config option. + type: enhancement + link: https://github.com/elastic/integrations/pull/19465 + - description: Add support for Audit Data Stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/18635 diff --git a/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/docker/docker-compose.yml b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..3c09a7b07e4 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,15 @@ +version: '3.8' +services: + beyondtrust_epm: + image: docker.elastic.co/observability/stream:v0.20.0 + hostname: beyondtrust_epm + ports: + - 8090 + volumes: + - ./files:/files:ro + environment: + PORT: '8090' + command: + - http-server + - --addr=:8090 + - --config=/files/config.yml diff --git a/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/docker/files/config.yml b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/docker/files/config.yml new file mode 100644 index 00000000000..9c7b31a95ee --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/docker/files/config.yml @@ -0,0 +1,696 @@ +# The BeyondTrust EPM API uses dot-notation query parameter keys (e.g. +# "Pagination.PageSize", "Sorts[0].order"). The stream mock server parses its +# config with ucfg.PathSep("."), which interprets dots as nested-path separators, +# so these keys cannot be used in query_params matching rules. +# +# To exercise pagination despite this, the Details rule omits query_params and +# instead uses response cycling: the stream server rotates through the responses +# list on successive requests to the same path (response index = request_count % +# len(responses)). Page 1 returns pageCount > pageNumber, causing the CEL +# program to set want_more=true and request the next page. Page 2 returns +# pageNumber == pageCount, ending pagination. +rules: + - path: /oauth/connect/token + methods: ['POST'] + query_params: + grant_type: client_credentials + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: | + {"access_token":"xxxx","expires_in":600,"token_type":"Bearer", "scope":"urn:management:api"} + - path: /management-api/v3/ActivityAudits/Details + methods: ['GET'] + request_headers: + Authorization: "Bearer xxxx" + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: |- + {{ minify_json ` + { + "pageNumber": 1, + "pageSize": 1, + "totalRecordCount": 2, + "pageCount": 2, + "data": [ + { + "id": 10574823, + "details": "User john.doe modified security policy settings for Windows Defender Exclusions", + "userId": "a7b5c3d1-8f2e-4a6b-9c3d-e5f7a2b4c6d8", + "user": "john.doe@company.com", + "entity": "PolicyRevision", + "entityName": "Windows_Security_Policy_v2", + "auditType": "PolicyModification", + "created": "2026-04-08T14:32:15.2340000", + "changedBy": "Portal", + "apiClientDataAuditing": { + "newName": "ProductionAPIClient_v2", + "oldName": "ProductionAPIClient", + "newDescription": "Production environment API client for automated deployments", + "oldDescription": "Production API client", + "secretUpdated": false, + "deleted": false + }, + "computerDataAuditing": { + "updatedPoliciesOn": { + "WORKSTATION-001": "Windows_Security_Policy_v2", + "SERVER-DB-01": "Server_Hardening_Policy_v3" + }, + "deactivatedAgents": { + "LAPTOP-042": "Agent inactive for 30 days", + "DESKTOP-178": "Hardware decommissioned" + }, + "newDeletedAgents": [ + "LAPTOP-042", + "DESKTOP-178" + ] + }, + "groupDataAuditing": { + "newName": "Finance_Department_Users", + "oldName": "Finance_Users", + "newDescription": "All finance department users including contractors", + "oldDescription": "Finance department users", + "newIsDefault": false, + "oldIsDefault": false, + "addPolicyRevisions": { + "Finance_Access_Policy": "Revision 3.2", + "Data_Protection_Policy": "Revision 2.1" + }, + "removePolicyRevisions": { + "Legacy_Finance_Policy": "Revision 1.0" + }, + "newAgents": { + "WORKSTATION-501": "Finance_WS_01", + "WORKSTATION-502": "Finance_WS_02" + }, + "removeAgents": { + "WORKSTATION-401": "Migrated to new group" + } + }, + "installationKeyDataAuditing": { + "oldLabel": "Production_Key_2025", + "newLabel": "Production_Key_2026", + "newDisabled": false, + "oldDisabled": false, + "deleted": false + }, + "policyDataAuditing": { + "newName": "Enhanced_Security_Policy", + "oldName": "Standard_Security_Policy", + "newDescription": "Enhanced security policy with additional privilege management rules", + "oldDescription": "Standard security policy for general users" + }, + "policyRevisionDataAuditing": { + "newGroups": { + "IT_Administrators": "Full access", + "Security_Team": "Audit access" + }, + "newAnnotationNote": "Updated policy to include new CVE-2026-1234 mitigation" + }, + "settingsDataAuditing": { + "addDomain": "subsidiary.company.com", + "removeDomain": "subsi.company.com", + "modifyDomainOldValue": "company.local", + "modifyDomainNewValue": "company.com" + }, + "userDataAuditing": { + "newEmailAddress": "john.doe@company.com", + "oldEmailAddress": "j.doe@company.com", + "newOlsonTimeZoneId": "America/New_York", + "oldOlsonTimeZoneId": "UTC", + "newDateTimeDisplayFormat": "MM/dd/yyyy HH:mm:ss", + "oldDateTimeDisplayFormat": "yyyy-MM-dd HH:mm:ss", + "newPreferredLanguage": "en-US", + "oldPreferredLanguage": "en-GB", + "newDisabled": false, + "oldDisabled": false, + "newUserType": "Administrator", + "oldUserType": "Standard", + "deletedAt": "2026-04-08T14:32:15.2340000", + "roles": [ + { + "resourceType": "PolicyManagement", + "resourceId": "f4g7h8i9-2j3k-4l5m-6n7o-p8q9r0s1t2u3", + "resourceName": "Global_Policy_Manager", + "newRoles": [ + { + "roleId": "b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9", + "roleName": "Security Administrator" + } + ], + "oldRoles": [ + { + "roleId": "a5b6c7d8-1e2f-3g4h-5i6j-k7l8m9n0o1p2", + "roleName": "Policy Viewer" + } + ] + } + ], + "newPermissionSets": [ + { + "permissionSetId": "d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6", + "permissionSetName": "Full_Admin_Access" + } + ], + "oldPermissionSets": [ + { + "permissionSetId": "c0d1e2f3-4g5h-6i7j-8k9l-m0n1o2p3q4r5", + "permissionSetName": "Read_Only_Access" + } + ] + }, + "openIdConfigDataAuditing": { + "oldAuthenticationType": "SAML", + "newAuthenticationType": "OAuth2", + "oldDomain": "auth.company.local", + "newDomain": "auth.company.com", + "oldClientId": "beyondtrust-client-prod-v1", + "newClientId": "beyondtrust-client-prod-v2", + "secretUpdated": true, + "oldOpenIDConnectProvider": "https://login.company.local", + "newOpenIDConnectProvider": "https://login.company.com" + }, + "mmcRemoteClientDataAuditing": { + "enabled": true, + "oldEnabled": false, + "clientId": "e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7", + "oldClientId": "d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6" + }, + "computerPolicyDataAuditing": { + "oldInactivityAgentDeactivationDays": 60, + "oldEnableDeactivatedAgentDeletion": false, + "oldDeactivatedAgentDeletionDays": 90, + "inactivityAgentDeactivationDays": 30, + "enableDeactivatedAgentDeletion": true, + "deactivatedAgentDeletionDays": 60 + }, + "azureADIntegrationDataAuditing": { + "oldAzureAdTenantId": "12345678-1234-1234-1234-123456789012", + "oldAzureAdClientId": "abcdef01-2345-6789-abcd-ef0123456789", + "oldAzureAdClientSecret": "***", + "oldAzureAdUseCertificateAuth": false, + "oldAzureAdIntegrationEnabled": false, + "azureAdTenantId": "87654321-4321-4321-4321-210987654321", + "azureAdClientId": "fedcba98-7654-3210-fedc-ba9876543210", + "azureAdClientSecret": "***", + "azureAdUseCertificateAuth": true, + "azureAdIntegrationEnabled": true, + "azureAdConfigChanged": true + }, + "authorizationRequestDataAuditing": { + "oldAuthRequestIntegrationEnabled": false, + "oldAuthRequestHostName": "auth-old.company.local", + "oldAuthRequestClientId": "bt-auth-client-v1", + "oldAuthRequestClientSecret": "***", + "oldAuthRequestPassword": "***", + "oldAuthRequestUserName": "bt_service_account", + "oldAuthRequestApiClientId": "api-client-v1", + "oldAuthRequestApiClientSecret": "***", + "authRequestIntegrationEnabled": true, + "authRequestHostName": "auth.company.com", + "authRequestClientId": "bt-auth-client-v2", + "authRequestClientSecret": "***", + "authRequestPassword": "***", + "authRequestUserName": "bt_service_account_v2", + "authRequestApiClientId": "api-client-v2", + "authRequestApiClientSecret": "***", + "authRequestConfigChanged": true + }, + "reputationSettingsDataAuditing": { + "oldReputationIntegrationEnabled": false, + "oldReputationIntegrationApiKey": "***", + "reputationIntegrationEnabled": true, + "reputationIntegrationApiKey": "***", + "reputationConfigChanged": true + }, + "securitySettingsDataAuditing": { + "tokenTimeout": 3600, + "oldTokenTimeout": 7200 + }, + "siemIntegrationBaseDetailModel": { + "siemIntegrationEnabled": true, + "siemIntegrationType": "Splunk", + "siemFormat": "JSON" + }, + "siemIntegrationQradarAuditing": { + "siemIntegrationEnabled": false, + "siemIntegrationType": "QRadar", + "siemFormat": "LEEF", + "hostName": "qradar.company.com", + "port": "514", + "cert": "-----BEGIN CERTIFICATE-----\nMIID...certificate...content\n-----END CERTIFICATE-----" + }, + "siemIntegrationS3Auditing": { + "siemIntegrationEnabled": true, + "siemIntegrationType": "AWS", + "siemFormat": "JSON", + "siemAccessKeyId": "AKIAIOSFODNN7EXAMPLE", + "siemBucketName": "company-beyondtrust-logs", + "siemCodec": "gzip", + "siemRegionName": "us-east-1", + "siemSseEnabled": true + }, + "siemIntegrationSentinelAuditing": { + "siemIntegrationEnabled": true, + "siemIntegrationType": "Sentinel", + "siemFormat": "JSON", + "tableName": "BeyondTrustAuditLogs", + "workspaceId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890" + }, + "siemIntegrationSplunkAuditing": { + "siemIntegrationEnabled": true, + "siemIntegrationType": "Splunk", + "siemFormat": "JSON", + "hostName": "splunk-hec.company.com", + "index": "beyondtrust_audit" + }, + "agentDataAuditing": { + "newAgentId": "f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0", + "oldAgentId": "e4f5g6h7-8i9j-0k1l-2m3n-o4p5q6r7s8t9", + "newTimestamp": "2026-04-08T14:30:00.0000000", + "oldTimestamp": "2026-04-08T14:00:00.0000000", + "newHostType": "Windows Server", + "oldHostType": "Windows Workstation", + "newOsName": "Windows Server 2022", + "oldOsName": "Windows 10 Enterprise", + "newAdapterVersion": "25.1.0.234", + "oldAdapterVersion": "25.0.1.198", + "newComputerGroupId": "g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1", + "oldComputerGroupId": "f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0", + "newComputerGroupName": "Production_Servers", + "oldComputerGroupName": "Workstations" + }, + "managementRuleDataAuditing": { + "newPriority": 100, + "oldPriority": 50 + }, + "autoUpdateRateLimitDataAuditing": { + "oldPmRequestsLimits": 100, + "oldPmRequestsLimitMinutes": 60, + "pmRequestsLimits": 200, + "pmRequestsLimitMinutes": 30 + }, + "autoUpdateGroupConfigSettingsDataAuditing": { + "newEnableAutoUpdate": "true", + "newUseLatestVersion": "true", + "newClientVersion": "25.1.0", + "newAdapterVersion": "25.1.0.234", + "oldEnableAutoUpdate": "false", + "oldUseLatestVersion": "false", + "oldClientVersion": "25.0.0", + "oldAdapterVersion": "25.0.1.198" + }, + "autoUpdateGroupClientSettingsDataAuditing": { + "oldAppEventLogType": "Warning", + "oldBeyondInsightCertName": "BeyondInsight_Prod_2025", + "oldBeyondInsightUrl": "https://beyondinsight.company.local", + "oldBeyondInsightWorkGroup": "WORKGROUP", + "oldCertMode": "Thumbprint", + "oldConfigAuditEnabled": "false", + "oldConfigAuditMode": "Basic", + "oldCrlFailOpen": "false", + "oldDownloadAuditMode": "Minimal", + "oldHookLoadMethod": "Standard", + "oldPolicyEnabled": "true", + "oldPolicyPrecedence": "Local", + "oldPsMode": "Restricted", + "newPsMode": "Full", + "newBeyondInsightCertName": "BeyondInsight_Prod_2026", + "newBeyondInsightUrl": "https://beyondinsight.company.com", + "newBeyondInsightWorkGroup": "DOMAIN", + "newAppEventLogType": "Information", + "newHookLoadMethod": "Advanced", + "newCertMode": "Subject", + "newConfigAuditEnabled": "true", + "newConfigAuditMode": "Detailed", + "newCrlFailOpen": "true", + "newDownloadAuditMode": "Verbose", + "newPolicyEnabled": "true", + "newPolicyPrecedence": "Central" + }, + "permissionGroupDataAuditing": { + "permissionSetId": "h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2", + "newName": "Advanced_Security_Permissions", + "oldName": "Basic_Security_Permissions", + "newDescription": "Full security administration permissions including audit and compliance", + "oldDescription": "Basic security permissions for viewing", + "newNumberOfUsers": "25", + "oldNumberOfUsers": "50" + }, + "autoUpdateGroupMacClientSettingsDataAuditing": { + "newAntiTamper": "enabled", + "newMountAssist": "enabled", + "newSudoEnabled": "true", + "newBiometricAuthenticationEnabled": "true", + "newBadgeIcons": "visible", + "oldAntiTamper": "disabled", + "oldMountAssist": "disabled", + "oldSudoEnabled": "false", + "oldBiometricAuthenticationEnabled": "false", + "oldBadgeIcons": "hidden" + } + } + ] + } + `}} + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: |- + {{ minify_json ` + { + "pageNumber": 2, + "pageSize": 1, + "totalRecordCount": 2, + "pageCount": 2, + "data": [ + { + "id": 10574824, + "details": "User jane.smith modified group membership and role assignments for IT Operations team", + "userId": "b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9", + "user": "jane.smith@company.com", + "entity": "Group", + "entityName": "IT_Operations_Group_v2", + "auditType": "GroupModification", + "created": "2026-04-09T09:15:42.5612340", + "changedBy": "API", + "apiClientDataAuditing": { + "newName": "StagingAPIClient_v2", + "oldName": "StagingAPIClient", + "newDescription": "Staging environment API client for CI/CD pipeline integrations", + "oldDescription": "Staging API client for testing", + "secretUpdated": true, + "deleted": false + }, + "computerDataAuditing": { + "updatedPoliciesOn": { + "WORKSTATION-101": "IT_Operations_Policy_v3", + "SERVER-APP-02": "Application_Server_Policy_v2" + }, + "deactivatedAgents": { + "LAPTOP-055": "Agent inactive for 45 days", + "DESKTOP-203": "Replaced by virtual machine" + }, + "newDeletedAgents": [ + "LAPTOP-055", + "DESKTOP-203" + ] + }, + "groupDataAuditing": { + "newName": "IT_Operations_Team", + "oldName": "IT_Operations", + "newDescription": "IT Operations team including on-call engineers and support staff", + "oldDescription": "IT Operations core team", + "newIsDefault": true, + "oldIsDefault": false, + "addPolicyRevisions": { + "IT_Operations_Policy": "Revision 4.1", + "Endpoint_Management_Policy": "Revision 1.5" + }, + "removePolicyRevisions": { + "Legacy_IT_Policy": "Revision 2.0", + "Deprecated_Access_Policy": "Revision 1.2" + }, + "newAgents": { + "WORKSTATION-601": "IT_Ops_WS_01", + "WORKSTATION-602": "IT_Ops_WS_02", + "WORKSTATION-603": "IT_Ops_WS_03" + }, + "removeAgents": { + "WORKSTATION-502": "Transferred to Finance group", + "WORKSTATION-503": "Decommissioned" + } + }, + "installationKeyDataAuditing": { + "oldLabel": "Staging_Key_2025", + "newLabel": "Staging_Key_2026", + "newDisabled": false, + "oldDisabled": true, + "deleted": false + }, + "policyDataAuditing": { + "newName": "IT_Operations_Hardening_Policy", + "oldName": "IT_Operations_Standard_Policy", + "newDescription": "Hardened IT operations policy with strict privilege controls and audit logging", + "oldDescription": "Standard IT operations policy for general access" + }, + "policyRevisionDataAuditing": { + "newGroups": { + "IT_Administrators": "Full access", + "IT_Operations": "Read-write access", + "Help_Desk": "Read-only access" + }, + "newAnnotationNote": "Revised policy to enforce least-privilege access following Q1 security audit findings" + }, + "settingsDataAuditing": { + "addDomain": "it-ops.company.com", + "removeDomain": "it.company.local", + "modifyDomainOldValue": "operations.company.local", + "modifyDomainNewValue": "operations.company.com" + }, + "userDataAuditing": { + "newEmailAddress": "jane.smith@company.com", + "oldEmailAddress": "j.smith@company.com", + "newOlsonTimeZoneId": "America/Chicago", + "oldOlsonTimeZoneId": "America/Los_Angeles", + "newDateTimeDisplayFormat": "dd/MM/yyyy HH:mm:ss", + "oldDateTimeDisplayFormat": "MM/dd/yyyy HH:mm:ss", + "newPreferredLanguage": "en-US", + "oldPreferredLanguage": "en-AU", + "newDisabled": false, + "oldDisabled": true, + "newUserType": "Auditor", + "oldUserType": "Standard", + "deletedAt": "2026-04-09T09:15:42.5612340", + "roles": [ + { + "resourceType": "GroupManagement", + "resourceId": "g5h6i7j8-3k4l-5m6n-7o8p-q9r0s1t2u3v4", + "resourceName": "IT_Operations_Manager", + "newRoles": [ + { + "roleId": "c9d7e5f3-0a4b-6c8d-2e0f-g4h2i8j0k2l4", + "roleName": "Group Administrator" + } + ], + "oldRoles": [ + { + "roleId": "b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9", + "roleName": "Group Member" + } + ] + } + ], + "newPermissionSets": [ + { + "permissionSetId": "e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7", + "permissionSetName": "IT_Ops_Admin_Access" + } + ], + "oldPermissionSets": [ + { + "permissionSetId": "d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6", + "permissionSetName": "Standard_User_Access" + } + ] + }, + "openIdConfigDataAuditing": { + "oldAuthenticationType": "LocalDB", + "newAuthenticationType": "SAML", + "oldDomain": "sso.company.local", + "newDomain": "sso.company.com", + "oldClientId": "beyondtrust-sso-staging-v1", + "newClientId": "beyondtrust-sso-staging-v2", + "secretUpdated": false, + "oldOpenIDConnectProvider": "https://sso.company.local", + "newOpenIDConnectProvider": "https://sso.company.com" + }, + "mmcRemoteClientDataAuditing": { + "enabled": false, + "oldEnabled": true, + "clientId": "f3g4h5i6-7j8k-9l0m-1n2o-p3q4r5s6t7u8", + "oldClientId": "e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7" + }, + "computerPolicyDataAuditing": { + "oldInactivityAgentDeactivationDays": 90, + "oldEnableDeactivatedAgentDeletion": true, + "oldDeactivatedAgentDeletionDays": 120, + "inactivityAgentDeactivationDays": 45, + "enableDeactivatedAgentDeletion": true, + "deactivatedAgentDeletionDays": 90 + }, + "azureADIntegrationDataAuditing": { + "oldAzureAdTenantId": "11223344-5566-7788-9900-aabbccddeeff", + "oldAzureAdClientId": "aabbccdd-1122-3344-5566-778899001122", + "oldAzureAdClientSecret": "***", + "oldAzureAdUseCertificateAuth": true, + "oldAzureAdIntegrationEnabled": true, + "azureAdTenantId": "99887766-5544-3322-1100-ffeeddccbbaa", + "azureAdClientId": "ffeeddc0-9988-7766-5544-332211009988", + "azureAdClientSecret": "***", + "azureAdUseCertificateAuth": true, + "azureAdIntegrationEnabled": true, + "azureAdConfigChanged": true + }, + "authorizationRequestDataAuditing": { + "oldAuthRequestIntegrationEnabled": true, + "oldAuthRequestHostName": "auth-staging.company.local", + "oldAuthRequestClientId": "bt-auth-staging-v1", + "oldAuthRequestClientSecret": "***", + "oldAuthRequestPassword": "***", + "oldAuthRequestUserName": "bt_staging_account", + "oldAuthRequestApiClientId": "api-staging-v1", + "oldAuthRequestApiClientSecret": "***", + "authRequestIntegrationEnabled": true, + "authRequestHostName": "auth-staging.company.com", + "authRequestClientId": "bt-auth-staging-v2", + "authRequestClientSecret": "***", + "authRequestPassword": "***", + "authRequestUserName": "bt_staging_account_v2", + "authRequestApiClientId": "api-staging-v2", + "authRequestApiClientSecret": "***", + "authRequestConfigChanged": true + }, + "reputationSettingsDataAuditing": { + "oldReputationIntegrationEnabled": true, + "oldReputationIntegrationApiKey": "***", + "reputationIntegrationEnabled": true, + "reputationIntegrationApiKey": "***", + "reputationConfigChanged": true + }, + "securitySettingsDataAuditing": { + "tokenTimeout": 1800, + "oldTokenTimeout": 3600 + }, + "siemIntegrationBaseDetailModel": { + "siemIntegrationEnabled": true, + "siemIntegrationType": "Sentinel", + "siemFormat": "JSON" + }, + "siemIntegrationQradarAuditing": { + "siemIntegrationEnabled": true, + "siemIntegrationType": "QRadar", + "siemFormat": "LEEF", + "hostName": "qradar-staging.company.com", + "port": "6514", + "cert": "-----BEGIN CERTIFICATE-----\nMIIE...staging-certificate...content\n-----END CERTIFICATE-----" + }, + "siemIntegrationS3Auditing": { + "siemIntegrationEnabled": false, + "siemIntegrationType": "AWS", + "siemFormat": "JSON", + "siemAccessKeyId": "AKIAI9SFODNN7STAGING", + "siemBucketName": "company-beyondtrust-staging-logs", + "siemCodec": "none", + "siemRegionName": "us-west-2", + "siemSseEnabled": false + }, + "siemIntegrationSentinelAuditing": { + "siemIntegrationEnabled": true, + "siemIntegrationType": "Sentinel", + "siemFormat": "JSON", + "tableName": "BeyondTrustStagingLogs", + "workspaceId": "b2c3d4e5-f6a7-8901-bcde-fg2345678901" + }, + "siemIntegrationSplunkAuditing": { + "siemIntegrationEnabled": false, + "siemIntegrationType": "Splunk", + "siemFormat": "JSON", + "hostName": "splunk-staging.company.com", + "index": "beyondtrust_staging" + }, + "agentDataAuditing": { + "newAgentId": "g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1", + "oldAgentId": "f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0", + "newTimestamp": "2026-04-09T09:10:00.0000000", + "oldTimestamp": "2026-04-09T08:45:00.0000000", + "newHostType": "Windows Workstation", + "oldHostType": "Windows Workstation", + "newOsName": "Windows 11 Enterprise", + "oldOsName": "Windows 10 Enterprise", + "newAdapterVersion": "25.1.0.234", + "oldAdapterVersion": "24.4.2.156", + "newComputerGroupId": "h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2", + "oldComputerGroupId": "g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1", + "newComputerGroupName": "IT_Operations_Workstations", + "oldComputerGroupName": "General_Workstations" + }, + "managementRuleDataAuditing": { + "newPriority": 75, + "oldPriority": 25 + }, + "autoUpdateRateLimitDataAuditing": { + "oldPmRequestsLimits": 150, + "oldPmRequestsLimitMinutes": 45, + "pmRequestsLimits": 300, + "pmRequestsLimitMinutes": 60 + }, + "autoUpdateGroupConfigSettingsDataAuditing": { + "newEnableAutoUpdate": "true", + "newUseLatestVersion": "false", + "newClientVersion": "25.1.0", + "newAdapterVersion": "25.1.0.234", + "oldEnableAutoUpdate": "true", + "oldUseLatestVersion": "true", + "oldClientVersion": "24.4.0", + "oldAdapterVersion": "24.4.2.156" + }, + "autoUpdateGroupClientSettingsDataAuditing": { + "oldAppEventLogType": "Error", + "oldBeyondInsightCertName": "BeyondInsight_Staging_2025", + "oldBeyondInsightUrl": "https://beyondinsight-staging.company.local", + "oldBeyondInsightWorkGroup": "STAGING", + "oldCertMode": "Subject", + "oldConfigAuditEnabled": "true", + "oldConfigAuditMode": "Basic", + "oldCrlFailOpen": "true", + "oldDownloadAuditMode": "Standard", + "oldHookLoadMethod": "Standard", + "oldPolicyEnabled": "true", + "oldPolicyPrecedence": "Central", + "oldPsMode": "Restricted", + "newPsMode": "Restricted", + "newBeyondInsightCertName": "BeyondInsight_Staging_2026", + "newBeyondInsightUrl": "https://beyondinsight-staging.company.com", + "newBeyondInsightWorkGroup": "STAGING", + "newAppEventLogType": "Warning", + "newHookLoadMethod": "Standard", + "newCertMode": "Thumbprint", + "newConfigAuditEnabled": "true", + "newConfigAuditMode": "Detailed", + "newCrlFailOpen": "false", + "newDownloadAuditMode": "Standard", + "newPolicyEnabled": "true", + "newPolicyPrecedence": "Central" + }, + "permissionGroupDataAuditing": { + "permissionSetId": "i8j9k0l1-2m3n-4o5p-6q7r-s8t9u0v1w2x3", + "newName": "IT_Operations_Permissions", + "oldName": "IT_Standard_Permissions", + "newDescription": "IT Operations team permissions with elevated endpoint management rights", + "oldDescription": "Standard IT permissions for basic endpoint access", + "newNumberOfUsers": "18", + "oldNumberOfUsers": "30" + }, + "autoUpdateGroupMacClientSettingsDataAuditing": { + "newAntiTamper": "enabled", + "newMountAssist": "disabled", + "newSudoEnabled": "false", + "newBiometricAuthenticationEnabled": "true", + "newBadgeIcons": "hidden", + "oldAntiTamper": "disabled", + "oldMountAssist": "disabled", + "oldSudoEnabled": "false", + "oldBiometricAuthenticationEnabled": "false", + "oldBadgeIcons": "hidden" + } + } + ] + } + `}} diff --git a/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/tf/env.yml b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/tf/env.yml new file mode 100644 index 00000000000..aee5f1c5900 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/tf/env.yml @@ -0,0 +1,9 @@ +version: '2.3' +services: + terraform: + environment: + - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} + - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} + - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} + - AWS_DEFAULT_PROFILE=${AWS_DEFAULT_PROFILE} + - AWS_REGION=${AWS_REGION:-us-east-1} diff --git a/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/tf/files/test-audit.log b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/tf/files/test-audit.log new file mode 100644 index 00000000000..3e78348c6f8 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/tf/files/test-audit.log @@ -0,0 +1,4 @@ +{"id":10574823,"details":"User john.doe modified security policy settings for Windows Defender Exclusions","userId":"a7b5c3d1-8f2e-4a6b-9c3d-e5f7a2b4c6d8","user":"john.doe@company.com","entity":"PolicyRevision","entityName":"Windows_Security_Policy_v2","auditType":"PolicyModification","created":"2026-04-08T14:32:15.2340000","changedBy":"Portal","apiClientDataAuditing":{"newName":"ProductionAPIClient_v2","oldName":"ProductionAPIClient","newDescription":"Production environment API client for automated deployments","oldDescription":"Production API client","secretUpdated":false,"deleted":false},"computerDataAuditing":{"updatedPoliciesOn":{"WORKSTATION-001":"Windows_Security_Policy_v2","SERVER-DB-01":"Server_Hardening_Policy_v3"},"deactivatedAgents":{"LAPTOP-042":"Agent inactive for 30 days","DESKTOP-178":"Hardware decommissioned"},"newDeletedAgents":["LAPTOP-042","DESKTOP-178"]},"groupDataAuditing":{"newName":"Finance_Department_Users","oldName":"Finance_Users","newDescription":"All finance department users including contractors","oldDescription":"Finance department users","newIsDefault":false,"oldIsDefault":false,"addPolicyRevisions":{"Finance_Access_Policy":"Revision 3.2","Data_Protection_Policy":"Revision 2.1"},"removePolicyRevisions":{"Legacy_Finance_Policy":"Revision 1.0"},"newAgents":{"WORKSTATION-501":"Finance_WS_01","WORKSTATION-502":"Finance_WS_02"},"removeAgents":{"WORKSTATION-401":"Migrated to new group"}},"installationKeyDataAuditing":{"oldLabel":"Production_Key_2025","newLabel":"Production_Key_2026","newDisabled":false,"oldDisabled":false,"deleted":false},"policyDataAuditing":{"newName":"Enhanced_Security_Policy","oldName":"Standard_Security_Policy","newDescription":"Enhanced security policy with additional privilege management rules","oldDescription":"Standard security policy for general users"},"policyRevisionDataAuditing":{"newGroups":{"IT_Administrators":"Full access","Security_Team":"Audit access"},"newAnnotationNote":"Updated policy to include new CVE-2026-1234 mitigation"},"settingsDataAuditing":{"addDomain":"subsidiary.company.com","removeDomain":"subsi.company.com","modifyDomainOldValue":"company.local","modifyDomainNewValue":"company.com"},"userDataAuditing":{"newEmailAddress":"john.doe@company.com","oldEmailAddress":"j.doe@company.com","newOlsonTimeZoneId":"America/New_York","oldOlsonTimeZoneId":"UTC","newDateTimeDisplayFormat":"MM/dd/yyyy HH:mm:ss","oldDateTimeDisplayFormat":"yyyy-MM-dd HH:mm:ss","newPreferredLanguage":"en-US","oldPreferredLanguage":"en-GB","newDisabled":false,"oldDisabled":false,"newUserType":"Administrator","oldUserType":"Standard","deletedAt":"2026-04-08T14:32:15.2340000","roles":[{"resourceType":"PolicyManagement","resourceId":"f4g7h8i9-2j3k-4l5m-6n7o-p8q9r0s1t2u3","resourceName":"Global_Policy_Manager","newRoles":[{"roleId":"b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9","roleName":"Security Administrator"}],"oldRoles":[{"roleId":"a5b6c7d8-1e2f-3g4h-5i6j-k7l8m9n0o1p2","roleName":"Policy Viewer"}]}],"newPermissionSets":[{"permissionSetId":"d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6","permissionSetName":"Full_Admin_Access"}],"oldPermissionSets":[{"permissionSetId":"c0d1e2f3-4g5h-6i7j-8k9l-m0n1o2p3q4r5","permissionSetName":"Read_Only_Access"}]},"openIdConfigDataAuditing":{"oldAuthenticationType":"SAML","newAuthenticationType":"OAuth2","oldDomain":"auth.company.local","newDomain":"auth.company.com","oldClientId":"beyondtrust-client-prod-v1","newClientId":"beyondtrust-client-prod-v2","secretUpdated":true,"oldOpenIDConnectProvider":"https://login.company.local","newOpenIDConnectProvider":"https://login.company.com"},"mmcRemoteClientDataAuditing":{"enabled":true,"oldEnabled":false,"clientId":"e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7","oldClientId":"d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6"},"computerPolicyDataAuditing":{"oldInactivityAgentDeactivationDays":60,"oldEnableDeactivatedAgentDeletion":false,"oldDeactivatedAgentDeletionDays":90,"inactivityAgentDeactivationDays":30,"enableDeactivatedAgentDeletion":true,"deactivatedAgentDeletionDays":60},"azureADIntegrationDataAuditing":{"oldAzureAdTenantId":"12345678-1234-1234-1234-123456789012","oldAzureAdClientId":"abcdef01-2345-6789-abcd-ef0123456789","oldAzureAdClientSecret":"***","oldAzureAdUseCertificateAuth":false,"oldAzureAdIntegrationEnabled":false,"azureAdTenantId":"87654321-4321-4321-4321-210987654321","azureAdClientId":"fedcba98-7654-3210-fedc-ba9876543210","azureAdClientSecret":"***","azureAdUseCertificateAuth":true,"azureAdIntegrationEnabled":true,"azureAdConfigChanged":true},"authorizationRequestDataAuditing":{"oldAuthRequestIntegrationEnabled":false,"oldAuthRequestHostName":"auth-old.company.local","oldAuthRequestClientId":"bt-auth-client-v1","oldAuthRequestClientSecret":"***","oldAuthRequestPassword":"***","oldAuthRequestUserName":"bt_service_account","oldAuthRequestApiClientId":"api-client-v1","oldAuthRequestApiClientSecret":"***","authRequestIntegrationEnabled":true,"authRequestHostName":"auth.company.com","authRequestClientId":"bt-auth-client-v2","authRequestClientSecret":"***","authRequestPassword":"***","authRequestUserName":"bt_service_account_v2","authRequestApiClientId":"api-client-v2","authRequestApiClientSecret":"***","authRequestConfigChanged":true},"reputationSettingsDataAuditing":{"oldReputationIntegrationEnabled":false,"oldReputationIntegrationApiKey":"***","reputationIntegrationEnabled":true,"reputationIntegrationApiKey":"***","reputationConfigChanged":true},"securitySettingsDataAuditing":{"tokenTimeout":3600,"oldTokenTimeout":7200},"siemIntegrationBaseDetailModel":{"siemIntegrationEnabled":true,"siemIntegrationType":"Splunk","siemFormat":"JSON"},"siemIntegrationQradarAuditing":{"siemIntegrationEnabled":false,"siemIntegrationType":"QRadar","siemFormat":"LEEF","hostName":"qradar.company.com","port":"514","cert":"-----BEGIN CERTIFICATE-----\nMIID...certificate...content\n-----END CERTIFICATE-----"},"siemIntegrationS3Auditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"AWS","siemFormat":"JSON","siemAccessKeyId":"AKIAIOSFODNN7EXAMPLE","siemBucketName":"company-beyondtrust-logs","siemCodec":"gzip","siemRegionName":"us-east-1","siemSseEnabled":true},"siemIntegrationSentinelAuditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"Sentinel","siemFormat":"JSON","tableName":"BeyondTrustAuditLogs","workspaceId":"a1b2c3d4-e5f6-7890-abcd-ef1234567890"},"siemIntegrationSplunkAuditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"Splunk","siemFormat":"JSON","hostName":"splunk-hec.company.com","index":"beyondtrust_audit"},"agentDataAuditing":{"newAgentId":"f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0","oldAgentId":"e4f5g6h7-8i9j-0k1l-2m3n-o4p5q6r7s8t9","newTimestamp":"2026-04-08T14:30:00.0000000","oldTimestamp":"2026-04-08T14:00:00.0000000","newHostType":"Windows Server","oldHostType":"Windows Workstation","newOsName":"Windows Server 2022","oldOsName":"Windows 10 Enterprise","newAdapterVersion":"25.1.0.234","oldAdapterVersion":"25.0.1.198","newComputerGroupId":"g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1","oldComputerGroupId":"f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0","newComputerGroupName":"Production_Servers","oldComputerGroupName":"Workstations"},"managementRuleDataAuditing":{"newPriority":100,"oldPriority":50},"autoUpdateRateLimitDataAuditing":{"oldPmRequestsLimits":100,"oldPmRequestsLimitMinutes":60,"pmRequestsLimits":200,"pmRequestsLimitMinutes":30},"autoUpdateGroupConfigSettingsDataAuditing":{"newEnableAutoUpdate":"true","newUseLatestVersion":"true","newClientVersion":"25.1.0","newAdapterVersion":"25.1.0.234","oldEnableAutoUpdate":"false","oldUseLatestVersion":"false","oldClientVersion":"25.0.0","oldAdapterVersion":"25.0.1.198"},"autoUpdateGroupClientSettingsDataAuditing":{"oldAppEventLogType":"Warning","oldBeyondInsightCertName":"BeyondInsight_Prod_2025","oldBeyondInsightUrl":"https://beyondinsight.company.local","oldBeyondInsightWorkGroup":"WORKGROUP","oldCertMode":"Thumbprint","oldConfigAuditEnabled":"false","oldConfigAuditMode":"Basic","oldCrlFailOpen":"false","oldDownloadAuditMode":"Minimal","oldHookLoadMethod":"Standard","oldPolicyEnabled":"true","oldPolicyPrecedence":"Local","oldPsMode":"Restricted","newPsMode":"Full","newBeyondInsightCertName":"BeyondInsight_Prod_2026","newBeyondInsightUrl":"https://beyondinsight.company.com","newBeyondInsightWorkGroup":"DOMAIN","newAppEventLogType":"Information","newHookLoadMethod":"Advanced","newCertMode":"Subject","newConfigAuditEnabled":"true","newConfigAuditMode":"Detailed","newCrlFailOpen":"true","newDownloadAuditMode":"Verbose","newPolicyEnabled":"true","newPolicyPrecedence":"Central"},"permissionGroupDataAuditing":{"permissionSetId":"h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2","newName":"Advanced_Security_Permissions","oldName":"Basic_Security_Permissions","newDescription":"Full security administration permissions including audit and compliance","oldDescription":"Basic security permissions for viewing","newNumberOfUsers":"25","oldNumberOfUsers":"50"},"autoUpdateGroupMacClientSettingsDataAuditing":{"newAntiTamper":"enabled","newMountAssist":"enabled","newSudoEnabled":"true","newBiometricAuthenticationEnabled":"true","newBadgeIcons":"visible","oldAntiTamper":"disabled","oldMountAssist":"disabled","oldSudoEnabled":"false","oldBiometricAuthenticationEnabled":"false","oldBadgeIcons":"hidden"}} +{"id":10574824,"details":"User jane.smith modified group membership and role assignments for IT Operations team","userId":"b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9","user":"jane.smith@company.com","entity":"Group","entityName":"IT_Operations_Group_v2","auditType":"GroupModification","created":"2026-04-09T09:15:42.5612340","changedBy":"API","apiClientDataAuditing":{"newName":"StagingAPIClient_v2","oldName":"StagingAPIClient","newDescription":"Staging environment API client for CI/CD pipeline integrations","oldDescription":"Staging API client for testing","secretUpdated":true,"deleted":false},"computerDataAuditing":{"updatedPoliciesOn":{"WORKSTATION-101":"IT_Operations_Policy_v3","SERVER-APP-02":"Application_Server_Policy_v2"},"deactivatedAgents":{"LAPTOP-055":"Agent inactive for 45 days","DESKTOP-203":"Replaced by virtual machine"},"newDeletedAgents":["LAPTOP-055","DESKTOP-203"]},"groupDataAuditing":{"newName":"IT_Operations_Team","oldName":"IT_Operations","newDescription":"IT Operations team including on-call engineers and support staff","oldDescription":"IT Operations core team","newIsDefault":true,"oldIsDefault":false,"addPolicyRevisions":{"IT_Operations_Policy":"Revision 4.1","Endpoint_Management_Policy":"Revision 1.5"},"removePolicyRevisions":{"Legacy_IT_Policy":"Revision 2.0","Deprecated_Access_Policy":"Revision 1.2"},"newAgents":{"WORKSTATION-601":"IT_Ops_WS_01","WORKSTATION-602":"IT_Ops_WS_02","WORKSTATION-603":"IT_Ops_WS_03"},"removeAgents":{"WORKSTATION-502":"Transferred to Finance group","WORKSTATION-503":"Decommissioned"}},"installationKeyDataAuditing":{"oldLabel":"Staging_Key_2025","newLabel":"Staging_Key_2026","newDisabled":false,"oldDisabled":true,"deleted":false},"policyDataAuditing":{"newName":"IT_Operations_Hardening_Policy","oldName":"IT_Operations_Standard_Policy","newDescription":"Hardened IT operations policy with strict privilege controls and audit logging","oldDescription":"Standard IT operations policy for general access"},"policyRevisionDataAuditing":{"newGroups":{"IT_Administrators":"Full access","IT_Operations":"Read-write access","Help_Desk":"Read-only access"},"newAnnotationNote":"Revised policy to enforce least-privilege access following Q1 security audit findings"},"settingsDataAuditing":{"addDomain":"it-ops.company.com","removeDomain":"it.company.local","modifyDomainOldValue":"operations.company.local","modifyDomainNewValue":"operations.company.com"},"userDataAuditing":{"newEmailAddress":"jane.smith@company.com","oldEmailAddress":"j.smith@company.com","newOlsonTimeZoneId":"America/Chicago","oldOlsonTimeZoneId":"America/Los_Angeles","newDateTimeDisplayFormat":"dd/MM/yyyy HH:mm:ss","oldDateTimeDisplayFormat":"MM/dd/yyyy HH:mm:ss","newPreferredLanguage":"en-US","oldPreferredLanguage":"en-AU","newDisabled":false,"oldDisabled":true,"newUserType":"Auditor","oldUserType":"Standard","deletedAt":"2026-04-09T09:15:42.5612340","roles":[{"resourceType":"GroupManagement","resourceId":"g5h6i7j8-3k4l-5m6n-7o8p-q9r0s1t2u3v4","resourceName":"IT_Operations_Manager","newRoles":[{"roleId":"c9d7e5f3-0a4b-6c8d-2e0f-g4h2i8j0k2l4","roleName":"Group Administrator"}],"oldRoles":[{"roleId":"b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9","roleName":"Group Member"}]}],"newPermissionSets":[{"permissionSetId":"e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7","permissionSetName":"IT_Ops_Admin_Access"}],"oldPermissionSets":[{"permissionSetId":"d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6","permissionSetName":"Standard_User_Access"}]},"openIdConfigDataAuditing":{"oldAuthenticationType":"LocalDB","newAuthenticationType":"SAML","oldDomain":"sso.company.local","newDomain":"sso.company.com","oldClientId":"beyondtrust-sso-staging-v1","newClientId":"beyondtrust-sso-staging-v2","secretUpdated":false,"oldOpenIDConnectProvider":"https://sso.company.local","newOpenIDConnectProvider":"https://sso.company.com"},"mmcRemoteClientDataAuditing":{"enabled":false,"oldEnabled":true,"clientId":"f3g4h5i6-7j8k-9l0m-1n2o-p3q4r5s6t7u8","oldClientId":"e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7"},"computerPolicyDataAuditing":{"oldInactivityAgentDeactivationDays":90,"oldEnableDeactivatedAgentDeletion":true,"oldDeactivatedAgentDeletionDays":120,"inactivityAgentDeactivationDays":45,"enableDeactivatedAgentDeletion":true,"deactivatedAgentDeletionDays":90},"azureADIntegrationDataAuditing":{"oldAzureAdTenantId":"11223344-5566-7788-9900-aabbccddeeff","oldAzureAdClientId":"aabbccdd-1122-3344-5566-778899001122","oldAzureAdClientSecret":"***","oldAzureAdUseCertificateAuth":true,"oldAzureAdIntegrationEnabled":true,"azureAdTenantId":"99887766-5544-3322-1100-ffeeddccbbaa","azureAdClientId":"ffeeddc0-9988-7766-5544-332211009988","azureAdClientSecret":"***","azureAdUseCertificateAuth":true,"azureAdIntegrationEnabled":true,"azureAdConfigChanged":true},"authorizationRequestDataAuditing":{"oldAuthRequestIntegrationEnabled":true,"oldAuthRequestHostName":"auth-staging.company.local","oldAuthRequestClientId":"bt-auth-staging-v1","oldAuthRequestClientSecret":"***","oldAuthRequestPassword":"***","oldAuthRequestUserName":"bt_staging_account","oldAuthRequestApiClientId":"api-staging-v1","oldAuthRequestApiClientSecret":"***","authRequestIntegrationEnabled":true,"authRequestHostName":"auth-staging.company.com","authRequestClientId":"bt-auth-staging-v2","authRequestClientSecret":"***","authRequestPassword":"***","authRequestUserName":"bt_staging_account_v2","authRequestApiClientId":"api-staging-v2","authRequestApiClientSecret":"***","authRequestConfigChanged":true},"reputationSettingsDataAuditing":{"oldReputationIntegrationEnabled":true,"oldReputationIntegrationApiKey":"***","reputationIntegrationEnabled":true,"reputationIntegrationApiKey":"***","reputationConfigChanged":true},"securitySettingsDataAuditing":{"tokenTimeout":1800,"oldTokenTimeout":3600},"siemIntegrationBaseDetailModel":{"siemIntegrationEnabled":true,"siemIntegrationType":"Sentinel","siemFormat":"JSON"},"siemIntegrationQradarAuditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"QRadar","siemFormat":"LEEF","hostName":"qradar-staging.company.com","port":"6514","cert":"-----BEGIN CERTIFICATE-----\nMIIE...staging-certificate...content\n-----END CERTIFICATE-----"},"siemIntegrationS3Auditing":{"siemIntegrationEnabled":false,"siemIntegrationType":"AWS","siemFormat":"JSON","siemAccessKeyId":"AKIAI9SFODNN7STAGING","siemBucketName":"company-beyondtrust-staging-logs","siemCodec":"none","siemRegionName":"us-west-2","siemSseEnabled":false},"siemIntegrationSentinelAuditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"Sentinel","siemFormat":"JSON","tableName":"BeyondTrustStagingLogs","workspaceId":"b2c3d4e5-f6a7-8901-bcde-fg2345678901"},"siemIntegrationSplunkAuditing":{"siemIntegrationEnabled":false,"siemIntegrationType":"Splunk","siemFormat":"JSON","hostName":"splunk-staging.company.com","index":"beyondtrust_staging"},"agentDataAuditing":{"newAgentId":"g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1","oldAgentId":"f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0","newTimestamp":"2026-04-09T09:10:00.0000000","oldTimestamp":"2026-04-09T08:45:00.0000000","newHostType":"Windows Workstation","oldHostType":"Windows Workstation","newOsName":"Windows 11 Enterprise","oldOsName":"Windows 10 Enterprise","newAdapterVersion":"25.1.0.234","oldAdapterVersion":"24.4.2.156","newComputerGroupId":"h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2","oldComputerGroupId":"g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1","newComputerGroupName":"IT_Operations_Workstations","oldComputerGroupName":"General_Workstations"},"managementRuleDataAuditing":{"newPriority":75,"oldPriority":25},"autoUpdateRateLimitDataAuditing":{"oldPmRequestsLimits":150,"oldPmRequestsLimitMinutes":45,"pmRequestsLimits":300,"pmRequestsLimitMinutes":60},"autoUpdateGroupConfigSettingsDataAuditing":{"newEnableAutoUpdate":"true","newUseLatestVersion":"false","newClientVersion":"25.1.0","newAdapterVersion":"25.1.0.234","oldEnableAutoUpdate":"true","oldUseLatestVersion":"true","oldClientVersion":"24.4.0","oldAdapterVersion":"24.4.2.156"},"autoUpdateGroupClientSettingsDataAuditing":{"oldAppEventLogType":"Error","oldBeyondInsightCertName":"BeyondInsight_Staging_2025","oldBeyondInsightUrl":"https://beyondinsight-staging.company.local","oldBeyondInsightWorkGroup":"STAGING","oldCertMode":"Subject","oldConfigAuditEnabled":"true","oldConfigAuditMode":"Basic","oldCrlFailOpen":"true","oldDownloadAuditMode":"Standard","oldHookLoadMethod":"Standard","oldPolicyEnabled":"true","oldPolicyPrecedence":"Central","oldPsMode":"Restricted","newPsMode":"Restricted","newBeyondInsightCertName":"BeyondInsight_Staging_2026","newBeyondInsightUrl":"https://beyondinsight-staging.company.com","newBeyondInsightWorkGroup":"STAGING","newAppEventLogType":"Warning","newHookLoadMethod":"Standard","newCertMode":"Thumbprint","newConfigAuditEnabled":"true","newConfigAuditMode":"Detailed","newCrlFailOpen":"false","newDownloadAuditMode":"Standard","newPolicyEnabled":"true","newPolicyPrecedence":"Central"},"permissionGroupDataAuditing":{"permissionSetId":"i8j9k0l1-2m3n-4o5p-6q7r-s8t9u0v1w2x3","newName":"IT_Operations_Permissions","oldName":"IT_Standard_Permissions","newDescription":"IT Operations team permissions with elevated endpoint management rights","oldDescription":"Standard IT permissions for basic endpoint access","newNumberOfUsers":"18","oldNumberOfUsers":"30"},"autoUpdateGroupMacClientSettingsDataAuditing":{"newAntiTamper":"enabled","newMountAssist":"disabled","newSudoEnabled":"false","newBiometricAuthenticationEnabled":"true","newBadgeIcons":"hidden","oldAntiTamper":"disabled","oldMountAssist":"disabled","oldSudoEnabled":"false","oldBiometricAuthenticationEnabled":"false","oldBadgeIcons":"hidden"}} +{"id":10574825,"details":"System scheduler updated macOS fleet auto-update configuration and adjusted agent computer policy inactivity thresholds","userId":"c9d7e5f3-0a4b-6c8d-2e0f-a4h6i8j0k2l4","user":"michael.chen@company.com","entity":"AutoUpdateGroupConfig","entityName":"Mac_Workstation_AutoUpdate_Policy","auditType":"AutoUpdateModification","created":"2026-04-10T16:45:28.9834210","changedBy":"Scheduler","apiClientDataAuditing":{"newName":"DevOpsAPIClient_v3","oldName":"DevOpsAPIClient_v2","newDescription":"DevOps automation API client with extended permissions for deployment workflows","oldDescription":"DevOps automation API client for standard deployments","secretUpdated":false,"deleted":false},"computerDataAuditing":{"updatedPoliciesOn":{"MAC-WORKSTATION-001":"Mac_Hardening_Policy_v2","MAC-WORKSTATION-002":"Mac_Hardening_Policy_v2","MAC-SERVER-01":"Mac_Server_Policy_v3"},"deactivatedAgents":{"MAC-LAPTOP-099":"Agent offline for 60 days","MAC-DESKTOP-045":"Device returned to vendor"},"newDeletedAgents":["MAC-LAPTOP-099","MAC-DESKTOP-045"]},"groupDataAuditing":{"newName":"MacOS_Fleet_Operations","oldName":"Mac_Ops_Group","newDescription":"All macOS devices in corporate fleet including laptops and desktops","oldDescription":"macOS operations group for managed devices","newIsDefault":false,"oldIsDefault":false,"addPolicyRevisions":{"Mac_Security_Policy":"Revision 2.3","Mac_Compliance_Policy":"Revision 1.1"},"removePolicyRevisions":{"Legacy_Mac_Policy":"Revision 1.0"},"newAgents":{"MAC-WORKSTATION-101":"Mac_WS_01","MAC-WORKSTATION-102":"Mac_WS_02"},"removeAgents":{"MAC-WORKSTATION-001":"Upgraded to newer model"}},"installationKeyDataAuditing":{"oldLabel":"Mac_Fleet_Key_2025","newLabel":"Mac_Fleet_Key_2026","newDisabled":false,"oldDisabled":false,"deleted":false},"policyDataAuditing":{"newName":"Mac_Enhanced_Privilege_Policy","oldName":"Mac_Standard_Privilege_Policy","newDescription":"Enhanced macOS privilege management policy with biometric authentication requirements","oldDescription":"Standard macOS privilege management policy"},"policyRevisionDataAuditing":{"newGroups":{"Mac_Administrators":"Full access","Mac_Power_Users":"Elevated access"},"newAnnotationNote":"Updated Mac policy to require biometric authentication for all privilege escalation requests"},"settingsDataAuditing":{"addDomain":"mac.company.com","removeDomain":"mac.company.local","modifyDomainOldValue":"macos.company.local","modifyDomainNewValue":"macos.company.com"},"userDataAuditing":{"newEmailAddress":"michael.chen@company.com","oldEmailAddress":"m.chen@company.com","newOlsonTimeZoneId":"America/Los_Angeles","oldOlsonTimeZoneId":"Asia/Shanghai","newDateTimeDisplayFormat":"MM/dd/yyyy HH:mm:ss","oldDateTimeDisplayFormat":"yyyy/MM/dd HH:mm:ss","newPreferredLanguage":"en-US","oldPreferredLanguage":"zh-CN","newDisabled":false,"oldDisabled":false,"newUserType":"Standard","oldUserType":"Standard","deletedAt":"2026-04-10T16:45:28.9834210","roles":[{"resourceType":"EndpointManagement","resourceId":"h6i7j8k9-4l5m-6n7o-8p9q-r0s1t2u3v4w5","resourceName":"Mac_Fleet_Manager","newRoles":[{"roleId":"d0e8f6g4-1b5c-7d9e-3f1g-h5i7j9k1l3m5","roleName":"Device Administrator"}],"oldRoles":[{"roleId":"c9d7e5f3-0a4b-6c8d-2e0f-a4h6i8j0k2l4","roleName":"Device Viewer"}]}],"newPermissionSets":[{"permissionSetId":"f3g4h5i6-7j8k-9l0m-1n2o-p3q4r5s6t7u8","permissionSetName":"Mac_Fleet_Admin_Access"}],"oldPermissionSets":[{"permissionSetId":"e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7","permissionSetName":"Mac_Fleet_Read_Access"}]},"openIdConfigDataAuditing":{"oldAuthenticationType":"OAuth2","newAuthenticationType":"OAuth2","oldDomain":"auth.mac.company.local","newDomain":"auth.mac.company.com","oldClientId":"beyondtrust-mac-client-v2","newClientId":"beyondtrust-mac-client-v3","secretUpdated":true,"oldOpenIDConnectProvider":"https://login.mac.company.local","newOpenIDConnectProvider":"https://login.mac.company.com"},"mmcRemoteClientDataAuditing":{"enabled":true,"oldEnabled":true,"clientId":"g4h5i6j7-8k9l-0m1n-2o3p-q4r5s6t7u8v9","oldClientId":"f3g4h5i6-7j8k-9l0m-1n2o-p3q4r5s6t7u8"},"computerPolicyDataAuditing":{"oldInactivityAgentDeactivationDays":45,"oldEnableDeactivatedAgentDeletion":false,"oldDeactivatedAgentDeletionDays":180,"inactivityAgentDeactivationDays":60,"enableDeactivatedAgentDeletion":false,"deactivatedAgentDeletionDays":180},"azureADIntegrationDataAuditing":{"oldAzureAdTenantId":"aabbccdd-eeff-0011-2233-445566778899","oldAzureAdClientId":"11223344-aabb-ccdd-eeff-001122334455","oldAzureAdClientSecret":"***","oldAzureAdUseCertificateAuth":false,"oldAzureAdIntegrationEnabled":true,"azureAdTenantId":"aabbccdd-eeff-0011-2233-445566778899","azureAdClientId":"22334455-bbcc-ddee-ff00-112233445566","azureAdClientSecret":"***","azureAdUseCertificateAuth":false,"azureAdIntegrationEnabled":true,"azureAdConfigChanged":true},"authorizationRequestDataAuditing":{"oldAuthRequestIntegrationEnabled":false,"oldAuthRequestHostName":"auth-mac.company.local","oldAuthRequestClientId":"bt-mac-client-v1","oldAuthRequestClientSecret":"***","oldAuthRequestPassword":"***","oldAuthRequestUserName":"bt_mac_service","oldAuthRequestApiClientId":"mac-api-client-v1","oldAuthRequestApiClientSecret":"***","authRequestIntegrationEnabled":true,"authRequestHostName":"auth-mac.company.com","authRequestClientId":"bt-mac-client-v2","authRequestClientSecret":"***","authRequestPassword":"***","authRequestUserName":"bt_mac_service_v2","authRequestApiClientId":"mac-api-client-v2","authRequestApiClientSecret":"***","authRequestConfigChanged":true},"reputationSettingsDataAuditing":{"oldReputationIntegrationEnabled":false,"oldReputationIntegrationApiKey":"***","reputationIntegrationEnabled":false,"reputationIntegrationApiKey":"***","reputationConfigChanged":false},"securitySettingsDataAuditing":{"tokenTimeout":7200,"oldTokenTimeout":7200},"siemIntegrationBaseDetailModel":{"siemIntegrationEnabled":true,"siemIntegrationType":"AWS","siemFormat":"JSON"},"siemIntegrationQradarAuditing":{"siemIntegrationEnabled":false,"siemIntegrationType":"QRadar","siemFormat":"LEEF","hostName":"qradar-mac.company.com","port":"514","cert":"-----BEGIN CERTIFICATE-----\nMIIF...mac-certificate...content\n-----END CERTIFICATE-----"},"siemIntegrationS3Auditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"AWS","siemFormat":"JSON","siemAccessKeyId":"AKIAIOSFODNN7MAC001","siemBucketName":"company-beyondtrust-mac-logs","siemCodec":"gzip","siemRegionName":"us-west-1","siemSseEnabled":true},"siemIntegrationSentinelAuditing":{"siemIntegrationEnabled":false,"siemIntegrationType":"Sentinel","siemFormat":"JSON","tableName":"BeyondTrustMacAuditLogs","workspaceId":"c3d4e5f6-a7b8-9012-cdef-gh3456789012"},"siemIntegrationSplunkAuditing":{"siemIntegrationEnabled":false,"siemIntegrationType":"Splunk","siemFormat":"JSON","hostName":"splunk-hec.company.com","index":"beyondtrust_mac_audit"},"agentDataAuditing":{"newAgentId":"h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2","oldAgentId":"g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1","newTimestamp":"2026-04-10T16:40:00.0000000","oldTimestamp":"2026-04-10T16:00:00.0000000","newHostType":"macOS Workstation","oldHostType":"macOS Workstation","newOsName":"macOS Sequoia 15.3","oldOsName":"macOS Ventura 13.6","newAdapterVersion":"25.1.0.234","oldAdapterVersion":"25.0.3.211","newComputerGroupId":"i8j9k0l1-2m3n-4o5p-6q7r-s8t9u0v1w2x3","oldComputerGroupId":"h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2","newComputerGroupName":"Mac_Production_Fleet","oldComputerGroupName":"Mac_Legacy_Fleet"},"managementRuleDataAuditing":{"newPriority":50,"oldPriority":200},"autoUpdateRateLimitDataAuditing":{"oldPmRequestsLimits":200,"oldPmRequestsLimitMinutes":30,"pmRequestsLimits":150,"pmRequestsLimitMinutes":15},"autoUpdateGroupConfigSettingsDataAuditing":{"newEnableAutoUpdate":"true","newUseLatestVersion":"true","newClientVersion":"25.1.0","newAdapterVersion":"25.1.0.234","oldEnableAutoUpdate":"true","oldUseLatestVersion":"false","oldClientVersion":"25.0.0","oldAdapterVersion":"25.0.3.211"},"autoUpdateGroupClientSettingsDataAuditing":{"oldAppEventLogType":"Information","oldBeyondInsightCertName":"BeyondInsight_Mac_2025","oldBeyondInsightUrl":"https://beyondinsight-mac.company.local","oldBeyondInsightWorkGroup":"MAC_DOMAIN","oldCertMode":"Subject","oldConfigAuditEnabled":"true","oldConfigAuditMode":"Detailed","oldCrlFailOpen":"true","oldDownloadAuditMode":"Verbose","oldHookLoadMethod":"Advanced","oldPolicyEnabled":"true","oldPolicyPrecedence":"Central","oldPsMode":"Full","newPsMode":"Full","newBeyondInsightCertName":"BeyondInsight_Mac_2026","newBeyondInsightUrl":"https://beyondinsight-mac.company.com","newBeyondInsightWorkGroup":"MAC_DOMAIN","newAppEventLogType":"Information","newHookLoadMethod":"Advanced","newCertMode":"Subject","newConfigAuditEnabled":"true","newConfigAuditMode":"Detailed","newCrlFailOpen":"true","newDownloadAuditMode":"Verbose","newPolicyEnabled":"true","newPolicyPrecedence":"Central"},"permissionGroupDataAuditing":{"permissionSetId":"j9k0l1m2-3n4o-5p6q-7r8s-t9u0v1w2x3y4","newName":"Mac_Fleet_Admin_Permissions","oldName":"Mac_Fleet_Standard_Permissions","newDescription":"Full macOS fleet administration permissions including privilege management and biometric controls","oldDescription":"Standard macOS fleet permissions for device management","newNumberOfUsers":"12","oldNumberOfUsers":"20"},"autoUpdateGroupMacClientSettingsDataAuditing":{"newAntiTamper":"enabled","newMountAssist":"enabled","newSudoEnabled":"true","newBiometricAuthenticationEnabled":"true","newBadgeIcons":"visible","oldAntiTamper":"enabled","oldMountAssist":"disabled","oldSudoEnabled":"true","oldBiometricAuthenticationEnabled":"false","oldBadgeIcons":"hidden"}} +{"id":10574826,"details":"Administrator sarah.wilson reconfigured SIEM integration endpoints and updated permission group membership for compliance reporting","userId":"d0e8f6g4-1b5c-7d9e-3f1g-h5i7j9k1l3m5","user":"sarah.wilson@company.com","entity":"SiemIntegration","entityName":"Splunk_Production_HEC","auditType":"IntegrationModification","created":"2026-04-11T11:22:55.1234560","changedBy":"Portal","apiClientDataAuditing":{"newName":"ComplianceAPIClient_v2","oldName":"ComplianceAPIClient_v1","newDescription":"Compliance reporting API client with read-only access to audit data","oldDescription":"Compliance reporting API client for basic audit queries","secretUpdated":true,"deleted":false},"computerDataAuditing":{"updatedPoliciesOn":{"SERVER-COMP-01":"Compliance_Audit_Policy_v4","SERVER-COMP-02":"Compliance_Audit_Policy_v4","WORKSTATION-AUDIT-01":"Auditor_Workstation_Policy_v2"},"deactivatedAgents":{"SERVER-LEGACY-01":"Decommissioned compliance server","WORKSTATION-OLD-22":"End of life hardware"},"newDeletedAgents":["SERVER-LEGACY-01","WORKSTATION-OLD-22"]},"groupDataAuditing":{"newName":"Compliance_Audit_Team","oldName":"Compliance_Team","newDescription":"Compliance and audit team with access to all audit logs and reporting tools","oldDescription":"Compliance team for regulatory reporting","newIsDefault":false,"oldIsDefault":false,"addPolicyRevisions":{"Compliance_Policy":"Revision 5.0","SOX_Audit_Policy":"Revision 3.1","GDPR_Compliance_Policy":"Revision 2.4"},"removePolicyRevisions":{"Legacy_Compliance_Policy":"Revision 1.5","Deprecated_SOX_Policy":"Revision 2.0"},"newAgents":{"WORKSTATION-AUDIT-01":"Audit_WS_01","WORKSTATION-AUDIT-02":"Audit_WS_02"},"removeAgents":{"WORKSTATION-COMP-OLD-01":"Replaced by WORKSTATION-AUDIT-01"}},"installationKeyDataAuditing":{"oldLabel":"Compliance_Key_2025","newLabel":"Compliance_Key_2026","newDisabled":false,"oldDisabled":false,"deleted":false},"policyDataAuditing":{"newName":"SOX_Compliance_Enforcement_Policy","oldName":"SOX_Compliance_Standard_Policy","newDescription":"SOX compliance enforcement policy with mandatory audit trail and privilege justification","oldDescription":"SOX compliance policy for financial systems access"},"policyRevisionDataAuditing":{"newGroups":{"Compliance_Officers":"Full access","Internal_Audit":"Read-write access","External_Auditors":"Read-only access"},"newAnnotationNote":"Updated SOX policy revision to meet 2026 regulatory requirements and address findings from external audit report"},"settingsDataAuditing":{"addDomain":"compliance.company.com","removeDomain":"compliance.company.local","modifyDomainOldValue":"audit.company.local","modifyDomainNewValue":"audit.company.com"},"userDataAuditing":{"newEmailAddress":"sarah.wilson@company.com","oldEmailAddress":"s.wilson@company.com","newOlsonTimeZoneId":"Europe/London","oldOlsonTimeZoneId":"UTC","newDateTimeDisplayFormat":"dd/MM/yyyy HH:mm:ss","oldDateTimeDisplayFormat":"dd/MM/yyyy HH:mm","newPreferredLanguage":"en-GB","oldPreferredLanguage":"en-US","newDisabled":false,"oldDisabled":false,"newUserType":"Auditor","oldUserType":"Auditor","deletedAt":"2026-04-11T11:22:55.1234560","roles":[{"resourceType":"AuditManagement","resourceId":"i7j8k9l0-5m6n-7o8p-9q0r-s1t2u3v4w5x6","resourceName":"Global_Audit_Manager","newRoles":[{"roleId":"e1f2g3h4-2i3j-4k5l-6m7n-o8p9q0r1s2t3","roleName":"Compliance Administrator"}],"oldRoles":[{"roleId":"d0e8f6g4-1b5c-7d9e-3f1g-h5i7j9k1l3m5","roleName":"Compliance Auditor"}]}],"newPermissionSets":[{"permissionSetId":"g4h5i6j7-8k9l-0m1n-2o3p-q4r5s6t7u8v9","permissionSetName":"Compliance_Full_Access"}],"oldPermissionSets":[{"permissionSetId":"f3g4h5i6-7j8k-9l0m-1n2o-p3q4r5s6t7u8","permissionSetName":"Compliance_Read_Access"}]},"openIdConfigDataAuditing":{"oldAuthenticationType":"OAuth2","newAuthenticationType":"OAuth2","oldDomain":"auth.compliance.company.local","newDomain":"auth.compliance.company.com","oldClientId":"beyondtrust-compliance-v2","newClientId":"beyondtrust-compliance-v3","secretUpdated":true,"oldOpenIDConnectProvider":"https://login.compliance.company.local","newOpenIDConnectProvider":"https://login.compliance.company.com"},"mmcRemoteClientDataAuditing":{"enabled":true,"oldEnabled":false,"clientId":"h5i6j7k8-9l0m-1n2o-3p4q-r5s6t7u8v9w0","oldClientId":"g4h5i6j7-8k9l-0m1n-2o3p-q4r5s6t7u8v9"},"computerPolicyDataAuditing":{"oldInactivityAgentDeactivationDays":30,"oldEnableDeactivatedAgentDeletion":true,"oldDeactivatedAgentDeletionDays":60,"inactivityAgentDeactivationDays":14,"enableDeactivatedAgentDeletion":true,"deactivatedAgentDeletionDays":30},"azureADIntegrationDataAuditing":{"oldAzureAdTenantId":"ccddee00-ff11-2233-4455-66778899aabb","oldAzureAdClientId":"33445566-ccdd-eeff-0011-223344556677","oldAzureAdClientSecret":"***","oldAzureAdUseCertificateAuth":true,"oldAzureAdIntegrationEnabled":true,"azureAdTenantId":"ccddee00-ff11-2233-4455-66778899aabb","azureAdClientId":"44556677-ddee-ff00-1122-334455667788","azureAdClientSecret":"***","azureAdUseCertificateAuth":true,"azureAdIntegrationEnabled":true,"azureAdConfigChanged":true},"authorizationRequestDataAuditing":{"oldAuthRequestIntegrationEnabled":true,"oldAuthRequestHostName":"auth-compliance.company.local","oldAuthRequestClientId":"bt-compliance-client-v2","oldAuthRequestClientSecret":"***","oldAuthRequestPassword":"***","oldAuthRequestUserName":"bt_compliance_svc","oldAuthRequestApiClientId":"compliance-api-v2","oldAuthRequestApiClientSecret":"***","authRequestIntegrationEnabled":true,"authRequestHostName":"auth-compliance.company.com","authRequestClientId":"bt-compliance-client-v3","authRequestClientSecret":"***","authRequestPassword":"***","authRequestUserName":"bt_compliance_svc_v3","authRequestApiClientId":"compliance-api-v3","authRequestApiClientSecret":"***","authRequestConfigChanged":true},"reputationSettingsDataAuditing":{"oldReputationIntegrationEnabled":true,"oldReputationIntegrationApiKey":"***","reputationIntegrationEnabled":true,"reputationIntegrationApiKey":"***","reputationConfigChanged":true},"securitySettingsDataAuditing":{"tokenTimeout":900,"oldTokenTimeout":1800},"siemIntegrationBaseDetailModel":{"siemIntegrationEnabled":true,"siemIntegrationType":"QRadar","siemFormat":"LEEF"},"siemIntegrationQradarAuditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"QRadar","siemFormat":"LEEF","hostName":"qradar-compliance.company.com","port":"6514","cert":"-----BEGIN CERTIFICATE-----\nMIIG...compliance-certificate...content\n-----END CERTIFICATE-----"},"siemIntegrationS3Auditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"AWS","siemFormat":"JSON","siemAccessKeyId":"AKIAIOSFODNN7COMP01","siemBucketName":"company-beyondtrust-compliance-logs","siemCodec":"gzip","siemRegionName":"eu-west-1","siemSseEnabled":true},"siemIntegrationSentinelAuditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"Sentinel","siemFormat":"JSON","tableName":"BeyondTrustComplianceLogs","workspaceId":"d4e5f6a7-b8c9-0123-defg-hi4567890123"},"siemIntegrationSplunkAuditing":{"siemIntegrationEnabled":true,"siemIntegrationType":"Splunk","siemFormat":"JSON","hostName":"splunk-hec-compliance.company.com","index":"beyondtrust_compliance"},"agentDataAuditing":{"newAgentId":"i8j9k0l1-2m3n-4o5p-6q7r-s8t9u0v1w2x3","oldAgentId":"h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2","newTimestamp":"2026-04-11T11:18:00.0000000","oldTimestamp":"2026-04-11T10:45:00.0000000","newHostType":"Windows Server","oldHostType":"Windows Server","newOsName":"Windows Server 2022 Datacenter","oldOsName":"Windows Server 2019 Standard","newAdapterVersion":"25.1.0.234","oldAdapterVersion":"25.1.0.201","newComputerGroupId":"j9k0l1m2-3n4o-5p6q-7r8s-t9u0v1w2x3y4","oldComputerGroupId":"i8j9k0l1-2m3n-4o5p-6q7r-s8t9u0v1w2x3","newComputerGroupName":"Compliance_Servers","oldComputerGroupName":"General_Servers"},"managementRuleDataAuditing":{"newPriority":10,"oldPriority":150},"autoUpdateRateLimitDataAuditing":{"oldPmRequestsLimits":50,"oldPmRequestsLimitMinutes":120,"pmRequestsLimits":100,"pmRequestsLimitMinutes":60},"autoUpdateGroupConfigSettingsDataAuditing":{"newEnableAutoUpdate":"false","newUseLatestVersion":"false","newClientVersion":"25.1.0","newAdapterVersion":"25.1.0.234","oldEnableAutoUpdate":"false","oldUseLatestVersion":"false","oldClientVersion":"25.1.0","oldAdapterVersion":"25.1.0.201"},"autoUpdateGroupClientSettingsDataAuditing":{"oldAppEventLogType":"Information","oldBeyondInsightCertName":"BeyondInsight_Compliance_2025","oldBeyondInsightUrl":"https://beyondinsight-compliance.company.local","oldBeyondInsightWorkGroup":"COMPLIANCE","oldCertMode":"Subject","oldConfigAuditEnabled":"true","oldConfigAuditMode":"Detailed","oldCrlFailOpen":"false","oldDownloadAuditMode":"Verbose","oldHookLoadMethod":"Advanced","oldPolicyEnabled":"true","oldPolicyPrecedence":"Central","oldPsMode":"Restricted","newPsMode":"Restricted","newBeyondInsightCertName":"BeyondInsight_Compliance_2026","newBeyondInsightUrl":"https://beyondinsight-compliance.company.com","newBeyondInsightWorkGroup":"COMPLIANCE","newAppEventLogType":"Information","newHookLoadMethod":"Advanced","newCertMode":"Subject","newConfigAuditEnabled":"true","newConfigAuditMode":"Detailed","newCrlFailOpen":"false","newDownloadAuditMode":"Verbose","newPolicyEnabled":"true","newPolicyPrecedence":"Central"},"permissionGroupDataAuditing":{"permissionSetId":"k0l1m2n3-4o5p-6q7r-8s9t-u0v1w2x3y4z5","newName":"Compliance_Full_Permissions","oldName":"Compliance_Audit_Permissions","newDescription":"Full compliance administration permissions including SIEM management and audit configuration","oldDescription":"Standard compliance audit permissions for log review and reporting","newNumberOfUsers":"8","oldNumberOfUsers":"15"},"autoUpdateGroupMacClientSettingsDataAuditing":{"newAntiTamper":"enabled","newMountAssist":"enabled","newSudoEnabled":"false","newBiometricAuthenticationEnabled":"false","newBadgeIcons":"visible","oldAntiTamper":"enabled","oldMountAssist":"enabled","oldSudoEnabled":"false","oldBiometricAuthenticationEnabled":"false","oldBadgeIcons":"visible"}} diff --git a/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/tf/main.tf b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/tf/main.tf new file mode 100644 index 00000000000..0ed3d776747 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/_dev/deploy/tf/main.tf @@ -0,0 +1,57 @@ +provider "aws" { + region = "us-east-1" + default_tags { + tags = { + environment = var.ENVIRONMENT + repo = var.REPO + branch = var.BRANCH + build = var.BUILD_ID + created_date = var.CREATED_DATE + } + } +} + +resource "aws_s3_bucket" "bucket" { + bucket = "elastic-package-beyondtrust-epm-bucket-${var.TEST_RUN_ID}" +} + +resource "aws_sqs_queue" "queue" { + name = "elastic-package-beyondtrust-epm-queue-${var.TEST_RUN_ID}" + policy = < 0) ? + optional.of( + body.data[size(body.data) - 1].created.parse_time("2006-01-02T15:04:05.9999999").format(time_layout.RFC3339) + ) + : + state.?cursor.last_timestamp, + }, + } + ) + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": string(resp.Status), + "message": "GET " + state.url.trim_suffix("/") + "/management-api/v3/ActivityAudits/Details: " + ( + (size(resp.Body) != 0) ? + string(resp.Body) + : + string(resp.Status) + " (" + string(resp.StatusCode) + ")" + ), + }, + }, + "next": {}, + "want_more": false, + } + ) + ) + ) +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/beyondtrust_epm/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/beyondtrust_epm/data_stream/audit/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..2f2a762afc3 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,804 @@ +--- +description: Pipeline for processing audit logs. +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: 9.3.0 + - terminate: + tag: data_collection_error + if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null + description: error message set and no data to process. + - remove: + field: + - organization + - division + - team + tag: remove_agentless_tags + if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String + ignore_missing: true + description: Removes the fields added by Agentless as metadata, as they can collide with ECS fields. + - rename: + field: message + tag: rename_message_to_event_original + if: ctx.event?.original == null + target_field: event.original + ignore_missing: true + description: Renames the original `message` field to `event.original` to store a copy of the original message. + - remove: + field: + - message + tag: remove_message + if: ctx.event?.original != null + ignore_missing: true + description: The `message` field is no longer required if the document has an `event.original` field. + - json: + field: event.original + tag: json_event_original + target_field: beyondtrust_epm.audit + - fingerprint: + tag: fingerprint_with_id + fields: + - beyondtrust_epm.audit.id + target_field: _id + ignore_missing: true + - set: + field: event.kind + tag: set_event_kind + value: event + - append: + field: event.type + tag: append_change_into_event_type + value: change + - append: + field: event.category + tag: append_change_into_event_type + value: configuration + - date: + field: beyondtrust_epm.audit.agentDataAuditing.newTimestamp + tag: date_agentDataAuditing_newTimestamp + if: ctx.beyondtrust_epm?.audit?.agentDataAuditing?.newTimestamp != null && ctx.beyondtrust_epm.audit.agentDataAuditing.newTimestamp != '' + target_field: beyondtrust_epm.audit.agentDataAuditing.newTimestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.audit.agentDataAuditing.newTimestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.audit.agentDataAuditing.oldTimestamp + tag: date_agentDataAuditing_oldTimestamp + if: ctx.beyondtrust_epm?.audit?.agentDataAuditing?.oldTimestamp != null && ctx.beyondtrust_epm.audit.agentDataAuditing.oldTimestamp != '' + target_field: beyondtrust_epm.audit.agentDataAuditing.oldTimestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.audit.agentDataAuditing.oldTimestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.apiClientDataAuditing.deleted + tag: convert_apiClientDataAuditing_deleted_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.apiClientDataAuditing.deleted + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.apiClientDataAuditing.secretUpdated + tag: convert_apiClientDataAuditing_secretUpdated_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.apiClientDataAuditing.secretUpdated + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.authorizationRequestDataAuditing.authRequestConfigChanged + tag: convert_authorizationRequestDataAuditing_authRequestConfigChanged_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.authorizationRequestDataAuditing.authRequestConfigChanged + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.authorizationRequestDataAuditing.authRequestIntegrationEnabled + tag: convert_authorizationRequestDataAuditing_authRequestIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.authorizationRequestDataAuditing.authRequestIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.authorizationRequestDataAuditing.oldAuthRequestIntegrationEnabled + tag: convert_authorizationRequestDataAuditing_oldAuthRequestIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.authorizationRequestDataAuditing.oldAuthRequestIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.autoUpdateRateLimitDataAuditing.oldPmRequestsLimitMinutes + tag: convert_autoUpdateRateLimitDataAuditing_oldPmRequestsLimitMinutes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.autoUpdateRateLimitDataAuditing.oldPmRequestsLimitMinutes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.autoUpdateRateLimitDataAuditing.oldPmRequestsLimits + tag: convert_autoUpdateRateLimitDataAuditing_oldPmRequestsLimits_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.autoUpdateRateLimitDataAuditing.oldPmRequestsLimits + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.autoUpdateRateLimitDataAuditing.pmRequestsLimitMinutes + tag: convert_autoUpdateRateLimitDataAuditing_pmRequestsLimitMinutes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.autoUpdateRateLimitDataAuditing.pmRequestsLimitMinutes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.autoUpdateRateLimitDataAuditing.pmRequestsLimits + tag: convert_autoUpdateRateLimitDataAuditing_pmRequestsLimits_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.autoUpdateRateLimitDataAuditing.pmRequestsLimits + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.azureAdConfigChanged + tag: convert_azureADIntegrationDataAuditing_azureAdConfigChanged_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.azureAdConfigChanged + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.azureAdIntegrationEnabled + tag: convert_azureADIntegrationDataAuditing_azureAdIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.azureAdIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.azureAdUseCertificateAuth + tag: convert_azureADIntegrationDataAuditing_azureAdUseCertificateAuth_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.azureAdUseCertificateAuth + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.oldAzureAdIntegrationEnabled + tag: convert_azureADIntegrationDataAuditing_oldAzureAdIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.oldAzureAdIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.oldAzureAdUseCertificateAuth + tag: convert_azureADIntegrationDataAuditing_oldAzureAdUseCertificateAuth_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.azureADIntegrationDataAuditing.oldAzureAdUseCertificateAuth + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.deactivatedAgentDeletionDays + tag: convert_computerPolicyDataAuditing_deactivatedAgentDeletionDays_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.deactivatedAgentDeletionDays + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.enableDeactivatedAgentDeletion + tag: convert_computerPolicyDataAuditing_enableDeactivatedAgentDeletion_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.enableDeactivatedAgentDeletion + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.inactivityAgentDeactivationDays + tag: convert_computerPolicyDataAuditing_inactivityAgentDeactivationDays_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.inactivityAgentDeactivationDays + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.oldDeactivatedAgentDeletionDays + tag: convert_computerPolicyDataAuditing_oldDeactivatedAgentDeletionDays_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.oldDeactivatedAgentDeletionDays + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.oldEnableDeactivatedAgentDeletion + tag: convert_computerPolicyDataAuditing_oldEnableDeactivatedAgentDeletion_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.oldEnableDeactivatedAgentDeletion + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.oldInactivityAgentDeactivationDays + tag: convert_computerPolicyDataAuditing_oldInactivityAgentDeactivationDays_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.computerPolicyDataAuditing.oldInactivityAgentDeactivationDays + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.audit.created + tag: date_created + if: ctx.beyondtrust_epm?.audit?.created != null && ctx.beyondtrust_epm.audit.created != '' + target_field: beyondtrust_epm.audit.created + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.audit.created + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: '@timestamp' + tag: set_timestamp_from_audit_created + copy_from: beyondtrust_epm.audit.created + ignore_empty_value: true + - set: + field: event.created + tag: set_event_created_from_audit_created + copy_from: beyondtrust_epm.audit.created + ignore_empty_value: true + - set: + field: message + tag: set_message_from_audit_details + copy_from: beyondtrust_epm.audit.details + ignore_empty_value: true + - convert: + field: beyondtrust_epm.audit.groupDataAuditing.newIsDefault + tag: convert_groupDataAuditing_newIsDefault_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.groupDataAuditing.newIsDefault + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.groupDataAuditing.oldIsDefault + tag: convert_groupDataAuditing_oldIsDefault_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.groupDataAuditing.oldIsDefault + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.id + tag: convert_id_to_string + type: string + ignore_missing: true + - set: + field: event.id + tag: set_event_id_from_audit_id + copy_from: beyondtrust_epm.audit.id + ignore_empty_value: true + - convert: + field: beyondtrust_epm.audit.installationKeyDataAuditing.deleted + tag: convert_installationKeyDataAuditing_deleted_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.installationKeyDataAuditing.deleted + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.installationKeyDataAuditing.newDisabled + tag: convert_installationKeyDataAuditing_newDisabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.installationKeyDataAuditing.newDisabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.installationKeyDataAuditing.oldDisabled + tag: convert_installationKeyDataAuditing_oldDisabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.installationKeyDataAuditing.oldDisabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.locked + tag: convert_locked_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.locked + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.managementRuleDataAuditing.newPriority + tag: convert_managementRuleDataAuditing_newPriority_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.managementRuleDataAuditing.newPriority + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.managementRuleDataAuditing.oldPriority + tag: convert_managementRuleDataAuditing_oldPriority_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.managementRuleDataAuditing.oldPriority + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.mmcRemoteClientDataAuditing.enabled + tag: convert_mmcRemoteClientDataAuditing_enabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.mmcRemoteClientDataAuditing.enabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.mmcRemoteClientDataAuditing.oldEnabled + tag: convert_mmcRemoteClientDataAuditing_oldEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.mmcRemoteClientDataAuditing.oldEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.openIdConfigDataAuditing.secretUpdated + tag: convert_openIdConfigDataAuditing_secretUpdated_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.openIdConfigDataAuditing.secretUpdated + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.reputationSettingsDataAuditing.oldReputationIntegrationEnabled + tag: convert_reputationSettingsDataAuditing_oldReputationIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.reputationSettingsDataAuditing.oldReputationIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.reputationSettingsDataAuditing.reputationConfigChanged + tag: convert_reputationSettingsDataAuditing_reputationConfigChanged_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.reputationSettingsDataAuditing.reputationConfigChanged + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.reputationSettingsDataAuditing.reputationIntegrationEnabled + tag: convert_reputationSettingsDataAuditing_reputationIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.reputationSettingsDataAuditing.reputationIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.securitySettingsDataAuditing.oldTokenTimeout + tag: convert_securitySettingsDataAuditing_oldTokenTimeout_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.securitySettingsDataAuditing.oldTokenTimeout + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.securitySettingsDataAuditing.tokenTimeout + tag: convert_securitySettingsDataAuditing_tokenTimeout_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.securitySettingsDataAuditing.tokenTimeout + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.siemIntegrationBaseDetailModel.siemIntegrationEnabled + tag: convert_siemIntegrationBaseDetailModel_siemIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.siemIntegrationBaseDetailModel.siemIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.siemIntegrationQradarAuditing.siemIntegrationEnabled + tag: convert_siemIntegrationQradarAuditing_siemIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.siemIntegrationQradarAuditing.siemIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.siemIntegrationS3Auditing.siemIntegrationEnabled + tag: convert_siemIntegrationS3Auditing_siemIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.siemIntegrationS3Auditing.siemIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.siemIntegrationS3Auditing.siemSseEnabled + tag: convert_siemIntegrationS3Auditing_siemSseEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.siemIntegrationS3Auditing.siemSseEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.siemIntegrationSentinelAuditing.siemIntegrationEnabled + tag: convert_siemIntegrationSentinelAuditing_siemIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.siemIntegrationSentinelAuditing.siemIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.siemIntegrationSplunkAuditing.siemIntegrationEnabled + tag: convert_siemIntegrationSplunkAuditing_siemIntegrationEnabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.siemIntegrationSplunkAuditing.siemIntegrationEnabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: user.name + tag: set_user_name_from_audit_user + copy_from: beyondtrust_epm.audit.user + ignore_empty_value: true + - date: + field: beyondtrust_epm.audit.userDataAuditing.deletedAt + tag: date_userDataAuditing_deletedAt + if: ctx.beyondtrust_epm?.audit?.userDataAuditing?.deletedAt != null && ctx.beyondtrust_epm.audit.userDataAuditing.deletedAt != '' + target_field: beyondtrust_epm.audit.userDataAuditing.deletedAt + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.audit.userDataAuditing.deletedAt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.userDataAuditing.newDisabled + tag: convert_userDataAuditing_newDisabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.userDataAuditing.newDisabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.audit.userDataAuditing.oldDisabled + tag: convert_userDataAuditing_oldDisabled_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.audit.userDataAuditing.oldDisabled + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: user.id + tag: set_user_id_from_audit_userId + copy_from: beyondtrust_epm.audit.userId + ignore_empty_value: true + - append: + field: related.user + tag: append_beyondtrust_epm_audit_userId_into_related_user + value: '{{{beyondtrust_epm.audit.userId}}}' + allow_duplicates: false + if: ctx.beyondtrust_epm?.audit?.userId != null + - append: + field: related.user + tag: append_beyondtrust_epm_audit_user_into_related_user + value: '{{{beyondtrust_epm.audit.user}}}' + allow_duplicates: false + if: ctx.beyondtrust_epm?.audit?.user != null + - append: + field: related.user + tag: append_beyondtrust_epm_audit_changedBy_into_related_user + value: '{{{beyondtrust_epm.audit.changedBy}}}' + allow_duplicates: false + if: ctx.beyondtrust_epm?.audit?.changedBy != null + - remove: + field: + - beyondtrust_epm.audit.details + - beyondtrust_epm.audit.id + - beyondtrust_epm.audit.user + - beyondtrust_epm.audit.userId + - beyondtrust_epm.audit.created + tag: remove_fields_mapped_to_ecs + ignore_missing: true + - script: + tag: remove_null_values + lang: painless + description: Remove null or empty values from the document. + source: |- + void handleMap(Map map) { + map.values().removeIf(v -> { + if (v instanceof Map) { + handleMap(v); + } else if (v instanceof List) { + handleList(v); + } + return v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) + }); + } + void handleList(List list) { + list.removeIf(v -> { + if (v instanceof Map) { + handleMap(v); + } else if (v instanceof List) { + handleList(v); + } + return v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) + }); + } + handleMap(ctx); + # rename to snake case + - script: + description: > + Convert field names from camelCase to snake_case recursively. + tag: script_convert_camelcase_to_snake_case + lang: painless + source: |- + String camelToSnake(String str) { + StringBuilder result = new StringBuilder(); + for (int i = 0; i < str.length(); i++) { + char c = str.charAt(i); + if (Character.isUpperCase(c)) { + if (i > 0) { + char prev = str.charAt(i - 1); + boolean nextIsLower = (i + 1 < str.length()) && Character.isLowerCase(str.charAt(i + 1)); + boolean prevIsDigit = Character.isDigit(prev); + if (Character.isLowerCase(prev) || prevIsDigit || (Character.isUpperCase(prev) && nextIsLower)) { + result.append('_'); + } + } + result.append(Character.toLowerCase(c)); + } else { + result.append(c); + } + } + return result.toString(); + } + def convertToSnakeCase(def obj) { + if (obj instanceof Map) { + def newObj = [:]; + for (entry in obj.entrySet()) { + String newKey = camelToSnake(entry.getKey()); + newObj[newKey] = convertToSnakeCase(entry.getValue()); + } + return newObj; + } else if (obj instanceof List) { + def newList = []; + for (item in obj) { + newList.add(convertToSnakeCase(item)); + } + return newList; + } else { + return obj; + } + } + ctx.beyondtrust_epm = ctx.beyondtrust_epm ?: [:]; + if (ctx.beyondtrust_epm?.audit != null) { + ctx.beyondtrust_epm.audit = convertToSnakeCase(ctx.beyondtrust_epm.audit); + } + - set: + field: event.kind + tag: set_pipeline_error_into_event_kind + if: ctx.error?.message != null + value: pipeline_error + - append: + field: tags + tag: append_tags + if: ctx.error?.message != null + value: preserve_original_event + allow_duplicates: false +on_failure: + - append: + field: error.message + value: |- + Processor '{{{_ingest.on_failure_processor_type}}}' + {{{#_ingest.on_failure_processor_tag}}}with tag '{{{_ingest.on_failure_processor_tag}}}' + {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{_ingest.on_failure_message}}}' + - set: + field: event.kind + tag: set_pipeline_error_to_event_kind + value: pipeline_error + - append: + field: tags + tag: append_tags + value: preserve_original_event + allow_duplicates: false diff --git a/packages/beyondtrust_epm/data_stream/audit/fields/base-fields.yml b/packages/beyondtrust_epm/data_stream/audit/fields/base-fields.yml new file mode 100644 index 00000000000..1d37d2bf391 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/fields/base-fields.yml @@ -0,0 +1,16 @@ +- name: data_stream.type + external: ecs +- name: data_stream.dataset + external: ecs +- name: data_stream.namespace + external: ecs +- name: event.module + type: constant_keyword + external: ecs + value: beyondtrust_epm +- name: event.dataset + type: constant_keyword + external: ecs + value: beyondtrust_epm.audit +- name: '@timestamp' + external: ecs diff --git a/packages/beyondtrust_epm/data_stream/audit/fields/beats.yml b/packages/beyondtrust_epm/data_stream/audit/fields/beats.yml new file mode 100644 index 00000000000..7ada8b46c3f --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/fields/beats.yml @@ -0,0 +1,24 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: aws.s3 + type: group + fields: + - name: bucket + type: group + fields: + - name: arn + type: keyword + description: The AWS S3 bucket ARN. + - name: name + type: keyword + description: The AWS S3 bucket name. + - name: object + type: group + fields: + - name: key + type: keyword + description: The AWS S3 Object key. diff --git a/packages/beyondtrust_epm/data_stream/audit/fields/ecs.yml b/packages/beyondtrust_epm/data_stream/audit/fields/ecs.yml new file mode 100644 index 00000000000..b24d606b439 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/fields/ecs.yml @@ -0,0 +1,9 @@ +# Define ECS constant fields as constant_keyword +- name: observer.product + external: ecs + type: constant_keyword + value: Endpoint Privilege Management +- name: observer.vendor + external: ecs + type: constant_keyword + value: BeyondTrust diff --git a/packages/beyondtrust_epm/data_stream/audit/fields/fields.yml b/packages/beyondtrust_epm/data_stream/audit/fields/fields.yml new file mode 100644 index 00000000000..9c1613dee1c --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/fields/fields.yml @@ -0,0 +1,745 @@ +- name: beyondtrust_epm + type: group + fields: + - name: audit + type: group + fields: + - name: agent_data_auditing + type: group + fields: + - name: new_adapter_version + type: keyword + description: Adapter version installed in the computer. + - name: new_agent_id + type: keyword + description: Guid to store the new Agent Id assigned to the computer. + - name: new_computer_group_id + type: keyword + description: The computer group Id that the agent is going to be assigned to. + - name: new_computer_group_name + type: keyword + description: The computer group name that the agent is going to be assigned to. + - name: new_host_type + type: keyword + description: The host type detected for the agent. + - name: new_os_name + type: keyword + description: Os Name assigned detected by the adapter. + - name: new_timestamp + type: date + description: TimeStamp of the audit event. + - name: old_adapter_version + type: keyword + description: Present adapter version, in case of updating, this value can reflect the last adapter version used. + - name: old_agent_id + type: keyword + description: Guid to store the old Agent Id if there is a change in Agent Id. + - name: old_computer_group_id + type: keyword + description: The computer group Id that the agent was assigned to. + - name: old_computer_group_name + type: keyword + description: The computer group name that the agent was assigned to. + - name: old_host_type + type: keyword + description: The present Host type found by the adapter. + - name: old_os_name + type: keyword + description: The present Os Name detected by the adapter. + - name: old_timestamp + type: date + description: TimeStamp of a previous audit event. + - name: api_client_data_auditing + type: group + fields: + - name: deleted + type: boolean + - name: new_description + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: new_name + type: keyword + - name: old_description + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: old_name + type: keyword + - name: secret_updated + type: boolean + - name: audit_type + type: keyword + description: audit type. + - name: authorization_request_data_auditing + type: group + fields: + - name: auth_request_api_client_id + type: keyword + description: Authorization Request API Client ID. + - name: auth_request_api_client_secret + type: keyword + description: Authorization Request Client Secret. + - name: auth_request_client_id + type: keyword + description: Authorization Request ClientId. + - name: auth_request_client_secret + type: keyword + description: Authorization Request Client Secret. + - name: auth_request_config_changed + type: boolean + description: Is Authorization Request Config changed?. + - name: auth_request_host_name + type: keyword + description: Authorization Requests Hostname. + - name: auth_request_integration_enabled + type: boolean + description: Old Value is Authorization Request Integration Enabled?. + - name: auth_request_password + type: keyword + description: Authorization Request Password. + - name: auth_request_user_name + type: keyword + description: Authorization Request User Name. + - name: old_auth_request_api_client_id + type: keyword + description: Old Value Authorization Request API Client ID. + - name: old_auth_request_api_client_secret + type: keyword + description: Old Value Authorization Request Client Secret. + - name: old_auth_request_client_id + type: keyword + description: Old Value Authorization Request ClientId. + - name: old_auth_request_client_secret + type: keyword + description: Old Value Authorization Request Client Secret. + - name: old_auth_request_host_name + type: keyword + description: Old Value Authorization Requests Hostname. + - name: old_auth_request_integration_enabled + type: boolean + description: Old Value is Authorization Request Integration Enabled?. + - name: old_auth_request_password + type: keyword + description: Old Value Authorization Request Password. + - name: old_auth_request_user_name + type: keyword + description: Old Value Authorization Request User Name. + - name: auto_update_group_client_settings_data_auditing + type: group + fields: + - name: new_app_event_log_type + type: keyword + description: New value of application event log type. + - name: new_beyond_insight_cert_name + type: keyword + description: New value of Beyond insight certificate name. + - name: new_beyond_insight_url + type: keyword + description: New value of Beyond insight URL. + - name: new_beyond_insight_work_group + type: keyword + description: New value of Beyond insight group. + - name: new_cert_mode + type: keyword + description: New value of certificate mode. + - name: new_config_audit_enabled + type: keyword + description: New value of config audit enabled. + - name: new_config_audit_mode + type: keyword + description: New value of config audit mode. + - name: new_crl_fail_open + type: keyword + description: New value of crl fail open. + - name: new_download_audit_mode + type: keyword + description: New value of download audit mode. + - name: new_hook_load_method + type: keyword + description: New value of hook load method. + - name: new_policy_enabled + type: keyword + description: New value of policy enabled. + - name: new_policy_precedence + type: keyword + description: New value of policy precedence. + - name: new_ps_mode + type: keyword + description: New value of ps mode. + - name: old_app_event_log_type + type: keyword + description: Old value of app event log type. + - name: old_beyond_insight_cert_name + type: keyword + description: Old value of Beyond insight certificate name. + - name: old_beyond_insight_url + type: keyword + description: Old value of Beyond insight URL. + - name: old_beyond_insight_work_group + type: keyword + description: Old value of Beyond insight group. + - name: old_cert_mode + type: keyword + description: Old value of certificate mode. + - name: old_config_audit_enabled + type: keyword + description: Old value of config audit enabled. + - name: old_config_audit_mode + type: keyword + description: Old value of config audit mode. + - name: old_crl_fail_open + type: keyword + description: Old value of crl fail open. + - name: old_download_audit_mode + type: keyword + description: Old value of download audit mode. + - name: old_hook_load_method + type: keyword + description: Old value of hook load method. + - name: old_policy_enabled + type: keyword + description: Old value of policy enabled. + - name: old_policy_precedence + type: keyword + description: Old value of policy precedence. + - name: old_ps_mode + type: keyword + description: Old value of ps mode. + - name: auto_update_group_config_settings_data_auditing + type: group + fields: + - name: new_adapter_version + type: keyword + description: New value of adapter version for package manager. + - name: new_client_version + type: keyword + description: New value of client version for package manager. + - name: new_enable_auto_update + type: keyword + description: New value of Enable auto update for package manager. + - name: new_use_latest_version + type: keyword + description: New value of use latest version for package manager. + - name: old_adapter_version + type: keyword + description: Old value of adapter version for package manager. + - name: old_client_version + type: keyword + description: Old value of client version for package manager. + - name: old_enable_auto_update + type: keyword + description: Old value of Enable auto update for package manager. + - name: old_use_latest_version + type: keyword + description: Old value of use latest version for package manager. + - name: auto_update_group_mac_client_settings_data_auditing + type: group + fields: + - name: new_anti_tamper + type: keyword + - name: new_badge_icons + type: keyword + - name: new_biometric_authentication_enabled + type: keyword + - name: new_mount_assist + type: keyword + - name: new_sudo_enabled + type: keyword + - name: old_anti_tamper + type: keyword + - name: old_badge_icons + type: keyword + - name: old_biometric_authentication_enabled + type: keyword + - name: old_mount_assist + type: keyword + - name: old_sudo_enabled + type: keyword + - name: auto_update_rate_limit_data_auditing + type: group + fields: + - name: old_pm_requests_limit_minutes + type: long + description: Old Value Auto update request limits in minutes. + - name: old_pm_requests_limits + type: long + description: Old Value Auto update request limits. + - name: pm_requests_limit_minutes + type: long + description: Auto update request limits in minutes. + - name: pm_requests_limits + type: long + description: Auto update request limits. + - name: azure_ad_integration_data_auditing + type: group + fields: + - name: azure_ad_client_id + type: keyword + description: Azure AD Client Id used in the integration. + - name: azure_ad_client_secret + type: keyword + description: Azure AD Client Secret. + - name: azure_ad_config_changed + type: boolean + description: Is Azure AD Configuration changed?. + - name: azure_ad_integration_enabled + type: boolean + description: Is Microsoft Entra ID Integration enabled?. + - name: azure_ad_tenant_id + type: keyword + description: Old Value Azure AD Tenant ID. + - name: azure_ad_use_certificate_auth + type: boolean + description: Azure AD Use Certified Authorization. + - name: old_azure_ad_client_id + type: keyword + description: Old Value Azure AD Client Id used in the integration. + - name: old_azure_ad_client_secret + type: keyword + description: Old Value Azure AD Client Secret. + - name: old_azure_ad_integration_enabled + type: boolean + description: Old Value Is Microsoft Entra ID Integration enabled?. + - name: old_azure_ad_tenant_id + type: keyword + description: Old Value Azure AD Tenant ID. + - name: old_azure_ad_use_certificate_auth + type: boolean + description: Old Value Azure AD Use Certified Authorization. + - name: changed_by + type: keyword + description: Changed by enum used for activity audits. + - name: computer_data_auditing + type: group + fields: + - name: deactivated_agents + type: flattened + - name: new_deleted_agents + type: keyword + - name: updated_policies_on + type: flattened + - name: computer_policy_data_auditing + type: group + fields: + - name: deactivated_agent_deletion_days + type: long + description: Deactivated Agent Deletion Days. + - name: enable_deactivated_agent_deletion + type: boolean + description: Is enable deactivated Agent Deletion. + - name: inactivity_agent_deactivation_days + type: long + description: Deactivation Days for inactivity. + - name: old_deactivated_agent_deletion_days + type: long + description: Old Value Deactivated Agent Deletion Days. + - name: old_enable_deactivated_agent_deletion + type: boolean + description: Old Value Is enable deactivated Agent Deletion. + - name: old_inactivity_agent_deactivation_days + type: long + description: Old Value Deactivation Days for inactivity. + - name: created + type: date + description: created. + - name: details + description: Details. + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: entity + type: keyword + description: Entity. + - name: entity_name + type: keyword + description: Name of the entity that was modified. + - name: error_info + type: flattened + - name: group_data_auditing + type: group + fields: + - name: add_policy_revisions + type: flattened + - name: new_agents + type: flattened + - name: new_description + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: new_is_default + type: boolean + - name: new_name + type: keyword + - name: old_description + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: old_is_default + type: boolean + - name: old_name + type: keyword + - name: remove_agents + type: flattened + - name: remove_policy_revisions + type: flattened + - name: id + type: keyword + description: Id. + - name: installation_key_data_auditing + type: group + fields: + - name: deleted + type: boolean + - name: new_disabled + type: boolean + - name: new_label + type: keyword + - name: old_disabled + type: boolean + - name: old_label + type: keyword + - name: locked + type: boolean + - name: management_rule_data_auditing + type: group + fields: + - name: new_priority + type: long + description: New Priority Value for rule. + - name: old_priority + type: long + description: Old priority value for rule. + - name: mmc_remote_client_data_auditing + type: group + fields: + - name: client_id + type: keyword + description: ClientId selected. + - name: enabled + type: boolean + description: Is Remote Client enabled?. + - name: old_client_id + type: keyword + description: Old Value ClientId selected. + - name: old_enabled + type: boolean + description: Old Value Is Remote Client enabled?. + - name: open_id_config_data_auditing + type: group + fields: + - name: new_authentication_type + type: keyword + description: New Authentication Type. + - name: new_client_id + type: keyword + description: New ClientId. + - name: new_domain + type: keyword + description: New Domain. + - name: new_open_id_connect_provider + type: keyword + description: New OpenIdProvider. + - name: old_authentication_type + type: keyword + description: Old Authentication Type. + - name: old_client_id + type: keyword + description: Old client ID. + - name: old_domain + type: keyword + description: Old domain. + - name: old_open_id_connect_provider + type: keyword + description: Old OpenId Provider. + - name: secret_updated + type: boolean + description: Is Secret Updated?. + - name: permission_group_data_auditing + type: group + fields: + - name: new_description + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: new_name + type: keyword + - name: new_number_of_users + type: keyword + - name: old_description + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: old_name + type: keyword + - name: old_number_of_users + type: keyword + - name: permission_set_id + type: keyword + - name: policy_data_auditing + type: group + fields: + - name: new_description + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: new_name + type: keyword + - name: old_description + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: old_name + type: keyword + - name: policy_revision_data_auditing + type: group + fields: + - name: new_annotation_note + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: new_groups + type: flattened + - name: reputation_settings_data_auditing + type: group + fields: + - name: old_reputation_integration_api_key + type: keyword + description: Old Value Reputation Integration Key. + - name: old_reputation_integration_enabled + type: boolean + description: Old Value Is reputation integration enabled?. + - name: reputation_config_changed + type: boolean + description: Reputation Configuration changed. + - name: reputation_integration_api_key + type: keyword + description: Reputation Integration Key. + - name: reputation_integration_enabled + type: boolean + description: Is reputation integration enabled?. + - name: security_settings_data_auditing + type: group + fields: + - name: old_token_timeout + type: long + description: Old Value Token Timeout. + - name: token_timeout + type: long + description: Token Timeout. + - name: settings_data_auditing + type: group + fields: + - name: add_domain + type: keyword + - name: modify_domain_new_value + type: keyword + - name: modify_domain_old_value + type: keyword + - name: remove_domain + type: keyword + - name: siem_integration_base_detail_model + type: group + fields: + - name: siem_format + type: keyword + description: Data format selected. + - name: siem_integration_enabled + type: boolean + description: Is siem integration enabled?. + - name: siem_integration_type + type: keyword + description: Type of integration selected. + - name: siem_integration_qradar_auditing + type: group + fields: + - name: cert + description: Cert. + type: keyword + multi_fields: + - name: text + type: match_only_text + - name: host_name + type: keyword + description: Hostname. + - name: port + type: keyword + description: Port. + - name: siem_format + type: keyword + description: Data format selected. + - name: siem_integration_enabled + type: boolean + description: Is siem integration enabled?. + - name: siem_integration_type + type: keyword + description: Type of integration selected. + - name: siem_integration_s3_auditing + type: group + fields: + - name: siem_access_key_id + type: keyword + description: AccessKeyId. + - name: siem_bucket_name + type: keyword + description: AWS Bucket name. + - name: siem_codec + type: keyword + description: Codec. + - name: siem_format + type: keyword + description: Data format selected. + - name: siem_integration_enabled + type: boolean + description: Is siem integration enabled?. + - name: siem_integration_type + type: keyword + description: Type of integration selected. + - name: siem_region_name + type: keyword + description: Region. + - name: siem_sse_enabled + type: boolean + description: Is SSE enabled. + - name: siem_integration_sentinel_auditing + type: group + fields: + - name: siem_format + type: keyword + description: Data format selected. + - name: siem_integration_enabled + type: boolean + description: Is siem integration enabled?. + - name: siem_integration_type + type: keyword + description: Type of integration selected. + - name: table_name + type: keyword + description: TableName. + - name: workspace_id + type: keyword + description: WorkspaceId. + - name: siem_integration_splunk_auditing + type: group + fields: + - name: host_name + type: keyword + description: Hostname. + - name: index + type: keyword + description: Index. + - name: siem_format + type: keyword + description: Data format selected. + - name: siem_integration_enabled + type: boolean + description: Is siem integration enabled?. + - name: siem_integration_type + type: keyword + description: Type of integration selected. + - name: user + type: keyword + description: user name. + - name: user_data_auditing + type: group + fields: + - name: deleted_at + type: date + description: Deleted date of the user. + - name: new_date_time_display_format + type: keyword + description: New Datetime Display Format. + - name: new_disabled + type: boolean + description: New Disabled. + - name: new_email_address + type: keyword + description: New Email Address. + - name: new_olson_time_zone_id + type: keyword + description: New Timezone. + - name: new_permission_sets + type: group + fields: + - name: permission_set_id + type: keyword + description: The Id of the permission set. + - name: permission_set_name + type: keyword + description: The name of the permission set. + - name: new_preferred_language + type: keyword + description: New Preferred Language. + - name: new_user_type + type: keyword + description: new user type. + - name: old_date_time_display_format + type: keyword + description: Old Datetime Display Format. + - name: old_disabled + type: boolean + description: Old Disabled. + - name: old_email_address + type: keyword + description: Old Email Address. + - name: old_olson_time_zone_id + type: keyword + description: Old Timezone. + - name: old_permission_sets + type: group + fields: + - name: permission_set_id + type: keyword + description: The Id of the permission set. + - name: permission_set_name + type: keyword + description: The name of the permission set. + - name: old_preferred_language + type: keyword + description: Old Preferred Language. + - name: old_user_type + type: keyword + description: old user type. + - name: roles + type: group + fields: + - name: new_roles + type: group + fields: + - name: role_id + type: keyword + description: role id. + - name: role_name + type: keyword + description: role name. + - name: old_roles + type: group + fields: + - name: role_id + type: keyword + description: role id. + - name: role_name + type: keyword + description: role name. + - name: resource_id + type: keyword + description: Id of the resource. + - name: resource_name + type: keyword + description: Resource name. + - name: resource_type + type: keyword + description: Type of resource. + - name: user_id + type: keyword + description: User id. diff --git a/packages/beyondtrust_epm/data_stream/audit/manifest.yml b/packages/beyondtrust_epm/data_stream/audit/manifest.yml new file mode 100644 index 00000000000..e58d2897380 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/manifest.yml @@ -0,0 +1,215 @@ +title: Collect Audit logs from BeyondTrust EPM +type: logs +streams: + - input: cel + title: BeyondTrust EPM Audit Logs + enabled: false + description: Collect Audit logs from BeyondTrust EPM via the ActivityAudits API. + template_path: cel.yml.hbs + vars: + - name: initial_interval + type: text + title: Initial Interval + description: How far back to pull the logs from BeyondTrust EPM API. Supported units for this parameter are h/m/s. + multi: false + required: true + show_user: true + default: 24h + - name: interval + type: text + title: Interval + description: Duration between requests to the BeyondTrust EPM API. Supported units for this parameter are h/m/s. + default: 5m + multi: false + required: true + show_user: true + - name: page_size + type: integer + title: Page Size + description: Page size for the response of the BeyondTrust EPM API. The maximum supported page size is 200. + default: 200 + multi: false + required: true + show_user: false + - name: max_executions + type: integer + title: Maximum Pages Per Interval + description: Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval. + multi: false + required: false + show_user: false + default: 1000 + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: true + show_user: false + default: 30s + - name: enable_request_tracer + type: bool + title: Enable request tracing + default: false + multi: false + required: false + show_user: false + description: >- + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. + Enabling this request tracing compromises security and should only be used for debugging. Disabling the request + tracer will delete any stored traces. + See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) + for details. + - name: tags + type: text + title: Tags + description: Tags for the data-stream. + multi: true + required: true + show_user: false + default: + - forwarded + - beyondtrust_epm-audit + - name: preserve_original_event + required: false + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: aws-s3 + template_path: aws-s3.yml.hbs + title: BeyondTrust EPM Audit logs via AWS S3 or SQS + description: Collecting BeyondTrust EPM Audit logs via AWS S3 or SQS input. + enabled: false + vars: + - name: bucket_arn + type: text + title: '[S3] Bucket ARN' + multi: false + required: false + show_user: true + description: ARN of the AWS S3 bucket that will be polled for list operation. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence. + - name: access_point_arn + type: text + title: '[S3] Access Point ARN' + multi: false + required: false + show_user: true + description: ARN of the AWS S3 Access Point that will be polled for list operation. Mandatory if the "Collect logs via S3 Bucket" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN. + - name: bucket_list_prefix + type: text + title: '[S3] Bucket Prefix' + multi: false + required: false + show_user: true + description: Prefix to apply for the list request to the S3 bucket. + - name: interval + type: text + title: '[S3] Interval' + multi: false + required: false + show_user: true + default: 120s + description: Listing of the S3 bucket will be polled according to the time interval defined by bucket_list_interval config. Default value is 120 secs. Supported units for this parameter are h/m/s. + - name: number_of_workers + type: integer + title: '[S3] Number of Workers' + multi: false + required: false + show_user: true + default: 5 + description: Number of workers that will process the S3 objects listed. + - name: start_timestamp + type: text + title: '[S3] Start Timestamp' + multi: false + required: false + show_user: false + description: If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, '2020-10-10T10:30:00Z' (UTC) or '2020-10-10T10:30:00Z+02:30' (with zone offset). + - name: ignore_older + type: text + title: '[S3] Ignore Older Timespan' + multi: false + required: false + show_user: false + description: If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`. + - name: queue_url + type: text + title: '[SQS] Queue URL' + multi: false + required: false + show_user: true + description: URL of the AWS SQS queue that messages will be received from. It is a required parameter for collecting logs via the AWS SQS. + - name: visibility_timeout + type: text + title: '[SQS] Visibility Timeout' + multi: false + required: false + show_user: true + default: 300s + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s. + - name: api_timeout + type: text + title: '[SQS] API Timeout' + multi: false + required: false + show_user: true + default: 120s + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s. + - name: max_number_of_messages + type: integer + title: '[SQS] Maximum Concurrent SQS Messages' + required: false + show_user: true + default: 5 + description: Deprecated in agent version 8.16.0, this parameter is ignored if present, use number_of_workers instead. The maximum number of SQS messages that can be inflight at any time. + - name: file_selectors + type: yaml + title: '[SQS] File Selectors' + multi: false + required: false + show_user: false + description: >- + If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global content_type and expand_event_list_from_field values are ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that do not match one of the regexes will not be processed. + - name: external_id + type: text + title: External ID + multi: false + required: false + show_user: false + description: External ID to use when assuming a role in another account. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - beyondtrust_epm-audit + - name: preserve_original_event + required: false + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/beyondtrust_epm/data_stream/audit/sample_event.json b/packages/beyondtrust_epm/data_stream/audit/sample_event.json new file mode 100644 index 00000000000..4fbe3279fbd --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/audit/sample_event.json @@ -0,0 +1,393 @@ +{ + "@timestamp": "2026-04-08T14:32:15.234Z", + "agent": { + "ephemeral_id": "811aab89-56c0-4970-b01e-85b41c56e6b2", + "id": "869883ad-4a20-41a5-868b-e4450f4de69f", + "name": "elastic-agent-74696", + "type": "filebeat", + "version": "8.18.0" + }, + "aws": { + "s3": { + "bucket": { + "arn": "arn:aws:s3:::elastic-package-beyondtrust-epm-bucket-11922", + "name": "elastic-package-beyondtrust-epm-bucket-11922" + }, + "object": { + "key": "audit.log" + } + } + }, + "beyondtrust_epm": { + "audit": { + "agent_data_auditing": { + "new_adapter_version": "25.1.0.234", + "new_agent_id": "f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0", + "new_computer_group_id": "g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1", + "new_computer_group_name": "Production_Servers", + "new_host_type": "Windows Server", + "new_os_name": "Windows Server 2022", + "new_timestamp": "2026-04-08T14:30:00.000Z", + "old_adapter_version": "25.0.1.198", + "old_agent_id": "e4f5g6h7-8i9j-0k1l-2m3n-o4p5q6r7s8t9", + "old_computer_group_id": "f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0", + "old_computer_group_name": "Workstations", + "old_host_type": "Windows Workstation", + "old_os_name": "Windows 10 Enterprise", + "old_timestamp": "2026-04-08T14:00:00.000Z" + }, + "api_client_data_auditing": { + "deleted": false, + "new_description": "Production environment API client for automated deployments", + "new_name": "ProductionAPIClient_v2", + "old_description": "Production API client", + "old_name": "ProductionAPIClient", + "secret_updated": false + }, + "audit_type": "PolicyModification", + "authorization_request_data_auditing": { + "auth_request_api_client_id": "api-client-v2", + "auth_request_api_client_secret": "***", + "auth_request_client_id": "bt-auth-client-v2", + "auth_request_client_secret": "***", + "auth_request_config_changed": true, + "auth_request_host_name": "auth.company.com", + "auth_request_integration_enabled": true, + "auth_request_password": "***", + "auth_request_user_name": "bt_service_account_v2", + "old_auth_request_api_client_id": "api-client-v1", + "old_auth_request_api_client_secret": "***", + "old_auth_request_client_id": "bt-auth-client-v1", + "old_auth_request_client_secret": "***", + "old_auth_request_host_name": "auth-old.company.local", + "old_auth_request_integration_enabled": false, + "old_auth_request_password": "***", + "old_auth_request_user_name": "bt_service_account" + }, + "auto_update_group_client_settings_data_auditing": { + "new_app_event_log_type": "Information", + "new_beyond_insight_cert_name": "BeyondInsight_Prod_2026", + "new_beyond_insight_url": "https://beyondinsight.company.com", + "new_beyond_insight_work_group": "DOMAIN", + "new_cert_mode": "Subject", + "new_config_audit_enabled": "true", + "new_config_audit_mode": "Detailed", + "new_crl_fail_open": "true", + "new_download_audit_mode": "Verbose", + "new_hook_load_method": "Advanced", + "new_policy_enabled": "true", + "new_policy_precedence": "Central", + "new_ps_mode": "Full", + "old_app_event_log_type": "Warning", + "old_beyond_insight_cert_name": "BeyondInsight_Prod_2025", + "old_beyond_insight_url": "https://beyondinsight.company.local", + "old_beyond_insight_work_group": "WORKGROUP", + "old_cert_mode": "Thumbprint", + "old_config_audit_enabled": "false", + "old_config_audit_mode": "Basic", + "old_crl_fail_open": "false", + "old_download_audit_mode": "Minimal", + "old_hook_load_method": "Standard", + "old_policy_enabled": "true", + "old_policy_precedence": "Local", + "old_ps_mode": "Restricted" + }, + "auto_update_group_config_settings_data_auditing": { + "new_adapter_version": "25.1.0.234", + "new_client_version": "25.1.0", + "new_enable_auto_update": "true", + "new_use_latest_version": "true", + "old_adapter_version": "25.0.1.198", + "old_client_version": "25.0.0", + "old_enable_auto_update": "false", + "old_use_latest_version": "false" + }, + "auto_update_group_mac_client_settings_data_auditing": { + "new_anti_tamper": "enabled", + "new_badge_icons": "visible", + "new_biometric_authentication_enabled": "true", + "new_mount_assist": "enabled", + "new_sudo_enabled": "true", + "old_anti_tamper": "disabled", + "old_badge_icons": "hidden", + "old_biometric_authentication_enabled": "false", + "old_mount_assist": "disabled", + "old_sudo_enabled": "false" + }, + "auto_update_rate_limit_data_auditing": { + "old_pm_requests_limit_minutes": 60, + "old_pm_requests_limits": 100, + "pm_requests_limit_minutes": 30, + "pm_requests_limits": 200 + }, + "azure_ad_integration_data_auditing": { + "azure_ad_client_id": "fedcba98-7654-3210-fedc-ba9876543210", + "azure_ad_client_secret": "***", + "azure_ad_config_changed": true, + "azure_ad_integration_enabled": true, + "azure_ad_tenant_id": "87654321-4321-4321-4321-210987654321", + "azure_ad_use_certificate_auth": true, + "old_azure_ad_client_id": "abcdef01-2345-6789-abcd-ef0123456789", + "old_azure_ad_client_secret": "***", + "old_azure_ad_integration_enabled": false, + "old_azure_ad_tenant_id": "12345678-1234-1234-1234-123456789012", + "old_azure_ad_use_certificate_auth": false + }, + "changed_by": "Portal", + "computer_data_auditing": { + "deactivated_agents": { + "desktop-178": "Hardware decommissioned", + "laptop-042": "Agent inactive for 30 days" + }, + "new_deleted_agents": [ + "LAPTOP-042", + "DESKTOP-178" + ], + "updated_policies_on": { + "server-db-01": "Server_Hardening_Policy_v3", + "workstation-001": "Windows_Security_Policy_v2" + } + }, + "computer_policy_data_auditing": { + "deactivated_agent_deletion_days": 60, + "enable_deactivated_agent_deletion": true, + "inactivity_agent_deactivation_days": 30, + "old_deactivated_agent_deletion_days": 90, + "old_enable_deactivated_agent_deletion": false, + "old_inactivity_agent_deactivation_days": 60 + }, + "entity": "PolicyRevision", + "entity_name": "Windows_Security_Policy_v2", + "group_data_auditing": { + "add_policy_revisions": { + "data_protection_policy": "Revision 2.1", + "finance_access_policy": "Revision 3.2" + }, + "new_agents": { + "workstation-501": "Finance_WS_01", + "workstation-502": "Finance_WS_02" + }, + "new_description": "All finance department users including contractors", + "new_is_default": false, + "new_name": "Finance_Department_Users", + "old_description": "Finance department users", + "old_is_default": false, + "old_name": "Finance_Users", + "remove_agents": { + "workstation-401": "Migrated to new group" + }, + "remove_policy_revisions": { + "legacy_finance_policy": "Revision 1.0" + } + }, + "installation_key_data_auditing": { + "deleted": false, + "new_disabled": false, + "new_label": "Production_Key_2026", + "old_disabled": false, + "old_label": "Production_Key_2025" + }, + "management_rule_data_auditing": { + "new_priority": 100, + "old_priority": 50 + }, + "mmc_remote_client_data_auditing": { + "client_id": "e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7", + "enabled": true, + "old_client_id": "d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6", + "old_enabled": false + }, + "open_id_config_data_auditing": { + "new_authentication_type": "OAuth2", + "new_client_id": "beyondtrust-client-prod-v2", + "new_domain": "auth.company.com", + "new_open_id_connect_provider": "https://login.company.com", + "old_authentication_type": "SAML", + "old_client_id": "beyondtrust-client-prod-v1", + "old_domain": "auth.company.local", + "old_open_id_connect_provider": "https://login.company.local", + "secret_updated": true + }, + "permission_group_data_auditing": { + "new_description": "Full security administration permissions including audit and compliance", + "new_name": "Advanced_Security_Permissions", + "new_number_of_users": "25", + "old_description": "Basic security permissions for viewing", + "old_name": "Basic_Security_Permissions", + "old_number_of_users": "50", + "permission_set_id": "h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2" + }, + "policy_data_auditing": { + "new_description": "Enhanced security policy with additional privilege management rules", + "new_name": "Enhanced_Security_Policy", + "old_description": "Standard security policy for general users", + "old_name": "Standard_Security_Policy" + }, + "policy_revision_data_auditing": { + "new_annotation_note": "Updated policy to include new CVE-2026-1234 mitigation", + "new_groups": { + "it_administrators": "Full access", + "security_team": "Audit access" + } + }, + "reputation_settings_data_auditing": { + "old_reputation_integration_api_key": "***", + "old_reputation_integration_enabled": false, + "reputation_config_changed": true, + "reputation_integration_api_key": "***", + "reputation_integration_enabled": true + }, + "security_settings_data_auditing": { + "old_token_timeout": 7200, + "token_timeout": 3600 + }, + "settings_data_auditing": { + "add_domain": "subsidiary.company.com", + "modify_domain_new_value": "company.com", + "modify_domain_old_value": "company.local", + "remove_domain": "subsi.company.com" + }, + "siem_integration_base_detail_model": { + "siem_format": "JSON", + "siem_integration_enabled": true, + "siem_integration_type": "Splunk" + }, + "siem_integration_qradar_auditing": { + "cert": "-----BEGIN CERTIFICATE-----\nMIID...certificate...content\n-----END CERTIFICATE-----", + "host_name": "qradar.company.com", + "port": "514", + "siem_format": "LEEF", + "siem_integration_enabled": false, + "siem_integration_type": "QRadar" + }, + "siem_integration_s3_auditing": { + "siem_access_key_id": "AKIAIOSFODNN7EXAMPLE", + "siem_bucket_name": "company-beyondtrust-logs", + "siem_codec": "gzip", + "siem_format": "JSON", + "siem_integration_enabled": true, + "siem_integration_type": "AWS", + "siem_region_name": "us-east-1", + "siem_sse_enabled": true + }, + "siem_integration_sentinel_auditing": { + "siem_format": "JSON", + "siem_integration_enabled": true, + "siem_integration_type": "Sentinel", + "table_name": "BeyondTrustAuditLogs", + "workspace_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890" + }, + "siem_integration_splunk_auditing": { + "host_name": "splunk-hec.company.com", + "index": "beyondtrust_audit", + "siem_format": "JSON", + "siem_integration_enabled": true, + "siem_integration_type": "Splunk" + }, + "user_data_auditing": { + "deleted_at": "2026-04-08T14:32:15.234Z", + "new_date_time_display_format": "MM/dd/yyyy HH:mm:ss", + "new_disabled": false, + "new_email_address": "john.doe@company.com", + "new_olson_time_zone_id": "America/New_York", + "new_permission_sets": [ + { + "permission_set_id": "d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6", + "permission_set_name": "Full_Admin_Access" + } + ], + "new_preferred_language": "en-US", + "new_user_type": "Administrator", + "old_date_time_display_format": "yyyy-MM-dd HH:mm:ss", + "old_disabled": false, + "old_email_address": "j.doe@company.com", + "old_olson_time_zone_id": "UTC", + "old_permission_sets": [ + { + "permission_set_id": "c0d1e2f3-4g5h-6i7j-8k9l-m0n1o2p3q4r5", + "permission_set_name": "Read_Only_Access" + } + ], + "old_preferred_language": "en-GB", + "old_user_type": "Standard", + "roles": [ + { + "new_roles": [ + { + "role_id": "b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9", + "role_name": "Security Administrator" + } + ], + "old_roles": [ + { + "role_id": "a5b6c7d8-1e2f-3g4h-5i6j-k7l8m9n0o1p2", + "role_name": "Policy Viewer" + } + ], + "resource_id": "f4g7h8i9-2j3k-4l5m-6n7o-p8q9r0s1t2u3", + "resource_name": "Global_Policy_Manager", + "resource_type": "PolicyManagement" + } + ] + } + } + }, + "cloud": { + "region": "us-east-1" + }, + "data_stream": { + "dataset": "beyondtrust_epm.audit", + "namespace": "12250", + "type": "logs" + }, + "ecs": { + "version": "9.3.0" + }, + "elastic_agent": { + "id": "869883ad-4a20-41a5-868b-e4450f4de69f", + "snapshot": false, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "configuration" + ], + "created": "2026-04-08T14:32:15.234Z", + "dataset": "beyondtrust_epm.audit", + "id": "10574823", + "ingested": "2026-05-28T11:05:04Z", + "kind": "event", + "original": "{\"id\":10574823,\"details\":\"User john.doe modified security policy settings for Windows Defender Exclusions\",\"userId\":\"a7b5c3d1-8f2e-4a6b-9c3d-e5f7a2b4c6d8\",\"user\":\"john.doe@company.com\",\"entity\":\"PolicyRevision\",\"entityName\":\"Windows_Security_Policy_v2\",\"auditType\":\"PolicyModification\",\"created\":\"2026-04-08T14:32:15.2340000\",\"changedBy\":\"Portal\",\"apiClientDataAuditing\":{\"newName\":\"ProductionAPIClient_v2\",\"oldName\":\"ProductionAPIClient\",\"newDescription\":\"Production environment API client for automated deployments\",\"oldDescription\":\"Production API client\",\"secretUpdated\":false,\"deleted\":false},\"computerDataAuditing\":{\"updatedPoliciesOn\":{\"WORKSTATION-001\":\"Windows_Security_Policy_v2\",\"SERVER-DB-01\":\"Server_Hardening_Policy_v3\"},\"deactivatedAgents\":{\"LAPTOP-042\":\"Agent inactive for 30 days\",\"DESKTOP-178\":\"Hardware decommissioned\"},\"newDeletedAgents\":[\"LAPTOP-042\",\"DESKTOP-178\"]},\"groupDataAuditing\":{\"newName\":\"Finance_Department_Users\",\"oldName\":\"Finance_Users\",\"newDescription\":\"All finance department users including contractors\",\"oldDescription\":\"Finance department users\",\"newIsDefault\":false,\"oldIsDefault\":false,\"addPolicyRevisions\":{\"Finance_Access_Policy\":\"Revision 3.2\",\"Data_Protection_Policy\":\"Revision 2.1\"},\"removePolicyRevisions\":{\"Legacy_Finance_Policy\":\"Revision 1.0\"},\"newAgents\":{\"WORKSTATION-501\":\"Finance_WS_01\",\"WORKSTATION-502\":\"Finance_WS_02\"},\"removeAgents\":{\"WORKSTATION-401\":\"Migrated to new group\"}},\"installationKeyDataAuditing\":{\"oldLabel\":\"Production_Key_2025\",\"newLabel\":\"Production_Key_2026\",\"newDisabled\":false,\"oldDisabled\":false,\"deleted\":false},\"policyDataAuditing\":{\"newName\":\"Enhanced_Security_Policy\",\"oldName\":\"Standard_Security_Policy\",\"newDescription\":\"Enhanced security policy with additional privilege management rules\",\"oldDescription\":\"Standard security policy for general users\"},\"policyRevisionDataAuditing\":{\"newGroups\":{\"IT_Administrators\":\"Full access\",\"Security_Team\":\"Audit access\"},\"newAnnotationNote\":\"Updated policy to include new CVE-2026-1234 mitigation\"},\"settingsDataAuditing\":{\"addDomain\":\"subsidiary.company.com\",\"removeDomain\":\"subsi.company.com\",\"modifyDomainOldValue\":\"company.local\",\"modifyDomainNewValue\":\"company.com\"},\"userDataAuditing\":{\"newEmailAddress\":\"john.doe@company.com\",\"oldEmailAddress\":\"j.doe@company.com\",\"newOlsonTimeZoneId\":\"America/New_York\",\"oldOlsonTimeZoneId\":\"UTC\",\"newDateTimeDisplayFormat\":\"MM/dd/yyyy HH:mm:ss\",\"oldDateTimeDisplayFormat\":\"yyyy-MM-dd HH:mm:ss\",\"newPreferredLanguage\":\"en-US\",\"oldPreferredLanguage\":\"en-GB\",\"newDisabled\":false,\"oldDisabled\":false,\"newUserType\":\"Administrator\",\"oldUserType\":\"Standard\",\"deletedAt\":\"2026-04-08T14:32:15.2340000\",\"roles\":[{\"resourceType\":\"PolicyManagement\",\"resourceId\":\"f4g7h8i9-2j3k-4l5m-6n7o-p8q9r0s1t2u3\",\"resourceName\":\"Global_Policy_Manager\",\"newRoles\":[{\"roleId\":\"b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9\",\"roleName\":\"Security Administrator\"}],\"oldRoles\":[{\"roleId\":\"a5b6c7d8-1e2f-3g4h-5i6j-k7l8m9n0o1p2\",\"roleName\":\"Policy Viewer\"}]}],\"newPermissionSets\":[{\"permissionSetId\":\"d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6\",\"permissionSetName\":\"Full_Admin_Access\"}],\"oldPermissionSets\":[{\"permissionSetId\":\"c0d1e2f3-4g5h-6i7j-8k9l-m0n1o2p3q4r5\",\"permissionSetName\":\"Read_Only_Access\"}]},\"openIdConfigDataAuditing\":{\"oldAuthenticationType\":\"SAML\",\"newAuthenticationType\":\"OAuth2\",\"oldDomain\":\"auth.company.local\",\"newDomain\":\"auth.company.com\",\"oldClientId\":\"beyondtrust-client-prod-v1\",\"newClientId\":\"beyondtrust-client-prod-v2\",\"secretUpdated\":true,\"oldOpenIDConnectProvider\":\"https://login.company.local\",\"newOpenIDConnectProvider\":\"https://login.company.com\"},\"mmcRemoteClientDataAuditing\":{\"enabled\":true,\"oldEnabled\":false,\"clientId\":\"e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7\",\"oldClientId\":\"d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6\"},\"computerPolicyDataAuditing\":{\"oldInactivityAgentDeactivationDays\":60,\"oldEnableDeactivatedAgentDeletion\":false,\"oldDeactivatedAgentDeletionDays\":90,\"inactivityAgentDeactivationDays\":30,\"enableDeactivatedAgentDeletion\":true,\"deactivatedAgentDeletionDays\":60},\"azureADIntegrationDataAuditing\":{\"oldAzureAdTenantId\":\"12345678-1234-1234-1234-123456789012\",\"oldAzureAdClientId\":\"abcdef01-2345-6789-abcd-ef0123456789\",\"oldAzureAdClientSecret\":\"***\",\"oldAzureAdUseCertificateAuth\":false,\"oldAzureAdIntegrationEnabled\":false,\"azureAdTenantId\":\"87654321-4321-4321-4321-210987654321\",\"azureAdClientId\":\"fedcba98-7654-3210-fedc-ba9876543210\",\"azureAdClientSecret\":\"***\",\"azureAdUseCertificateAuth\":true,\"azureAdIntegrationEnabled\":true,\"azureAdConfigChanged\":true},\"authorizationRequestDataAuditing\":{\"oldAuthRequestIntegrationEnabled\":false,\"oldAuthRequestHostName\":\"auth-old.company.local\",\"oldAuthRequestClientId\":\"bt-auth-client-v1\",\"oldAuthRequestClientSecret\":\"***\",\"oldAuthRequestPassword\":\"***\",\"oldAuthRequestUserName\":\"bt_service_account\",\"oldAuthRequestApiClientId\":\"api-client-v1\",\"oldAuthRequestApiClientSecret\":\"***\",\"authRequestIntegrationEnabled\":true,\"authRequestHostName\":\"auth.company.com\",\"authRequestClientId\":\"bt-auth-client-v2\",\"authRequestClientSecret\":\"***\",\"authRequestPassword\":\"***\",\"authRequestUserName\":\"bt_service_account_v2\",\"authRequestApiClientId\":\"api-client-v2\",\"authRequestApiClientSecret\":\"***\",\"authRequestConfigChanged\":true},\"reputationSettingsDataAuditing\":{\"oldReputationIntegrationEnabled\":false,\"oldReputationIntegrationApiKey\":\"***\",\"reputationIntegrationEnabled\":true,\"reputationIntegrationApiKey\":\"***\",\"reputationConfigChanged\":true},\"securitySettingsDataAuditing\":{\"tokenTimeout\":3600,\"oldTokenTimeout\":7200},\"siemIntegrationBaseDetailModel\":{\"siemIntegrationEnabled\":true,\"siemIntegrationType\":\"Splunk\",\"siemFormat\":\"JSON\"},\"siemIntegrationQradarAuditing\":{\"siemIntegrationEnabled\":false,\"siemIntegrationType\":\"QRadar\",\"siemFormat\":\"LEEF\",\"hostName\":\"qradar.company.com\",\"port\":\"514\",\"cert\":\"-----BEGIN CERTIFICATE-----\\nMIID...certificate...content\\n-----END CERTIFICATE-----\"},\"siemIntegrationS3Auditing\":{\"siemIntegrationEnabled\":true,\"siemIntegrationType\":\"AWS\",\"siemFormat\":\"JSON\",\"siemAccessKeyId\":\"AKIAIOSFODNN7EXAMPLE\",\"siemBucketName\":\"company-beyondtrust-logs\",\"siemCodec\":\"gzip\",\"siemRegionName\":\"us-east-1\",\"siemSseEnabled\":true},\"siemIntegrationSentinelAuditing\":{\"siemIntegrationEnabled\":true,\"siemIntegrationType\":\"Sentinel\",\"siemFormat\":\"JSON\",\"tableName\":\"BeyondTrustAuditLogs\",\"workspaceId\":\"a1b2c3d4-e5f6-7890-abcd-ef1234567890\"},\"siemIntegrationSplunkAuditing\":{\"siemIntegrationEnabled\":true,\"siemIntegrationType\":\"Splunk\",\"siemFormat\":\"JSON\",\"hostName\":\"splunk-hec.company.com\",\"index\":\"beyondtrust_audit\"},\"agentDataAuditing\":{\"newAgentId\":\"f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0\",\"oldAgentId\":\"e4f5g6h7-8i9j-0k1l-2m3n-o4p5q6r7s8t9\",\"newTimestamp\":\"2026-04-08T14:30:00.0000000\",\"oldTimestamp\":\"2026-04-08T14:00:00.0000000\",\"newHostType\":\"Windows Server\",\"oldHostType\":\"Windows Workstation\",\"newOsName\":\"Windows Server 2022\",\"oldOsName\":\"Windows 10 Enterprise\",\"newAdapterVersion\":\"25.1.0.234\",\"oldAdapterVersion\":\"25.0.1.198\",\"newComputerGroupId\":\"g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1\",\"oldComputerGroupId\":\"f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0\",\"newComputerGroupName\":\"Production_Servers\",\"oldComputerGroupName\":\"Workstations\"},\"managementRuleDataAuditing\":{\"newPriority\":100,\"oldPriority\":50},\"autoUpdateRateLimitDataAuditing\":{\"oldPmRequestsLimits\":100,\"oldPmRequestsLimitMinutes\":60,\"pmRequestsLimits\":200,\"pmRequestsLimitMinutes\":30},\"autoUpdateGroupConfigSettingsDataAuditing\":{\"newEnableAutoUpdate\":\"true\",\"newUseLatestVersion\":\"true\",\"newClientVersion\":\"25.1.0\",\"newAdapterVersion\":\"25.1.0.234\",\"oldEnableAutoUpdate\":\"false\",\"oldUseLatestVersion\":\"false\",\"oldClientVersion\":\"25.0.0\",\"oldAdapterVersion\":\"25.0.1.198\"},\"autoUpdateGroupClientSettingsDataAuditing\":{\"oldAppEventLogType\":\"Warning\",\"oldBeyondInsightCertName\":\"BeyondInsight_Prod_2025\",\"oldBeyondInsightUrl\":\"https://beyondinsight.company.local\",\"oldBeyondInsightWorkGroup\":\"WORKGROUP\",\"oldCertMode\":\"Thumbprint\",\"oldConfigAuditEnabled\":\"false\",\"oldConfigAuditMode\":\"Basic\",\"oldCrlFailOpen\":\"false\",\"oldDownloadAuditMode\":\"Minimal\",\"oldHookLoadMethod\":\"Standard\",\"oldPolicyEnabled\":\"true\",\"oldPolicyPrecedence\":\"Local\",\"oldPsMode\":\"Restricted\",\"newPsMode\":\"Full\",\"newBeyondInsightCertName\":\"BeyondInsight_Prod_2026\",\"newBeyondInsightUrl\":\"https://beyondinsight.company.com\",\"newBeyondInsightWorkGroup\":\"DOMAIN\",\"newAppEventLogType\":\"Information\",\"newHookLoadMethod\":\"Advanced\",\"newCertMode\":\"Subject\",\"newConfigAuditEnabled\":\"true\",\"newConfigAuditMode\":\"Detailed\",\"newCrlFailOpen\":\"true\",\"newDownloadAuditMode\":\"Verbose\",\"newPolicyEnabled\":\"true\",\"newPolicyPrecedence\":\"Central\"},\"permissionGroupDataAuditing\":{\"permissionSetId\":\"h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2\",\"newName\":\"Advanced_Security_Permissions\",\"oldName\":\"Basic_Security_Permissions\",\"newDescription\":\"Full security administration permissions including audit and compliance\",\"oldDescription\":\"Basic security permissions for viewing\",\"newNumberOfUsers\":\"25\",\"oldNumberOfUsers\":\"50\"},\"autoUpdateGroupMacClientSettingsDataAuditing\":{\"newAntiTamper\":\"enabled\",\"newMountAssist\":\"enabled\",\"newSudoEnabled\":\"true\",\"newBiometricAuthenticationEnabled\":\"true\",\"newBadgeIcons\":\"visible\",\"oldAntiTamper\":\"disabled\",\"oldMountAssist\":\"disabled\",\"oldSudoEnabled\":\"false\",\"oldBiometricAuthenticationEnabled\":\"false\",\"oldBadgeIcons\":\"hidden\"}}", + "type": [ + "change" + ] + }, + "input": { + "type": "aws-s3" + }, + "log": { + "file": { + "path": "https://elastic-package-beyondtrust-epm-bucket-11922.s3.us-east-1.amazonaws.com/audit.log" + }, + "offset": 0 + }, + "message": "User john.doe modified security policy settings for Windows Defender Exclusions", + "related": { + "user": [ + "a7b5c3d1-8f2e-4a6b-9c3d-e5f7a2b4c6d8", + "john.doe@company.com", + "Portal" + ] + }, + "tags": [ + "collect_sqs_logs", + "preserve_original_event", + "forwarded", + "beyondtrust_epm-audit" + ], + "user": { + "id": "a7b5c3d1-8f2e-4a6b-9c3d-e5f7a2b4c6d8", + "name": "john.doe@company.com" + } +} diff --git a/packages/beyondtrust_epm/data_stream/event/_dev/deploy/docker/docker-compose.yml b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..4129ff329cd --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,15 @@ +version: '3.8' +services: + beyondtrust_epm: + image: docker.elastic.co/observability/stream:v0.21.0 + hostname: beyondtrust_epm + ports: + - 8090 + volumes: + - ./files:/files:ro + environment: + PORT: '8090' + command: + - http-server + - --addr=:8090 + - --config=/files/config.yml diff --git a/packages/beyondtrust_epm/data_stream/event/_dev/deploy/docker/files/config.yml b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/docker/files/config.yml new file mode 100644 index 00000000000..683a78e1b33 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/docker/files/config.yml @@ -0,0 +1,413 @@ +# The BeyondTrust EPM API uses dot-notation query parameter keys (e.g. +# "Pagination.PageSize", "Sorts[0].order"). The stream mock server parses its +# config with ucfg.PathSep("."), which interprets dots as nested-path separators, +# so these keys cannot be used in query_params matching rules. +# +# To exercise pagination despite this, the Details rule omits query_params and +# instead uses response cycling: the stream server rotates through the responses +# list on successive requests to the same path (response index = request_count % +# len(responses)). Page 1 returns pageCount > pageNumber, causing the CEL +# program to set want_more=true and request the next page. Page 2 returns +# pageNumber == pageCount, ending pagination. + +rules: + - path: /oauth/connect/token + methods: ['POST'] + query_params: + grant_type: client_credentials + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: | + {"access_token":"xxxx","expires_in":600,"token_type":"Bearer", "scope":"urn:management:api"} + + # Events search - Page 1 + - path: /management-api/v3/Events/search + methods: ["GET"] + request_headers: + Authorization: "Bearer xxxx" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {{ minify_json ` + { + "pageNumber": 1, + "pageSize": 1, + "pageCount": 2, + "totalRecordCount": 2, + "events": [ + { + "@timestamp": "2026-04-15T06:49:55.541Z", + "client": { + "address": "198.51.100.100", + "ip": "81.2.69.144", + "port": 443, + "mac": "00:00:5E:00:53:23", + "domain": "foo.example.com", + "registered_domain": "example.com", + "top_level_domain": "co.uk", + "subdomain": "east", + "bytes": 184, + "packets": 12, + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "Name": "DESKTOP-ACME-01", + "as": { + "number": 15169, + "organization": { + "name": "Google LLC" + } + }, + "geo": { + "location": { + "lon": -122, + "lat": 37 + }, + "continent_code": "NA", + "continent_name": "North America", + "country_name": "Canada", + "region_name": "Quebec", + "city_name": "Montreal", + "country_iso_code": "CA", + "postal_code": "94040", + "region_iso_code": "CA-QC", + "timezone": "America/Argentina/Buenos_Aires", + "name": "boston-dc", + "TimezoneOffset": -480 + }, + "user": { + "id": "S-1-5-21-202424912787-2692429404-2351956786-1000", + "name": "a.einstein", + "full_name": "Albert Einstein", + "email": "alice", + "hash": "alice", + "domain": "alice", + "roles": [ + "kibana_admin", + "reporting_user" + ], + "DomainIdentifier": "alice", + "DomainNetBIOSName": "alice", + "DefaultTimezoneOffset": -480, + "LocalIdentifier": 10001, + "group": { + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01", + "domain": "corp.example.com" + }, + "target": { + "id": "S-1-5-21-3623811015-3361044348-30300820-1013", + "name": "DESKTOP-ACME-01", + "full_name": "Alice Williams", + "email": "alice.williams@example.com", + "hash": "b1946ac92492d2347c6235b4d2611184", + "domain": "corp.example.com", + "roles": [ + "admin" + ], + "DomainIdentifier": "corp.example.com", + "DomainNetBIOSName": "corp.example.com", + "DefaultTimezoneOffset": -480, + "LocalIdentifier": 10001, + "group": { + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01", + "domain": "corp.example.com" + } + }, + "effective": { + "id": "S-1-5-21-3623811015-3361044348-30300820-1013", + "name": "DESKTOP-ACME-01", + "full_name": "Alice Williams", + "email": "alice.williams@example.com", + "hash": "b1946ac92492d2347c6235b4d2611184", + "domain": "corp.example.com", + "roles": [ + "admin" + ], + "DomainIdentifier": "corp.example.com", + "DomainNetBIOSName": "corp.example.com", + "DefaultTimezoneOffset": -480, + "LocalIdentifier": 10001, + "group": { + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01", + "domain": "corp.example.com" + } + }, + "changes": { + "id": "S-1-5-21-3623811015-3361044348-30300820-1013", + "name": "DESKTOP-ACME-01", + "full_name": "Alice Williams", + "email": "alice.williams@example.com", + "hash": "b1946ac92492d2347c6235b4d2611184", + "domain": "corp.example.com", + "roles": [ + "admin" + ], + "DomainIdentifier": "corp.example.com", + "DomainNetBIOSName": "corp.example.com", + "DefaultTimezoneOffset": -480, + "LocalIdentifier": 10001, + "group": { + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01", + "domain": "corp.example.com" + } + } + } + }, + "cloud": { + "provider": "aws", + "availability_zone": "us-east-1c", + "region": "us-east-1", + "instance": { + "id": "i-1234567890abcdef0", + "name": "sample-resource" + }, + "machine": { + "type": "t2.medium" + }, + "account": { + "id": "666777888999", + "name": "elastic-dev" + }, + "service": { + "name": "lambda" + }, + "project": { + "id": "my-project", + "name": "my project" + }, + "origin": { + "provider": "aws", + "availability_zone": "us-east-1c", + "region": "us-east-1", + "instance": { + "id": "i-1234567890abcdef0", + "name": "sample-resource" + }, + "machine": { + "type": "t2.medium" + }, + "account": { + "id": "666777888999", + "name": "elastic-dev" + }, + "service": { + "name": "lambda" + }, + "project": { + "id": "my-project", + "name": "my project" + } + }, + "target": { + "provider": "aws", + "availability_zone": "us-east-1c", + "region": "us-east-1", + "instance": { + "id": "i-1234567890abcdef0", + "name": "sample-resource" + }, + "machine": { + "type": "t2.medium" + }, + "account": { + "id": "666777888999", + "name": "elastic-dev" + }, + "service": { + "name": "lambda" + }, + "project": { + "id": "my-project", + "name": "my project" + } + } + }, + "container": { + "cpu": { + "usage": 1 + }, + "disk": { + "read": { + "bytes": 42 + }, + "write": { + "bytes": 42 + } + }, + "id": "sample-id", + "image": { + "name": "sample-resource", + "tag": [ + "item-0" + ], + "hash": { + "all": [ + "sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26" + ] + } + }, + "labels": "sample-environment", + "memory": { + "usage": 1 + }, + "name": "sample-resource", + "network": { + "ingress": { + "bytes": 42 + }, + "egress": { + "bytes": 42 + } + }, + "runtime": "docker" + }, + "email": { + "attachments": [ + { + "file": { + "extension": "sample-extension", + "mime_type": "sample-mime-type", + "name": "sample.bin", + "hash": { + "md5": "d41d8cd98f00b204e9800998ecf8427e", + "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "sha384": "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b", + "sha512": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e", + "ssdeep": "3::", + "tlsh": "T100000000000000000000000000000000000000000000000000000000000000000000" + } + } + } + ], + "bcc": { + "address": [ + "bcc.user1@example.com" + ] + }, + "cc": { + "address": [ + "cc.user1@example.com" + ] + }, + "content_type": "text/plain", + "delivery_timestamp": "2026-04-15T06:49:55.541Z", + "direction": "inbound", + "from": { + "address": [ + "sender@example.com" + ] + }, + "local_id": "c26dbea0-80d5-463b-b93c-4e8b708219ce", + "message_id": "81ce15$8r2j59@mail01.example.com", + "origination_timestamp": "2026-04-15T06:49:55.541Z", + "reply_to": { + "address": [ + "reply.here@example.com" + ] + }, + "sender": { + "address": "198.51.100.100" + }, + "subject": "Please see this important message.", + "to": { + "address": [ + "user1@example.com" + ] + }, + "x_mailer": "Spambot v2.5" + }, + "event": { + "id": "8a4f5002", + "action": "user-password-change", + "outcome": "success", + "type": [ + "item-0" + ], + "provider": "kernel", + "severity": 7, + "original": "Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232", + "hash": "123456789012345678901234567890ABCD", + "duration": 42, + "sequence": 42, + "timezone": "America/Los_Angeles", + "created": "2026-04-15T06:49:55.541Z", + "start": "2026-04-15T06:49:55.541Z", + "end": "2026-04-15T06:49:55.541Z", + "risk_score": 1, + "risk_score_norm": 1, + "ingested": "2026-04-15T06:49:55.541Z", + "reference": "https://system.example.com/event/#0001234", + "url": "https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe", + "reason": "Terminated an unexpected process", + "agent_id_status": "verified", + "ReceivedAt": "2026-04-15T06:49:55.541Z" + } + } + ] + } + `}} + + # Events search - Page 2 + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {{ minify_json ` + { + "pageNumber": 2, + "pageSize": 1, + "pageCount": 2, + "totalRecordCount": 2, + "events": [ + { + "@timestamp": "2026-04-22T18:21:23.442Z", + "event": { + "id": "8a4f500d", + "code": "4648", + "kind": "alert", + "category": [ + "authentication" + ], + "action": "user-password-change", + "outcome": "success", + "type": [ + "item-0" + ], + "module": "beyondtrust_epm", + "dataset": "beyondtrust_epm.event", + "provider": "kernel", + "severity": 7, + "original": "Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232", + "hash": "123456789012345678901234567890ABCD", + "duration": 42, + "sequence": 42, + "timezone": "America/Los_Angeles", + "created": "2026-04-15T06:49:55.541Z", + "start": "2026-04-15T06:49:55.541Z", + "end": "2026-04-15T06:49:55.541Z", + "risk_score": 1, + "risk_score_norm": 1, + "ingested": "2026-04-15T06:49:55.541Z", + "reference": "https://system.example.com/event/#0001234", + "url": "https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe", + "reason": "Terminated an unexpected process", + "agent_id_status": "verified", + "ReceivedAt": "2026-04-15T06:49:55.541Z" + } + } + ] + } + `}} diff --git a/packages/beyondtrust_epm/data_stream/event/_dev/deploy/tf/env.yml b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/tf/env.yml new file mode 100644 index 00000000000..aee5f1c5900 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/tf/env.yml @@ -0,0 +1,9 @@ +version: '2.3' +services: + terraform: + environment: + - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} + - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} + - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} + - AWS_DEFAULT_PROFILE=${AWS_DEFAULT_PROFILE} + - AWS_REGION=${AWS_REGION:-us-east-1} diff --git a/packages/beyondtrust_epm/data_stream/event/_dev/deploy/tf/files/test-event.log b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/tf/files/test-event.log new file mode 100644 index 00000000000..ebe24215a83 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/tf/files/test-event.log @@ -0,0 +1,6 @@ +{"agent":{"version":"6.0.0-rc2","build":{"original":"metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]"},"name":"foo","type":"filebeat","id":"8a4f500d","ephemeral_id":"8a4f500f"},"@timestamp":"2026-04-15T06:49:55.541Z","tags":["production","env2"],"labels":"application","message":"Hello World","client":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:00:5E:00:53:23","domain":"foo.example.com","registered_domain":"example.com","top_level_domain":"co.uk","subdomain":"east","bytes":184,"packets":12,"nat":{"ip":"81.2.69.144","port":443},"Name":"DESKTOP-ACME-01","as":{"number":15169,"organization":{"name":"Google LLC"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"NA","continent_name":"North America","country_name":"Canada","region_name":"Quebec","city_name":"Montreal","country_iso_code":"CA","postal_code":"94040","region_iso_code":"CA-QC","timezone":"America/Argentina/Buenos_Aires","name":"boston-dc","TimezoneOffset":-480},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice","hash":"alice","domain":"alice","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}},"cloud":{"provider":"aws","availability_zone":"us-east-1c","region":"us-east-1","instance":{"id":"i-1234567890abcdef0","name":"sample-resource"},"machine":{"type":"t2.medium"},"account":{"id":"666777888999","name":"elastic-dev"},"service":{"name":"lambda"},"project":{"id":"my-project","name":"my project"},"origin":{"provider":"aws","availability_zone":"us-east-1c","region":"us-east-1","instance":{"id":"i-1234567890abcdef0","name":"sample-resource"},"machine":{"type":"t2.medium"},"account":{"id":"666777888999","name":"elastic-dev"},"service":{"name":"lambda"},"project":{"id":"my-project","name":"my project"}},"target":{"provider":"aws","availability_zone":"us-east-1c","region":"us-east-1","instance":{"id":"i-1234567890abcdef0","name":"sample-resource"},"machine":{"type":"t2.medium"},"account":{"id":"666777888999","name":"elastic-dev"},"service":{"name":"lambda"},"project":{"id":"my-project","name":"my project"}}},"container":{"cpu":{"usage":1},"disk":{"read":{"bytes":42},"write":{"bytes":42}},"id":"sample-id","image":{"name":"sample-resource","tag":["item-0"],"hash":{"all":["[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]"]}},"labels":"sample-environment","memory":{"usage":1},"name":"sample-resource","network":{"ingress":{"bytes":42},"egress":{"bytes":42}},"runtime":"docker"},"data_stream":{"type":"logs","dataset":"beyondtrust_epm.event","namespace":"production"},"destination":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00-00-5E-00-53-23","domain":"foo.example.com","registered_domain":"example.com","top_level_domain":"co.uk","subdomain":"east","bytes":184,"packets":12,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"Google LLC"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"NA","continent_name":"North America","country_name":"Canada","region_name":"Quebec","city_name":"Montreal","country_iso_code":"CA","postal_code":"94040","region_iso_code":"CA-QC","timezone":"America/Argentina/Buenos_Aires","name":"boston-dc","TimezoneOffset":-480},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice","hash":"alice","domain":"alice","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}},"dll":{"name":"kernel32.dll","path":"C:\\Windows\\System32\\kernel32.dll","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"Paint","product":"Microsoft® Windows® Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"}},"dns":{"type":"answer","id":"62111","op_code":"QUERY","header_flags":["RD","RA"],"response_code":"NOERROR","question":{"name":"www.example.com","type":"AAAA","class":"IN","registered_domain":"example.com","top_level_domain":"co.uk","subdomain":"www"},"answers":"sample-answers","resolved_ip":["10.10.10.10","10.10.10.11"]},"ecs":{"version":"1.0.0"},"email":{"attachments":[{"file":{"extension":"sample-extension","mime_type":"sample-mime-type","name":"sample.bin","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"}}}],"bcc":{"address":["bcc.user1@example.com"]},"cc":{"address":["cc.user1@example.com"]},"content_type":"text/plain","delivery_timestamp":"2026-04-15T06:49:55.541Z","direction":"inbound","from":{"address":["sender@example.com"]},"local_id":"c26dbea0-80d5-463b-b93c-4e8b708219ce","message_id":"81ce15$8r2j59@mail01.example.com","origination_timestamp":"2026-04-15T06:49:55.541Z","reply_to":{"address":["reply.here@example.com"]},"sender":{"address":"198.51.100.100"},"subject":"Please see this important message.","to":{"address":["user1@example.com"]},"x_mailer":"Spambot v2.5"},"error":{"id":"sample-id","code":"sample-code","type":"java.lang.NullPointerException","stack_trace":"sample-stack-trace"},"event":{"id":"8a4f500d","code":"4648","kind":"alert","category":["authentication"],"action":"user-password-change","outcome":"success","type":["item-0"],"module":"beyondtrust_epm","dataset":"beyondtrust_epm.event","provider":"kernel","severity":7,"original":"Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232","hash":"123456789012345678901234567890ABCD","duration":42,"sequence":42,"timezone":"America/Los_Angeles","created":"2026-04-15T06:49:55.541Z","start":"2026-04-15T06:49:55.541Z","end":"2026-04-15T06:49:55.541Z","risk_score":1,"risk_score_norm":1,"ingested":"2026-04-15T06:49:55.541Z","reference":"https://system.example.com/event/#0001234","url":"https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe","reason":"Terminated an unexpected process","agent_id_status":"verified","ReceivedAt":"2026-04-15T06:49:55.541Z"},"faas":{"name":"my-function","id":"arn:aws:lambda:us-west-2:123456789012:function:my-function","version":"123","coldstart":true,"execution":"af9d5aa4-a685-4c5f-a22b-444f80b3cc28","trigger":{"type":"http","request_id":"123456789"}},"file":{"name":"example.png","attributes":["readonly","system"],"directory":"/home/alice","drive_letter":"C","path":"/home/alice/example.png","target_path":"sample-target-path","extension":"png","type":"file","device":"sda","inode":"256383","uid":"1001","gid":"1001","group":"alice","owner":"alice","mode":"0640","size":16384,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"Zone.Identifier","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"sample-escription","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"Paint","product":"Microsoft® Windows® Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"x509":{"version_number":"3","serial_number":"55FBB9C7DEBF09809D12CCAA","issuer":{"distinguished_name":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","common_name":["Example SHA2 High Assurance Server CA"],"organizational_unit":["www.example.com"],"organization":["Example Inc"],"locality":["Mountain View"],"state_or_province":["California"],"country":["US"]},"signature_algorithm":"SHA256-RSA","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","common_name":["shared.global.example.net"],"organizational_unit":["item-0"],"organization":["Example, Inc."],"locality":["San Francisco"],"state_or_province":["California"],"country":["US"]},"public_key_algorithm":"RSA","public_key_size":2048,"public_key_exponent":65537,"public_key_curve":"nistp521","alternative_names":["*.elastic.co"]},"Bundle":{"Name":"sample.bin","Type":"EXEC","Creator":"sample-reator","InfoDescription":"sample-info-escription","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"sample-resource","domain":"corp.example.com"},"host":{"DefaultUILanguage":"example-default-ui-language","NetBIOSName":"sample-net-bios","hostname":"sample-hostname","name":"sample-resource","id":"sample-id","ip":["81.2.69.144"],"mac":["00-00-5E-00-53-23","00-00-5E-00-53-24"],"type":"EXEC","uptime":1325,"architecture":"x86_64","domain":"CONTOSO","cpu":{"usage":1},"disk":{"read":{"bytes":42},"write":{"bytes":42}},"network":{"ingress":{"bytes":42,"packets":42},"egress":{"bytes":42,"packets":42}},"boot":{"id":"88a1f0ed-5ae5-41ee-af6b-41921c311872"},"pid_ns_ino":"256383","DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","ChassisType":"sample-hassis-ype","DefaultLocale":"sample-efault-ocale","geo":{"location":{"lon":-122,"lat":37},"continent_code":"NA","continent_name":"North America","country_name":"Canada","region_name":"Quebec","city_name":"Montreal","country_iso_code":"CA","postal_code":"94040","region_iso_code":"CA-QC","timezone":"America/Argentina/Buenos_Aires","name":"boston-dc","TimezoneOffset":-480},"os":{"type":"macos","platform":"darwin","name":"Mac OS X","full":"Mac OS Mojave","family":"debian","version":"10.14.1","kernel":"4.4.0-112-generic","ProductType":"sample-roduct-ype"}},"http":{"request":{"id":"123e4567-e89b-12d3-a456-426614174000","method":"POST","mime_type":"image/gif","body":{"content":"Hello world","bytes":887},"referrer":"https://blog.example.com/","bytes":1437},"response":{"status_code":404,"mime_type":"image/gif","body":{"content":"Hello world","bytes":887},"bytes":1437},"version":"1.1"},"log":{"level":"error","file":{"path":"/var/log/fun-times.log"},"logger":"org.elasticsearch.bootstrap.Bootstrap","origin":{"file":{"name":"Bootstrap.java","line":42},"function":"init"},"syslog":"sample-syslog"},"network":{"name":"Guest Wifi","type":"ipv4","iana_number":"6","transport":"tcp","application":"aim","protocol":"http","direction":"inbound","forwarded_ip":"67.43.156.1","community_id":"1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=","bytes":368,"packets":24,"inner":"sample-inner","vlan":{"id":"10","name":"outside"}},"observer":{"mac":["00-00-5E-00-53-23","00-00-5E-00-53-24"],"ip":["81.2.69.144"],"hostname":"sample-hostname","name":"1_proxySG","product":"s200","vendor":"Symantec","version":"sample-version","serial_number":"sample-serial-number","type":"firewall","ingress":"sample-ingress","egress":"sample-egress","geo":{"location":{"lon":-122,"lat":37},"continent_code":"NA","continent_name":"North America","country_name":"Canada","region_name":"Quebec","city_name":"Montreal","country_iso_code":"CA","postal_code":"94040","region_iso_code":"CA-QC","timezone":"America/Argentina/Buenos_Aires","name":"boston-dc","TimezoneOffset":-480},"os":{"type":"macos","platform":"darwin","name":"Mac OS X","full":"Mac OS Mojave","family":"debian","version":"10.14.1","kernel":"4.4.0-112-generic","ProductType":"sample-roduct-ype"}},"orchestrator":{"cluster":{"name":"sample-resource","id":"sample-id","url":"sample-url","version":"sample-version"},"type":"kubernetes","organization":"elastic","namespace":"kube-system","resource":{"name":"test-pod-cdcws","type":"service","parent":{"type":"DaemonSet"},"ip":["81.2.69.144"],"id":"sample-id"},"api_version":"v1beta1"},"organization":{"name":"sample-resource","id":"sample-id"},"package":{"name":"go","version":"1.12.9","build_version":"36f4f7e89dd61b0988b12ee000b98966867710cd","description":"Open source programming language to build simple/reliable/efficient software.","size":62231,"installed":"2026-04-15T06:49:55.541Z","path":"/usr/local/Cellar/go/1.12.9/","architecture":"x86_64","checksum":"68b329da9893e34099c7d8ad5cb9c940","install_scope":"global","license":"Apache License 2.0","reference":"https://golang.org","type":"rpm"},"process":{"group_leader":{"pid":4242,"entity_id":"sample-entity-id","name":"sample-resource","pgid":4242,"command_line":"sample-command-line","args":["item-0"],"args_count":3,"executable":"sample-executable","title":"sample-title","thread":{"id":"4242","name":"sample-resource"},"start":"2026-04-15T06:49:55.541Z","uptime":3600,"working_directory":"sample-working-directory","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":"sample-env-vars","entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"sample-resource","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"sample-resource","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"sample-resource","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"sample-resource","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"Paint","product":"Microsoft® Windows® Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"sample-resource","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"sample.bin","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","owner":"sample-owner","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"sample-escription","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"sample-description","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"sample.bin","Type":"EXEC","Creator":"sample-reator","InfoDescription":"sample-nfo-escription","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"sample.bin","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice","hash":"alice","domain":"alice","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}}}}} +{"process":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"/usr/bin/ssh -l user 10.0.0.16","args":["/usr/bin/ssh","-l","user","10.0.0.16"],"args_count":4,"executable":"/usr/bin/ssh","title":"bash","thread":{"id":"4242","name":"thread-0"},"start":"2026-04-15T06:49:55.541Z","uptime":1325,"working_directory":"/home/alice","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":["PATH=/usr/local/bin:/usr/bin","USER=ubuntu"],"entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"67.43.156.1","product":"Microsoft\u00ae Windows\u00ae Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"parent":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"/usr/bin/ssh -l user 10.0.0.16","args":["/usr/bin/ssh","-l","user","10.0.0.16"],"args_count":4,"executable":"/usr/bin/ssh","title":"bash","thread":{"id":"4242","name":"thread-0"},"start":"2026-04-15T06:49:55.541Z","uptime":1325,"working_directory":"/home/alice","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":"sample-env-vars","entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"67.43.156.1","product":"Microsoft\u00ae Windows\u00ae Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"group_leader":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"/usr/bin/ssh -l user 10.0.0.16","args":["/usr/bin/ssh","-l","user","10.0.0.16"],"args_count":4,"executable":"/usr/bin/ssh","title":"bash","thread":{"id":"4242","name":"thread-0"},"start":"2026-04-15T06:49:55.541Z","uptime":1325,"working_directory":"/home/alice","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":"sample-env-vars","entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"67.43.156.1","product":"Microsoft\u00ae Windows\u00ae Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}}}}}} +{"process":{"entry_leader":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"/usr/bin/ssh -l user 10.0.0.16","args":["/usr/bin/ssh","-l","user","10.0.0.16"],"args_count":4,"executable":"/usr/bin/ssh","title":"bash","thread":{"id":"4242","name":"thread-0"},"start":"2026-04-15T06:49:55.541Z","uptime":1325,"working_directory":"/home/alice","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":["PATH=/usr/local/bin:/usr/bin","USER=ubuntu"],"entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"67.43.156.1","product":"Microsoft\u00ae Windows\u00ae Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"parent":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"/usr/bin/ssh -l user 10.0.0.16","args":["/usr/bin/ssh","-l","user","10.0.0.16"],"args_count":4,"executable":"/usr/bin/ssh","title":"bash","thread":{"id":"4242","name":"thread-0"},"start":"2026-04-15T06:49:55.541Z","uptime":1325,"working_directory":"/home/alice","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":"sample-env-vars","entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"67.43.156.1","product":"Microsoft\u00ae Windows\u00ae Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"group_leader":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"sample-command-line","args":["item-0"],"args_count":3,"executable":"sample-executable","title":"bash","thread":{"id":"4242","name":"ssh"},"start":"2026-04-15T06:49:55.541Z","uptime":3600,"working_directory":"sample-working-directory","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":"sample-env-vars","entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}}}}}}} +{"process":{"session_leader":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"/usr/bin/ssh -l user 10.0.0.16","args":["/usr/bin/ssh","-l","user","10.0.0.16"],"args_count":4,"executable":"/usr/bin/ssh","title":"bash","thread":{"id":"4242","name":"thread-0"},"start":"2026-04-15T06:49:55.541Z","uptime":1325,"working_directory":"/home/alice","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":["PATH=/usr/local/bin:/usr/bin","USER=ubuntu"],"entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"67.43.156.1","product":"Microsoft\u00ae Windows\u00ae Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"parent":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"/usr/bin/ssh -l user 10.0.0.16","args":["/usr/bin/ssh","-l","user","10.0.0.16"],"args_count":4,"executable":"/usr/bin/ssh","title":"bash","thread":{"id":"4242","name":"thread-0"},"start":"2026-04-15T06:49:55.541Z","uptime":1325,"working_directory":"/home/alice","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":"sample-env-vars","entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"67.43.156.1","product":"Microsoft\u00ae Windows\u00ae Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"group_leader":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"sample-command-line","args":["item-0"],"args_count":3,"executable":"sample-executable","title":"bash","thread":{"id":"4242","name":"ssh"},"start":"2026-04-15T06:49:55.541Z","uptime":3600,"working_directory":"sample-working-directory","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":"sample-env-vars","entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}}}}}}} +{"process":{"previous":{"pid":4242,"entity_id":"c2c455d9f99375d","name":"ssh","pgid":4242,"command_line":"/usr/bin/ssh -l user 10.0.0.16","args":["/usr/bin/ssh","-l","user","10.0.0.16"],"args_count":4,"executable":"/usr/bin/ssh","title":"bash","thread":{"id":"4242","name":"thread-0"},"start":"2026-04-15T06:49:55.541Z","uptime":1325,"working_directory":"/home/alice","exit_code":137,"end":"2026-04-15T06:49:55.541Z","interactive":true,"same_as_process":true,"env_vars":["PATH=/usr/local/bin:/usr/bin","USER=ubuntu"],"entry_meta":{"type":"terminal","source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00:1a:2b:3c:4d:5e","domain":"corp.example.com","registered_domain":"example.com","top_level_domain":"corp.example.com","subdomain":"corp.example.com","bytes":1024,"packets":1024,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"DESKTOP-ACME-01"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"US","continent_name":"North America","country_name":"United States","region_name":"California","city_name":"San Francisco","country_iso_code":"US","postal_code":"US","region_iso_code":"US","timezone":"America/Los_Angeles","name":"us-west-2","TimezoneOffset":-480},"user":{"id":"alice","name":"alice","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}}},"tty":"sample-tty","ElevationRequired":true,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"real_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"saved_group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"supplemental_groups":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"ssh","domain":"corp.example.com"},"hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"67.43.156.1","product":"Microsoft\u00ae Windows\u00ae Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]},"HostedFile":{"name":"ssh","attributes":["item-0"],"directory":"sample-directory","drive_letter":"sample-drive-letter","path":"sample-path","target_path":"sample-target-path","extension":"sample-extension","type":"EXEC","device":"sample-device","inode":"sample-inode","uid":"sample-uid","gid":"sample-gid","group":"sample-group","mode":"sample-mode","size":1024,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"sample-fork-name","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"67.43.156.3","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"sample-original-file-name","file_version":"sample-file-version","description":"67.43.156.2","product":"sample-product","company":"sample-company","imphash":"sample-imphash","architecture":"sample-architecture","pehash":"b1946ac92492d2347c6235b4d2611184"},"x509":{"version_number":"sample-version-number","serial_number":"sample-serial-number","issuer":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"signature_algorithm":"sample-signature-algorithm","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"sample-distinguished-name","common_name":["item-0"],"organizational_unit":["item-0"],"organization":["item-0"],"locality":["item-0"],"state_or_province":["item-0"],"country":["item-0"]},"public_key_algorithm":"sample-public-key-algorithm","public_key_size":42,"public_key_exponent":42,"public_key_curve":"sample-public-key-curve","alternative_names":["item-0"]},"Bundle":{"Name":"ssh","Type":"EXEC","Creator":"sample-reator","InfoDescription":"67.43.156.4","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"sample-subject-name","valid":true,"trusted":true,"status":"sample-status","team_id":"sample-team-id","signing_id":"sample-signing-id","digest_algorithm":"sample-digest-algorithm","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"sample-architecture","byte_order":"sample-byte-order","cpu_type":"sample-cpu-type","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"ssh","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"alice","email":"alice","hash":"alice","domain":"alice","roles":["admin"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"saved_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"real_user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"alice","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}}}}} +{"registry":{"hive":"HKLM","key":"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe","value":"Debugger","path":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger","data":{"type":"REG_SZ","strings":["[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"],"bytes":"ZQBuAC0AVQBTAAAAZQBuAAAAAAA="}},"related":{"ip":["81.2.69.144"],"user":["alice"],"hash":["d41d8cd98f00b204e9800998ecf8427e"],"hosts":["web-server-01.corp.example.com"]},"rule":{"id":"101","uuid":"1100110011","version":"1.1","name":"BLOCK_DNS_over_TLS","description":"Block requests to public DNS over HTTPS / TLS protocols","category":"Attempted Information Leak","ruleset":"Standard_Protocol_Filters","reference":"https://en.wikipedia.org/wiki/DNS_over_TLS","author":["Star-Lord"],"license":"Apache 2.0"},"server":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00-00-5E-00-53-23","domain":"foo.example.com","registered_domain":"example.com","top_level_domain":"co.uk","subdomain":"east","bytes":184,"packets":12,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"Google LLC"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"NA","continent_name":"North America","country_name":"Canada","region_name":"Quebec","city_name":"Montreal","country_iso_code":"CA","postal_code":"94040","region_iso_code":"CA-QC","timezone":"America/Argentina/Buenos_Aires","name":"boston-dc","TimezoneOffset":-480},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice","hash":"alice","domain":"alice","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}},"service":{"environment":"production","id":"d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6","name":"elasticsearch-metrics","node":{"name":"instance-0000000016","role":"background_tasks"},"type":"elasticsearch","state":"sample-state","version":"3.2.4","ephemeral_id":"8a4f500f","address":"172.26.0.2:5432","origin":{"environment":"production","id":"d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6","name":"elasticsearch-metrics","node":{"name":"instance-0000000016","role":"background_tasks"},"type":"elasticsearch","state":"sample-state","version":"3.2.4","ephemeral_id":"8a4f500f","address":"172.26.0.2:5432"},"target":{"environment":"production","id":"d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6","name":"elasticsearch-metrics","node":{"name":"instance-0000000016","role":"background_tasks"},"type":"elasticsearch","state":"sample-state","version":"3.2.4","ephemeral_id":"8a4f500f","address":"172.26.0.2:5432"}},"source":{"address":"198.51.100.100","ip":"81.2.69.144","port":443,"mac":"00-00-5E-00-53-23","domain":"foo.example.com","registered_domain":"example.com","top_level_domain":"co.uk","subdomain":"east","bytes":184,"packets":12,"nat":{"ip":"81.2.69.144","port":443},"as":{"number":15169,"organization":{"name":"Google LLC"}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"NA","continent_name":"North America","country_name":"Canada","region_name":"Quebec","city_name":"Montreal","country_iso_code":"CA","postal_code":"94040","region_iso_code":"CA-QC","timezone":"America/Argentina/Buenos_Aires","name":"boston-dc","TimezoneOffset":-480},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice","hash":"alice","domain":"alice","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"},"target":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-3623811015-3361044348-30300820-1013","name":"DESKTOP-ACME-01","full_name":"Alice Williams","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["admin"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"DESKTOP-ACME-01","domain":"corp.example.com"}}}},"threat":{"enrichments":[{"indicator":"sample-indicator","matched":{"atomic":"sample-atomic","field":"sample-field","id":"sample-id","index":"sample-index","occurred":"2026-04-15T06:49:55.541Z","type":"EXEC"}}],"feed":{"dashboard_id":"5ba16340-72e6-11eb-a3e3-b3cc7c78a70f","name":"AlienVault OTX","description":"Threat feed from the AlienVault Open Threat eXchange network.","reference":"https://otx.alienvault.com"},"framework":"MITRE ATT&CK","group":{"alias":["Magecart Group 6"],"id":"G0037","name":"FIN6","reference":"https://attack.mitre.org/groups/G0037/"},"indicator":{"first_seen":"2026-04-15T06:49:55.541Z","last_seen":"2026-04-15T06:49:55.541Z","modified_at":"2026-04-15T06:49:55.541Z","sightings":20,"type":"ipv4-addr","description":"IP x.x.x.x was observed delivering the Angler EK.","scanner_stats":4,"confidence":"Medium","ip":"67.43.156.1","port":443,"email":{"address":"phish@example.com"},"marking":{"tlp":"CLEAR"},"reference":"https://system.example.com/indicator/0001234","provider":"lrz_urlhaus","x509":{"version_number":"3","serial_number":"55FBB9C7DEBF09809D12CCAA","issuer":{"distinguished_name":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","common_name":["Example SHA2 High Assurance Server CA"],"organizational_unit":["www.example.com"],"organization":["Example Inc"],"locality":["Mountain View"],"state_or_province":["California"],"country":["US"]},"signature_algorithm":"SHA256-RSA","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","common_name":["shared.global.example.net"],"organizational_unit":["item-0"],"organization":["Example, Inc."],"locality":["San Francisco"],"state_or_province":["California"],"country":["US"]},"public_key_algorithm":"RSA","public_key_size":2048,"public_key_exponent":65537,"public_key_curve":"nistp521","alternative_names":["*.elastic.co"]},"as":{"number":15169,"organization":{"name":"Google LLC"}},"file":{"name":"example.png","attributes":["readonly","system"],"directory":"/home/alice","drive_letter":"C","path":"/home/alice/example.png","target_path":"sample-target-path","extension":"png","type":"file","device":"sda","inode":"256383","uid":"1001","owner":"alice","gid":"1001","group":"alice","mode":"0640","size":16384,"mtime":"2026-04-15T06:49:55.541Z","ctime":"2026-04-15T06:49:55.541Z","created":"2026-04-15T06:49:55.541Z","accessed":"2026-04-15T06:49:55.541Z","mime_type":"sample-mime-type","fork_name":"Zone.Identifier","DriveType":"sample-rive-ype","SourceUrl":"sample-ource-rl","ZoneTag":"sample-one-ag","ProductVersion":"sample-roduct-ersion","Description":"sample-escription","Version":"sample-version","hash":{"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha384":"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"3::","tlsh":"T100000000000000000000000000000000000000000000000000000000000000000000"},"pe":{"original_file_name":"MSPAINT.EXE","file_version":"6.3.9600.17415","description":"Paint","product":"Microsoft\u00ae Windows\u00ae Operating System","company":"Microsoft Corporation","imphash":"0c6803c4e922103c4dca5963aad36ddf","architecture":"x64","pehash":"73ff189b63cd6be375a7ff25179a38d347651975"},"x509":{"version_number":"3","serial_number":"55FBB9C7DEBF09809D12CCAA","issuer":{"distinguished_name":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","common_name":["Example SHA2 High Assurance Server CA"],"organizational_unit":["www.example.com"],"organization":["Example Inc"],"locality":["Mountain View"],"state_or_province":["California"],"country":["US"]},"signature_algorithm":"SHA256-RSA","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","common_name":["shared.global.example.net"],"organizational_unit":["item-0"],"organization":["Example, Inc."],"locality":["San Francisco"],"state_or_province":["California"],"country":["US"]},"public_key_algorithm":"RSA","public_key_size":2048,"public_key_exponent":65537,"public_key_curve":"nistp521","alternative_names":["*.elastic.co"]},"Bundle":{"Name":"sample.bin","Type":"EXEC","Creator":"sample-reator","InfoDescription":"sample-info-escription","Version":"sample-version","DownloadSource":"sample-ownload-ource","Uri":"sample-ri"},"Owner":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainName":"corp.example.com","DomainNetBIOSName":"corp.example.com"},"code_signature":{"exists":true,"subject_name":"Microsoft Corporation","valid":true,"trusted":true,"status":"ERROR_UNTRUSTED_ROOT","team_id":"EQHXZ8M8AV","signing_id":"com.apple.xpc.proxy","digest_algorithm":"sha256","timestamp":"2026-04-15T06:49:55.541Z"},"elf":{"creation_date":"2026-04-15T06:49:55.541Z","architecture":"x86-64","byte_order":"Little Endian","cpu_type":"Intel","header":{"class":"sample-class","data":"sample-data","os_abi":"sample-os-abi","type":"EXEC","version":"sample-version","abi_version":"sample-abi-version","entrypoint":42,"object_version":"sample-object-version"},"sections":[{"flags":"sample-flags","name":"sample.bin","physical_offset":"sample-physical-offset","type":"EXEC","physical_size":8192,"virtual_address":4096,"virtual_size":8192,"entropy":4,"chi2":1000}],"exports":{"additionalProp":"sample-additional-rop"},"imports":{"additionalProp":"sample-additional-rop"},"shared_libraries":["item-0"],"telfhash":"b1946ac92492d2347c6235b4d2611184","segments":[{"type":"EXEC","sections":"sample-sections"}]}},"geo":{"location":{"lon":-122,"lat":37},"continent_code":"NA","continent_name":"North America","country_name":"Canada","region_name":"Quebec","city_name":"Montreal","country_iso_code":"CA","postal_code":"94040","region_iso_code":"CA-QC","timezone":"America/Argentina/Buenos_Aires","name":"boston-dc","TimezoneOffset":-480},"registry":{"hive":"HKLM","key":"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe","value":"Debugger","path":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger","data":{"type":"REG_SZ","strings":["[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"],"bytes":"ZQBuAC0AVQBTAAAAZQBuAAAAAAA="}},"url":{"original":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","full":"https://www.elastic.co:443/search?q=elasticsearch#top","scheme":"https","domain":"www.elastic.co","registered_domain":"example.com","top_level_domain":"co.uk","subdomain":"east","port":443,"path":"sample-path","query":"sample-query","extension":"png","fragment":"sample-fragment","username":"sample-username","password":"sample-password"}},"software":{"id":"S0552","name":"AdFind","alias":["X-Agent"],"platforms":["Windows"],"reference":"https://attack.mitre.org/software/S0552/","type":"Tool"},"tactic":{"id":["TA0002"],"name":["Execution"],"reference":["https://attack.mitre.org/tactics/TA0002/"]},"technique":{"id":["T1059"],"name":["Command and Scripting Interpreter"],"reference":["https://attack.mitre.org/techniques/T1059/"],"subtechnique":{"id":["T1059.001"],"name":["PowerShell"],"reference":["https://attack.mitre.org/techniques/T1059/001/"]}}},"tls":{"version":"1.2","version_protocol":"tls","cipher":"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","curve":"secp256r1","resumed":true,"established":true,"next_protocol":"http/1.1","client":{"ja3":"d4e5b18d6b55c71272893221c96ba240","server_name":"www.elastic.co","subject":"CN=myclient, OU=Documentation Team, DC=example, DC=com","issuer":"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","certificate_chain":["MII...","MII..."],"certificate":"MII...","hash":{"md5":"0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC","sha1":"9E393D93138888D288266C2D915214D1D1CCEB2A","sha256":"0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0"},"x509":{"version_number":"3","serial_number":"55FBB9C7DEBF09809D12CCAA","issuer":{"distinguished_name":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","common_name":["Example SHA2 High Assurance Server CA"],"organizational_unit":["www.example.com"],"organization":["Example Inc"],"locality":["Mountain View"],"state_or_province":["California"],"country":["US"]},"signature_algorithm":"SHA256-RSA","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","common_name":["shared.global.example.net"],"organizational_unit":["item-0"],"organization":["Example, Inc."],"locality":["San Francisco"],"state_or_province":["California"],"country":["US"]},"public_key_algorithm":"RSA","public_key_size":2048,"public_key_exponent":65537,"public_key_curve":"nistp521","alternative_names":["*.elastic.co"]}},"server":{"ja3s":"394441ab65754e2207b1e1b457b3641d","subject":"CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com","issuer":"CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","certificate_chain":["MII...","MII..."],"certificate":"MII...","hash":{"md5":"0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC","sha1":"9E393D93138888D288266C2D915214D1D1CCEB2A","sha256":"0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0"},"x509":{"version_number":"3","serial_number":"55FBB9C7DEBF09809D12CCAA","issuer":{"distinguished_name":"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA","common_name":["Example SHA2 High Assurance Server CA"],"organizational_unit":["www.example.com"],"organization":["Example Inc"],"locality":["Mountain View"],"state_or_province":["California"],"country":["US"]},"signature_algorithm":"SHA256-RSA","not_before":"2026-04-15T06:49:55.541Z","not_after":"2026-04-15T06:49:55.541Z","subject":{"distinguished_name":"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net","common_name":["shared.global.example.net"],"organizational_unit":["item-0"],"organization":["Example, Inc."],"locality":["San Francisco"],"state_or_province":["California"],"country":["US"]},"public_key_algorithm":"RSA","public_key_size":2048,"public_key_exponent":65537,"public_key_curve":"nistp521","alternative_names":["*.elastic.co"]}}},"trace":{"id":"4bf92f3577b34da6a3ce929d0e0e4736"},"transaction":{"id":"00f067aa0ba902b7"},"span":{"id":"3ff9a8981b7ccd5a"},"url":{"original":"https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch","full":"https://www.elastic.co:443/search?q=elasticsearch#top","scheme":"https","domain":"www.elastic.co","registered_domain":"example.com","top_level_domain":"co.uk","subdomain":"east","port":443,"path":"sample-path","query":"sample-query","extension":"png","fragment":"sample-fragment","username":"sample-username","password":"sample-password"},"user":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice","hash":"alice","domain":"alice","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"alice","DomainNetBIOSName":"alice","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"},"target":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"effective":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}},"changes":{"id":"S-1-5-21-202424912787-2692429404-2351956786-1000","name":"a.einstein","full_name":"Albert Einstein","email":"alice.williams@example.com","hash":"b1946ac92492d2347c6235b4d2611184","domain":"corp.example.com","roles":["kibana_admin","reporting_user"],"DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DefaultTimezoneOffset":-480,"LocalIdentifier":10001,"group":{"id":"S-1-5-21-3623811015-3361044348-30300820-513","name":"alice","domain":"corp.example.com"}}},"user_agent":{"original":"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1","name":"Safari","version":"12.0","device":{"name":"iPhone"},"os":{"type":"macos","platform":"darwin","name":"Mac OS X","full":"Mac OS Mojave","family":"debian","version":"10.14.1","kernel":"4.4.0-112-generic","ProductType":"sample-roduct-ype"}},"vulnerability":{"classification":"CVSS","enumeration":"CVE","reference":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111","score":{"base":5,"temporal":1,"environmental":5,"version":"2.0"},"category":["Firewall"],"description":"In macOS before 2.12.6, there is a vulnerability in the RPC...","id":"CVE-2019-00001","scanner":{"vendor":"Tenable"},"severity":"Critical","report_id":"20191018.0001"},"EPMWinMac":{"SchemaVersion":"sample-chema-ersion","GroupId":"sample-roup-d","TenantId":"sample-enant-d","AdapterVersion":"sample-dapter-ersion","ActiveX":{"Codebase":"sample-odebase","CLSID":"sample-value","Version":"sample-version"},"AuthorizationRequest":{"ControlAuthorization":true,"AuthRequestURI":"sample-uth-equest"},"AuthorizingUser":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Name":"alice","DomainIdentifier":"corp.example.com","DomainNetBIOSName":"corp.example.com","DomainName":"corp.example.com","CredentialSource":"sample-redential-ource"},"COM":{"AppID":"sample-pp","CLSID":"sample-value","DisplayName":"sample-isplay-ame"},"Configuration":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","RevisionNumber":"sample-evision-umber","Source":"sample-ource","Name":"sample-resource","Path":"sample-ath","LoadAuditMode":["item-0"],"SigningEnforcement":"sample-igning-nforcement","Application":{"Type":"EXEC","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"ApplicationGroup":{"Name":"sample-resource","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"Content":{"Type":"EXEC","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"ContentGroup":{"Name":"sample-resource","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"GPO":{"Version":"sample-version","DisplayName":"sample-isplay-ame","ActiveDirectoryPath":"sample-ctive-irectory-ath","LinkInformation":"sample-ink-nformation"},"Message":{"Type":"EXEC","Name":"sample-resource","Description":"sample-escription","UserReason":"sample-ser-eason","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","AuthMethods":["item-0"],"UserRequestManagementId":"sample-ser-equest-anagement-d","Authorization":{"ChallengeCode":"sample-hallenge-ode","ResponseStatus":"sample-esponse-tatus"},"Authentication":{"User":"sample-ser"}},"Rule":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","OnDemand":true,"Action":"sample-ction","MatchedChild":true},"RuleScript":{"FileName":"sample-ile-ame","Publisher":"sample-publisher","Outcome":{"Version":"sample-version","Name":"sample-resource","RuleAffected":true,"Result":"sample-esult","output":"sample-output"}},"Token":{"Name":"sample-resource","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"Workstyle":{"Name":"sample-resource","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"}},"Event":{"Type":"EXEC","Action":"sample-ction"},"Installer":{"ProductCode":"sample-roduct-ode","UpgradeCode":"sample-pgrade-ode","Action":"sample-ction"},"License":{"InvalidReason":"sample-nvalid-eason"},"PrivilegedGroup":{"Name":"sample-resource","RID":"sample-value","Access":"sample-ccess"},"RemotePowerShell":{"Command":"sample-ommand"},"ServiceControl":{"Service":{"DisplayName":"sample-isplay-ame","Name":"sample-resource","Action":"sample-ction"}},"Session":{"Administrator":true,"Locale":"sample-ocale","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","PowerUser":true,"WindowsSessionId":"sample-indows-ession-d","UILanguage":"sample-anguage","JITAdmin":{"RequestIdentifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","TicketIdentifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","Configuration":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","RevisionNumber":"sample-evision-umber","Source":"sample-ource","Name":"sample-resource","Path":"sample-ath","LoadAuditMode":["item-0"],"SigningEnforcement":"sample-igning-nforcement","Application":{"Type":"EXEC","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"ApplicationGroup":{"Name":"sample-resource","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"Content":{"Type":"EXEC","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"ContentGroup":{"Name":"sample-resource","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"GPO":{"Version":"sample-version","DisplayName":"sample-isplay-ame","ActiveDirectoryPath":"sample-ctive-irectory-ath","LinkInformation":"sample-ink-nformation"},"Message":{"Type":"EXEC","Name":"sample-resource","Description":"sample-escription","UserReason":"sample-ser-eason","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","AuthMethods":["item-0"],"UserRequestManagementId":"sample-ser-equest-anagement-d","Authorization":{"ChallengeCode":"sample-hallenge-ode","ResponseStatus":"sample-esponse-tatus"},"Authentication":{"User":"sample-ser"}},"Rule":{"Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01","OnDemand":true,"Action":"sample-ction","MatchedChild":true},"RuleScript":{"FileName":"sample-ile-ame","Publisher":"sample-publisher","Outcome":{"Version":"sample-version","Name":"sample-resource","RuleAffected":true,"Result":"sample-esult","output":"sample-output"}},"Token":{"Name":"sample-resource","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"},"Workstyle":{"Name":"sample-resource","Description":"sample-escription","Identifier":"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01"}}}},"StoreApp":{"Name":"sample-resource","Publisher":"sample-publisher","Version":"sample-version"},"TrustedApplication":{"Name":"sample-resource","Version":"sample-version"}}} diff --git a/packages/beyondtrust_epm/data_stream/event/_dev/deploy/tf/main.tf b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/tf/main.tf new file mode 100644 index 00000000000..d1cd278096f --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/_dev/deploy/tf/main.tf @@ -0,0 +1,57 @@ +provider "aws" { + region = "us-east-1" + default_tags { + tags = { + environment = var.ENVIRONMENT + repo = var.REPO + branch = var.BRANCH + build = var.BUILD_ID + created_date = var.CREATED_DATE + } + } +} + +resource "aws_s3_bucket" "bucket" { + bucket = "elastic-package-beyondtrust-epm-bucket-${var.TEST_RUN_ID}" +} + +resource "aws_sqs_queue" "queue" { + name = "elastic-package-beyondtrust-epm-queue-${var.TEST_RUN_ID}" + policy = < 0) ? + (has(state.?cursor.last_timestamp) ? + optional.of( + max( + state.cursor.last_timestamp, + body.events[0].event.ingested + ) + ) + : + optional.of(body.events[0].event.ingested) + ) + : + state.?cursor.last_timestamp, + }, + } + ) + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": resp.Status, + "message": "GET " + state.url.trim_suffix("/") + "/management-api/v3/Events/search: " + ( + (size(resp.Body) != 0) ? + string(resp.Body) + : + resp.Status + " (" + string(resp.StatusCode) + ")" + ), + }, + }, + "want_more": false, + "page_number": 1, + } + ) + ) + ) +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..4f1c65a7cd5 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,272 @@ +--- +description: Pipeline for processing event logs. +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: 9.3.0 + - terminate: + tag: data_collection_error + if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null + description: error message set and no data to process. + - remove: + field: + - organization + - division + - team + tag: remove_agentless_tags + if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String + ignore_missing: true + description: Removes the fields added by Agentless as metadata, as they can collide with ECS fields. + - rename: + field: message + tag: rename_message_to_event_original + if: ctx.event?.original == null + target_field: event.original + ignore_missing: true + description: Renames the original `message` field to `event.original` to store a copy of the original message. + - remove: + field: message + tag: remove_message + if: ctx.event?.original != null + ignore_missing: true + description: The `message` field is no longer required if the document has an `event.original` field. + - json: + field: event.original + tag: json_event_original + target_field: beyondtrust_epm.event + - set: + field: observer.vendor + tag: set_observer_vendor + value: BeyondTrust + - set: + field: observer.product + tag: set_observer_product + value: Endpoint Privilege Management + - set: + field: event.kind + tag: set_event_kind + value: event + - append: + field: event.type + tag: append_event_type_info + value: info + allow_duplicates: false + description: BeyondTrust EPM events are informational; set the ECS event.type companion required alongside event.category. + - pipeline: + name: '{{ IngestPipeline "pipeline-network-transport" }}' + tag: route_network_transport + if: >- + ctx.beyondtrust_epm?.event != null + && (ctx.beyondtrust_epm.event.client != null + || ctx.beyondtrust_epm.event.destination != null + || ctx.beyondtrust_epm.event.dns != null + || ctx.beyondtrust_epm.event.http != null + || ctx.beyondtrust_epm.event.network != null + || ctx.beyondtrust_epm.event.server != null + || ctx.beyondtrust_epm.event.source != null + || ctx.beyondtrust_epm.event.tls != null + || ctx.beyondtrust_epm.event.url != null) + - pipeline: + name: '{{ IngestPipeline "pipeline-threat-security" }}' + tag: route_threat_security + if: >- + ctx.beyondtrust_epm?.event != null + && (ctx.beyondtrust_epm.event.threat != null + || ctx.beyondtrust_epm.event.EPMWinMac != null + || ctx.beyondtrust_epm.event.rule != null + || ctx.beyondtrust_epm.event.vulnerability != null) + - pipeline: + name: '{{ IngestPipeline "pipeline-file-endpoint" }}' + tag: route_file_endpoint + if: >- + ctx.beyondtrust_epm?.event != null + && (ctx.beyondtrust_epm.event.file != null + || ctx.beyondtrust_epm.event.EPMWinMac != null + || ctx.beyondtrust_epm.event.dll != null + || ctx.beyondtrust_epm.event.package != null + || ctx.beyondtrust_epm.event.registry != null) + - pipeline: + name: '{{ IngestPipeline "pipeline-process" }}' + tag: route_process + if: >- + ctx.beyondtrust_epm?.event != null + && (ctx.beyondtrust_epm.event.process != null + || ctx.beyondtrust_epm.event.EPMWinMac != null) + - pipeline: + name: '{{ IngestPipeline "pipeline-host-infrastructure" }}' + tag: route_host_infrastructure + if: >- + ctx.beyondtrust_epm?.event != null + && (ctx.beyondtrust_epm.event.EPMWinMac != null + || ctx.beyondtrust_epm.event.cloud != null + || ctx.beyondtrust_epm.event.container != null + || ctx.beyondtrust_epm.event.faas != null + || ctx.beyondtrust_epm.event.host != null + || ctx.beyondtrust_epm.event.observer != null + || ctx.beyondtrust_epm.event.orchestrator != null + || ctx.beyondtrust_epm.event.client != null) + - pipeline: + name: '{{ IngestPipeline "pipeline-identity-user" }}' + tag: route_identity_user + if: >- + ctx.beyondtrust_epm?.event != null + && (ctx.beyondtrust_epm.event.EPMWinMac != null + || ctx.beyondtrust_epm.event.email != null + || ctx.beyondtrust_epm.event.group != null + || ctx.beyondtrust_epm.event.user != null + || ctx.beyondtrust_epm.event.user_agent != null + || ctx.beyondtrust_epm.event.client != null) + - pipeline: + name: '{{ IngestPipeline "pipeline-service-application" }}' + tag: route_service_application + if: >- + ctx.beyondtrust_epm?.event != null + && (ctx.beyondtrust_epm.event.EPMWinMac != null + || ctx.beyondtrust_epm.event.error != null + || ctx.beyondtrust_epm.event.event != null + || ctx.beyondtrust_epm.event.log != null + || ctx.beyondtrust_epm.event.service != null) + - pipeline: + name: '{{ IngestPipeline "pipeline-metadata-observability" }}' + tag: route_metadata_observability + if: >- + ctx.beyondtrust_epm?.event != null + && (ctx.beyondtrust_epm.event['@timestamp'] != null + || ctx.beyondtrust_epm.event.timestamp != null + || ctx.beyondtrust_epm.event.EPMWinMac != null + || ctx.beyondtrust_epm.event.message != null + || ctx.beyondtrust_epm.event.organization != null + || ctx.beyondtrust_epm.event.related != null + || ctx.beyondtrust_epm.event.span != null + || ctx.beyondtrust_epm.event.tags != null + || ctx.beyondtrust_epm.event.trace != null + || ctx.beyondtrust_epm.event.transaction != null) + # rename all fields name to snake case + - script: + tag: script_convert_camelcase_to_snake_case + lang: painless + description: Convert camelCase to snake_case. + source: | + // Helper function to convert camelCase to snake_case + String camelToSnake(String str) { + def result = ""; + def lastCharWasUpperCase = false; + for (int i = 0; i < str.length(); i++) { + char c = str.charAt(i); + if (Character.isUpperCase(c)) { + if (i > 0 && !lastCharWasUpperCase) { + result += "_"; + } + result += Character.toLowerCase(c); + lastCharWasUpperCase = true; + } else { + result += c; + lastCharWasUpperCase = false; + } + } + return result; + } + // Recursive function to handle nested fields + def convertToSnakeCase(def obj) { + if (obj instanceof Map) { + // Convert each key in the map + def newObj = [:]; + for (entry in obj.entrySet()) { + if (entry.getKey().contains("@")) { + newObj[entry.getKey()] = convertToSnakeCase(entry.getValue()); + } else { + String newKey = camelToSnake(entry.getKey()); + newObj[newKey] = convertToSnakeCase(entry.getValue()); + } + } + return newObj; + } else if (obj instanceof List) { + // If it's a list, process each item recursively + def newList = []; + for (item in obj) { + newList.add(convertToSnakeCase(item)); + } + return newList; + } else { + return obj; + } + } + if (ctx.beyondtrust_epm.event != null) { + ctx.beyondtrust_epm.event = convertToSnakeCase(ctx.beyondtrust_epm.event); + } + # rename fields to more readable format for better clarity + - rename: + field: beyondtrust_epm.event.epmwin_mac + tag: rename_epmwin_mac_to_epm_win_mac + target_field: beyondtrust_epm.event.epm_win_mac + ignore_missing: true + - rename: + field: beyondtrust_epm.event.epm_win_mac.session.jitadmin + tag: rename_epm_win_mac_session_jitadmin_to_jit_admin + target_field: beyondtrust_epm.event.epm_win_mac.session.jit_admin + ignore_missing: true + - rename: + field: beyondtrust_epm.event.host.default_uilanguage + tag: rename_host_default_uilanguage_to_default_ui_language + target_field: beyondtrust_epm.event.host.default_ui_language + ignore_missing: true + - rename: + field: beyondtrust_epm.event.epm_win_mac.session.uilanguage + tag: rename_epmwin_mac_session_default_uilanguage_to_ui_language + target_field: beyondtrust_epm.event.epm_win_mac.session.ui_language + ignore_missing: true + + - script: + tag: remove_null_values + lang: painless + description: Remove null or empty values from the document. + source: |- + void handleMap(Map map) { + map.values().removeIf(v -> { + if (v instanceof Map) { + handleMap(v); + } else if (v instanceof List) { + handleList(v); + } + return v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) + }); + } + void handleList(List list) { + list.removeIf(v -> { + if (v instanceof Map) { + handleMap(v); + } else if (v instanceof List) { + handleList(v); + } + return v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) + }); + } + handleMap(ctx); + - set: + field: event.kind + tag: set_pipeline_error_into_event_kind + if: ctx.error?.message != null + value: pipeline_error + - append: + field: tags + tag: append_tags + if: ctx.error?.message != null + value: preserve_original_event + allow_duplicates: false +on_failure: + - append: + field: error.message + value: |- + Processor '{{{_ingest.on_failure_processor_type}}}' + {{{#_ingest.on_failure_processor_tag}}}with tag '{{{_ingest.on_failure_processor_tag}}}' + {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{_ingest.on_failure_message}}}' + - set: + field: event.kind + tag: set_pipeline_error_to_event_kind + value: pipeline_error + - append: + field: tags + tag: append_tags + value: preserve_original_event + allow_duplicates: false diff --git a/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-file-endpoint.yml b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-file-endpoint.yml new file mode 100644 index 00000000000..d9afbb262e4 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-file-endpoint.yml @@ -0,0 +1,1682 @@ +--- +description: Pipeline for processing file and endpoint resource fields (file, registry, dll, package, EPMWinMac). +processors: + - rename: + field: beyondtrust_epm.event.file.owner + tag: rename_file_owner + target_field: beyondtrust_epm.event.file.owner_keyword + if: ctx.beyondtrust_epm?.event?.file?.owner instanceof String + - convert: + field: beyondtrust_epm.event.EPMWinMac.AuthorizationRequest.ControlAuthorization + tag: convert_EPMWinMac_AuthorizationRequest_ControlAuthorization_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.EPMWinMac.AuthorizationRequest.ControlAuthorization + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_EPMWinMac_AuthorizingUser_Identifier_into_related_user + if: ctx.beyondtrust_epm?.event?.EPMWinMac?.AuthorizingUser?.Identifier != null + value: '{{{beyondtrust_epm.event.EPMWinMac.AuthorizingUser.Identifier}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_EPMWinMac_AuthorizingUser_Name_into_related_user + if: ctx.beyondtrust_epm?.event?.EPMWinMac?.AuthorizingUser?.Name != null + value: '{{{beyondtrust_epm.event.EPMWinMac.AuthorizingUser.Name}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_EPMWinMac_Configuration_Message_Authentication_User_into_related_user + if: ctx.beyondtrust_epm?.event?.EPMWinMac?.Configuration?.Message?.Authentication?.User != null + value: '{{{beyondtrust_epm.event.EPMWinMac.Configuration.Message.Authentication.User}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.EPMWinMac.Configuration.Rule.MatchedChild + tag: convert_EPMWinMac_Configuration_Rule_MatchedChild_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.EPMWinMac.Configuration.Rule.MatchedChild + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.EPMWinMac.Configuration.Rule.OnDemand + tag: convert_EPMWinMac_Configuration_Rule_OnDemand_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.EPMWinMac.Configuration.Rule.OnDemand + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.EPMWinMac.Configuration.RuleScript.Outcome.RuleAffected + tag: convert_EPMWinMac_Configuration_RuleScript_Outcome_RuleAffected_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.EPMWinMac.Configuration.RuleScript.Outcome.RuleAffected + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.EPMWinMac.Session.Administrator + tag: convert_EPMWinMac_Session_Administrator_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.EPMWinMac.Session.Administrator + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_EPMWinMac_Session_JITAdmin_Configuration_Message_Authentication_User_into_related_user + if: ctx.beyondtrust_epm?.event?.EPMWinMac?.Session?.JITAdmin?.Configuration?.Message?.Authentication?.User != null + value: '{{{beyondtrust_epm.event.EPMWinMac.Session.JITAdmin.Configuration.Message.Authentication.User}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.EPMWinMac.Session.JITAdmin.Configuration.Rule.MatchedChild + tag: convert_EPMWinMac_Session_JITAdmin_Configuration_Rule_MatchedChild_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.EPMWinMac.Session.JITAdmin.Configuration.Rule.MatchedChild + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.EPMWinMac.Session.JITAdmin.Configuration.Rule.OnDemand + tag: convert_EPMWinMac_Session_JITAdmin_Configuration_Rule_OnDemand_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.EPMWinMac.Session.JITAdmin.Configuration.Rule.OnDemand + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.EPMWinMac.Session.JITAdmin.Configuration.RuleScript.Outcome.RuleAffected + tag: convert_EPMWinMac_Session_JITAdmin_Configuration_RuleScript_Outcome_RuleAffected_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.EPMWinMac.Session.JITAdmin.Configuration.RuleScript.Outcome.RuleAffected + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.EPMWinMac.Session.PowerUser + tag: convert_EPMWinMac_Session_PowerUser_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.EPMWinMac.Session.PowerUser + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: dll.code_signature.digest_algorithm + tag: set_dll_code_signature_digest_algorithm_from_event_dll_code_signature_digest_algorithm + copy_from: beyondtrust_epm.event.dll.code_signature.digest_algorithm + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.dll.code_signature.exists + tag: convert_dll_code_signature_exists_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.dll.code_signature.exists + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: dll.code_signature.exists + tag: set_dll_code_signature_exists_from_event_dll_code_signature_exists + copy_from: beyondtrust_epm.event.dll.code_signature.exists + ignore_empty_value: true + - set: + field: dll.code_signature.signing_id + tag: set_dll_code_signature_signing_id_from_event_dll_code_signature_signing_id + copy_from: beyondtrust_epm.event.dll.code_signature.signing_id + ignore_empty_value: true + - set: + field: dll.code_signature.status + tag: set_dll_code_signature_status_from_event_dll_code_signature_status + copy_from: beyondtrust_epm.event.dll.code_signature.status + ignore_empty_value: true + - set: + field: dll.code_signature.subject_name + tag: set_dll_code_signature_subject_name_from_event_dll_code_signature_subject_name + copy_from: beyondtrust_epm.event.dll.code_signature.subject_name + ignore_empty_value: true + - set: + field: dll.code_signature.team_id + tag: set_dll_code_signature_team_id_from_event_dll_code_signature_team_id + copy_from: beyondtrust_epm.event.dll.code_signature.team_id + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.dll.code_signature.timestamp + tag: date_dll_code_signature_timestamp + if: ctx.beyondtrust_epm?.event?.dll?.code_signature?.timestamp != null && ctx.beyondtrust_epm.event.dll.code_signature.timestamp != '' + target_field: beyondtrust_epm.event.dll.code_signature.timestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.dll.code_signature.timestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: dll.code_signature.timestamp + tag: set_dll_code_signature_timestamp_from_event_dll_code_signature_timestamp + copy_from: beyondtrust_epm.event.dll.code_signature.timestamp + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.dll.code_signature.trusted + tag: convert_dll_code_signature_trusted_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.dll.code_signature.trusted + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: dll.code_signature.trusted + tag: set_dll_code_signature_trusted_from_event_dll_code_signature_trusted + copy_from: beyondtrust_epm.event.dll.code_signature.trusted + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.dll.code_signature.valid + tag: convert_dll_code_signature_valid_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.dll.code_signature.valid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: dll.code_signature.valid + tag: set_dll_code_signature_valid_from_event_dll_code_signature_valid + copy_from: beyondtrust_epm.event.dll.code_signature.valid + ignore_empty_value: true + - set: + field: dll.hash.md5 + tag: set_dll_hash_md5_from_event_dll_hash_md5 + copy_from: beyondtrust_epm.event.dll.hash.md5 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_dll_hash_md5_into_related_hash + if: ctx.beyondtrust_epm?.event?.dll?.hash?.md5 != null + value: '{{{beyondtrust_epm.event.dll.hash.md5}}}' + allow_duplicates: false + - set: + field: dll.hash.sha1 + tag: set_dll_hash_sha1_from_event_dll_hash_sha1 + copy_from: beyondtrust_epm.event.dll.hash.sha1 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_dll_hash_sha1_into_related_hash + if: ctx.beyondtrust_epm?.event?.dll?.hash?.sha1 != null + value: '{{{beyondtrust_epm.event.dll.hash.sha1}}}' + allow_duplicates: false + - set: + field: dll.hash.sha256 + tag: set_dll_hash_sha256_from_event_dll_hash_sha256 + copy_from: beyondtrust_epm.event.dll.hash.sha256 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_dll_hash_sha256_into_related_hash + if: ctx.beyondtrust_epm?.event?.dll?.hash?.sha256 != null + value: '{{{beyondtrust_epm.event.dll.hash.sha256}}}' + allow_duplicates: false + - set: + field: dll.hash.sha384 + tag: set_dll_hash_sha384_from_event_dll_hash_sha384 + copy_from: beyondtrust_epm.event.dll.hash.sha384 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_dll_hash_sha384_into_related_hash + if: ctx.beyondtrust_epm?.event?.dll?.hash?.sha384 != null + value: '{{{beyondtrust_epm.event.dll.hash.sha384}}}' + allow_duplicates: false + - set: + field: dll.hash.sha512 + tag: set_dll_hash_sha512_from_event_dll_hash_sha512 + copy_from: beyondtrust_epm.event.dll.hash.sha512 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_dll_hash_sha512_into_related_hash + if: ctx.beyondtrust_epm?.event?.dll?.hash?.sha512 != null + value: '{{{beyondtrust_epm.event.dll.hash.sha512}}}' + allow_duplicates: false + - set: + field: dll.hash.ssdeep + tag: set_dll_hash_ssdeep_from_event_dll_hash_ssdeep + copy_from: beyondtrust_epm.event.dll.hash.ssdeep + ignore_empty_value: true + - set: + field: dll.hash.tlsh + tag: set_dll_hash_tlsh_from_event_dll_hash_tlsh + copy_from: beyondtrust_epm.event.dll.hash.tlsh + ignore_empty_value: true + - set: + field: dll.name + tag: set_dll_name_from_event_dll_name + copy_from: beyondtrust_epm.event.dll.name + ignore_empty_value: true + - set: + field: dll.path + tag: set_dll_path_from_event_dll_path + copy_from: beyondtrust_epm.event.dll.path + ignore_empty_value: true + - set: + field: dll.pe.architecture + tag: set_dll_pe_architecture_from_event_dll_pe_architecture + copy_from: beyondtrust_epm.event.dll.pe.architecture + ignore_empty_value: true + - set: + field: dll.pe.company + tag: set_dll_pe_company_from_event_dll_pe_company + copy_from: beyondtrust_epm.event.dll.pe.company + ignore_empty_value: true + - set: + field: dll.pe.description + tag: set_dll_pe_description_from_event_dll_pe_description + copy_from: beyondtrust_epm.event.dll.pe.description + ignore_empty_value: true + - set: + field: dll.pe.file_version + tag: set_dll_pe_file_version_from_event_dll_pe_file_version + copy_from: beyondtrust_epm.event.dll.pe.file_version + ignore_empty_value: true + - set: + field: dll.pe.imphash + tag: set_dll_pe_imphash_from_event_dll_pe_imphash + copy_from: beyondtrust_epm.event.dll.pe.imphash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_dll_pe_imphash_into_related_hash + if: ctx.beyondtrust_epm?.event?.dll?.pe?.imphash != null + value: '{{{beyondtrust_epm.event.dll.pe.imphash}}}' + allow_duplicates: false + - set: + field: dll.pe.original_file_name + tag: set_dll_pe_original_file_name_from_event_dll_pe_original_file_name + copy_from: beyondtrust_epm.event.dll.pe.original_file_name + ignore_empty_value: true + - set: + field: dll.pe.pehash + tag: set_dll_pe_pehash_from_event_dll_pe_pehash + copy_from: beyondtrust_epm.event.dll.pe.pehash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_dll_pe_pehash_into_related_hash + if: ctx.beyondtrust_epm?.event?.dll?.pe?.pehash != null + value: '{{{beyondtrust_epm.event.dll.pe.pehash}}}' + allow_duplicates: false + - set: + field: dll.pe.product + tag: set_dll_pe_product_from_event_dll_pe_product + copy_from: beyondtrust_epm.event.dll.pe.product + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.file.accessed + tag: date_file_accessed + if: ctx.beyondtrust_epm?.event?.file?.accessed != null && ctx.beyondtrust_epm.event.file.accessed != '' + target_field: beyondtrust_epm.event.file.accessed + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.file.accessed + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.accessed + tag: set_file_accessed_from_event_file_accessed + copy_from: beyondtrust_epm.event.file.accessed + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.file.attributes + tag: foreach_file_attributes + if: ctx.beyondtrust_epm?.event?.file?.attributes instanceof List + processor: + append: + field: file.attributes + tag: append_file_attributes_into_file_attributes + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: file.code_signature.digest_algorithm + tag: set_file_code_signature_digest_algorithm_from_event_file_code_signature_digest_algorithm + copy_from: beyondtrust_epm.event.file.code_signature.digest_algorithm + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.file.code_signature.exists + tag: convert_file_code_signature_exists_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.file.code_signature.exists + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.code_signature.exists + tag: set_file_code_signature_exists_from_event_file_code_signature_exists + copy_from: beyondtrust_epm.event.file.code_signature.exists + ignore_empty_value: true + - set: + field: file.code_signature.signing_id + tag: set_file_code_signature_signing_id_from_event_file_code_signature_signing_id + copy_from: beyondtrust_epm.event.file.code_signature.signing_id + ignore_empty_value: true + - set: + field: file.code_signature.status + tag: set_file_code_signature_status_from_event_file_code_signature_status + copy_from: beyondtrust_epm.event.file.code_signature.status + ignore_empty_value: true + - set: + field: file.code_signature.subject_name + tag: set_file_code_signature_subject_name_from_event_file_code_signature_subject_name + copy_from: beyondtrust_epm.event.file.code_signature.subject_name + ignore_empty_value: true + - set: + field: file.code_signature.team_id + tag: set_file_code_signature_team_id_from_event_file_code_signature_team_id + copy_from: beyondtrust_epm.event.file.code_signature.team_id + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.file.code_signature.timestamp + tag: date_file_code_signature_timestamp + if: ctx.beyondtrust_epm?.event?.file?.code_signature?.timestamp != null && ctx.beyondtrust_epm.event.file.code_signature.timestamp != '' + target_field: beyondtrust_epm.event.file.code_signature.timestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.file.code_signature.timestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.code_signature.timestamp + tag: set_file_code_signature_timestamp_from_event_file_code_signature_timestamp + copy_from: beyondtrust_epm.event.file.code_signature.timestamp + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.file.code_signature.trusted + tag: convert_file_code_signature_trusted_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.file.code_signature.trusted + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.code_signature.trusted + tag: set_file_code_signature_trusted_from_event_file_code_signature_trusted + copy_from: beyondtrust_epm.event.file.code_signature.trusted + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.file.code_signature.valid + tag: convert_file_code_signature_valid_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.file.code_signature.valid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.code_signature.valid + tag: set_file_code_signature_valid_from_event_file_code_signature_valid + copy_from: beyondtrust_epm.event.file.code_signature.valid + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.file.created + tag: date_file_created + if: ctx.beyondtrust_epm?.event?.file?.created != null && ctx.beyondtrust_epm.event.file.created != '' + target_field: beyondtrust_epm.event.file.created + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.file.created + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.created + tag: set_file_created_from_event_file_created + copy_from: beyondtrust_epm.event.file.created + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.file.ctime + tag: date_file_ctime + if: ctx.beyondtrust_epm?.event?.file?.ctime != null && ctx.beyondtrust_epm.event.file.ctime != '' + target_field: beyondtrust_epm.event.file.ctime + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.file.ctime + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.ctime + tag: set_file_ctime_from_event_file_ctime + copy_from: beyondtrust_epm.event.file.ctime + ignore_empty_value: true + - set: + field: file.device + tag: set_file_device_from_event_file_device + copy_from: beyondtrust_epm.event.file.device + ignore_empty_value: true + - set: + field: file.directory + tag: set_file_directory_from_event_file_directory + copy_from: beyondtrust_epm.event.file.directory + ignore_empty_value: true + - set: + field: file.drive_letter + tag: set_file_drive_letter_from_event_file_drive_letter + copy_from: beyondtrust_epm.event.file.drive_letter + ignore_empty_value: true + - set: + field: file.elf.architecture + tag: set_file_elf_architecture_from_event_file_elf_architecture + copy_from: beyondtrust_epm.event.file.elf.architecture + ignore_empty_value: true + - set: + field: file.elf.byte_order + tag: set_file_elf_byte_order_from_event_file_elf_byte_order + copy_from: beyondtrust_epm.event.file.elf.byte_order + ignore_empty_value: true + - set: + field: file.elf.cpu_type + tag: set_file_elf_cpu_type_from_event_file_elf_cpu_type + copy_from: beyondtrust_epm.event.file.elf.cpu_type + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.file.elf.creation_date + tag: date_file_elf_creation_date + if: ctx.beyondtrust_epm?.event?.file?.elf?.creation_date != null && ctx.beyondtrust_epm.event.file.elf.creation_date != '' + target_field: beyondtrust_epm.event.file.elf.creation_date + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.file.elf.creation_date + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.elf.creation_date + tag: set_file_elf_creation_date_from_event_file_elf_creation_date + copy_from: beyondtrust_epm.event.file.elf.creation_date + ignore_empty_value: true + - set: + field: file.elf.header.abi_version + tag: set_file_elf_header_abi_version_from_event_file_elf_header_abi_version + copy_from: beyondtrust_epm.event.file.elf.header.abi_version + ignore_empty_value: true + - set: + field: file.elf.header.class + tag: set_file_elf_header_class_from_event_file_elf_header_class + copy_from: beyondtrust_epm.event.file.elf.header.class + ignore_empty_value: true + - set: + field: file.elf.header.data + tag: set_file_elf_header_data_from_event_file_elf_header_data + copy_from: beyondtrust_epm.event.file.elf.header.data + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.file.elf.header.entrypoint + tag: convert_file_elf_header_entrypoint_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.file.elf.header.entrypoint + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.elf.header.entrypoint + tag: set_file_elf_header_entrypoint_from_event_file_elf_header_entrypoint + copy_from: beyondtrust_epm.event.file.elf.header.entrypoint + ignore_empty_value: true + - set: + field: file.elf.header.object_version + tag: set_file_elf_header_object_version_from_event_file_elf_header_object_version + copy_from: beyondtrust_epm.event.file.elf.header.object_version + ignore_empty_value: true + - set: + field: file.elf.header.os_abi + tag: set_file_elf_header_os_abi_from_event_file_elf_header_os_abi + copy_from: beyondtrust_epm.event.file.elf.header.os_abi + ignore_empty_value: true + - set: + field: file.elf.header.type + tag: set_file_elf_header_type_from_event_file_elf_header_type + copy_from: beyondtrust_epm.event.file.elf.header.type + ignore_empty_value: true + - set: + field: file.elf.header.version + tag: set_file_elf_header_version_from_event_file_elf_header_version + copy_from: beyondtrust_epm.event.file.elf.header.version + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_chi2 + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.chi2 + tag: convert_file_elf_sections_chi2_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.chi2 + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_chi2 + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + append: + field: file.elf.sections.chi2 + tag: append_file_elf_sections_chi2_into_file_elf_sections_chi2 + value: '{{{_ingest._value.chi2}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_entropy + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.entropy + tag: convert_file_elf_sections_entropy_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.entropy + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_entropy + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + append: + field: file.elf.sections.entropy + tag: append_file_elf_sections_entropy_into_file_elf_sections_entropy + value: '{{{_ingest._value.entropy}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_flags + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + append: + field: file.elf.sections.flags + tag: append_file_elf_sections_flags_into_file_elf_sections_flags + value: '{{{_ingest._value.flags}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_name + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + append: + field: file.elf.sections.name + tag: append_file_elf_sections_name_into_file_elf_sections_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_physical_offset + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + append: + field: file.elf.sections.physical_offset + tag: append_file_elf_sections_physical_offset_into_file_elf_sections_physical_offset + value: '{{{_ingest._value.physical_offset}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_physical_size + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.physical_size + tag: convert_file_elf_sections_physical_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.physical_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_physical_size + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + append: + field: file.elf.sections.physical_size + tag: append_file_elf_sections_physical_size_into_file_elf_sections_physical_size + value: '{{{_ingest._value.physical_size}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_type + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + append: + field: file.elf.sections.type + tag: append_file_elf_sections_type_into_file_elf_sections_type + value: '{{{_ingest._value.type}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_virtual_address + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.virtual_address + tag: convert_file_elf_sections_virtual_address_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.virtual_address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_virtual_address + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + append: + field: file.elf.sections.virtual_address + tag: append_file_elf_sections_virtual_address_into_file_elf_sections_virtual_address + value: '{{{_ingest._value.virtual_address}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_virtual_size + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.virtual_size + tag: convert_file_elf_sections_virtual_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.virtual_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections_virtual_size + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + append: + field: file.elf.sections.virtual_size + tag: append_file_elf_sections_virtual_size_into_file_elf_sections_virtual_size + value: '{{{_ingest._value.virtual_size}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.segments + tag: foreach_file_elf_segments_sections + if: ctx.beyondtrust_epm?.event?.file?.elf?.segments instanceof List + processor: + append: + field: file.elf.segments.sections + tag: append_file_elf_segments_sections_into_file_elf_segments_sections + value: '{{{_ingest._value.sections}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.segments + tag: foreach_file_elf_segments_type + if: ctx.beyondtrust_epm?.event?.file?.elf?.segments instanceof List + processor: + append: + field: file.elf.segments.type + tag: append_file_elf_segments_type_into_file_elf_segments_type + value: '{{{_ingest._value.type}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.shared_libraries + tag: foreach_file_elf_shared_libraries + if: ctx.beyondtrust_epm?.event?.file?.elf?.shared_libraries instanceof List + processor: + append: + field: file.elf.shared_libraries + tag: append_file_elf_shared_libraries_into_file_elf_shared_libraries + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: file.elf.telfhash + tag: set_file_elf_telfhash_from_event_file_elf_telfhash + copy_from: beyondtrust_epm.event.file.elf.telfhash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_elf_telfhash_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.elf?.telfhash != null + value: '{{{beyondtrust_epm.event.file.elf.telfhash}}}' + allow_duplicates: false + - set: + field: file.extension + tag: set_file_extension_from_event_file_extension + copy_from: beyondtrust_epm.event.file.extension + ignore_empty_value: true + - set: + field: file.fork_name + tag: set_file_fork_name_from_event_file_fork_name + copy_from: beyondtrust_epm.event.file.fork_name + ignore_empty_value: true + - set: + field: file.gid + tag: set_file_gid_from_event_file_gid + copy_from: beyondtrust_epm.event.file.gid + ignore_empty_value: true + - set: + field: file.group + tag: set_file_group_from_event_file_group + copy_from: beyondtrust_epm.event.file.group + ignore_empty_value: true + - set: + field: file.hash.md5 + tag: set_file_hash_md5_from_event_file_hash_md5 + copy_from: beyondtrust_epm.event.file.hash.md5 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_hash_md5_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.hash?.md5 != null + value: '{{{beyondtrust_epm.event.file.hash.md5}}}' + allow_duplicates: false + - set: + field: file.hash.sha1 + tag: set_file_hash_sha1_from_event_file_hash_sha1 + copy_from: beyondtrust_epm.event.file.hash.sha1 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_hash_sha1_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.hash?.sha1 != null + value: '{{{beyondtrust_epm.event.file.hash.sha1}}}' + allow_duplicates: false + - set: + field: file.hash.sha256 + tag: set_file_hash_sha256_from_event_file_hash_sha256 + copy_from: beyondtrust_epm.event.file.hash.sha256 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_hash_sha256_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.hash?.sha256 != null + value: '{{{beyondtrust_epm.event.file.hash.sha256}}}' + allow_duplicates: false + - set: + field: file.hash.sha384 + tag: set_file_hash_sha384_from_event_file_hash_sha384 + copy_from: beyondtrust_epm.event.file.hash.sha384 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_hash_sha384_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.hash?.sha384 != null + value: '{{{beyondtrust_epm.event.file.hash.sha384}}}' + allow_duplicates: false + - set: + field: file.hash.sha512 + tag: set_file_hash_sha512_from_event_file_hash_sha512 + copy_from: beyondtrust_epm.event.file.hash.sha512 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_hash_sha512_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.hash?.sha512 != null + value: '{{{beyondtrust_epm.event.file.hash.sha512}}}' + allow_duplicates: false + - set: + field: file.hash.ssdeep + tag: set_file_hash_ssdeep_from_event_file_hash_ssdeep + copy_from: beyondtrust_epm.event.file.hash.ssdeep + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_hash_ssdeep_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.hash?.ssdeep != null + value: '{{{beyondtrust_epm.event.file.hash.ssdeep}}}' + allow_duplicates: false + - set: + field: file.hash.tlsh + tag: set_file_hash_tlsh_from_event_file_hash_tlsh + copy_from: beyondtrust_epm.event.file.hash.tlsh + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_hash_tlsh_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.hash?.tlsh != null + value: '{{{beyondtrust_epm.event.file.hash.tlsh}}}' + allow_duplicates: false + - set: + field: file.inode + tag: set_file_inode_from_event_file_inode + copy_from: beyondtrust_epm.event.file.inode + ignore_empty_value: true + - set: + field: file.mime_type + tag: set_file_mime_type_from_event_file_mime_type + copy_from: beyondtrust_epm.event.file.mime_type + ignore_empty_value: true + - set: + field: file.mode + tag: set_file_mode_from_event_file_mode + copy_from: beyondtrust_epm.event.file.mode + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.file.mtime + tag: date_file_mtime + if: ctx.beyondtrust_epm?.event?.file?.mtime != null && ctx.beyondtrust_epm.event.file.mtime != '' + target_field: beyondtrust_epm.event.file.mtime + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.file.mtime + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.mtime + tag: set_file_mtime_from_event_file_mtime + copy_from: beyondtrust_epm.event.file.mtime + ignore_empty_value: true + - set: + field: file.name + tag: set_file_name_from_event_file_name + copy_from: beyondtrust_epm.event.file.name + ignore_empty_value: true + - set: + field: file.path + tag: set_file_path_from_event_file_path + copy_from: beyondtrust_epm.event.file.path + ignore_empty_value: true + - set: + field: file.pe.architecture + tag: set_file_pe_architecture_from_event_file_pe_architecture + copy_from: beyondtrust_epm.event.file.pe.architecture + ignore_empty_value: true + - set: + field: file.pe.company + tag: set_file_pe_company_from_event_file_pe_company + copy_from: beyondtrust_epm.event.file.pe.company + ignore_empty_value: true + - set: + field: file.pe.description + tag: set_file_pe_description_from_event_file_pe_description + copy_from: beyondtrust_epm.event.file.pe.description + ignore_empty_value: true + - set: + field: file.pe.file_version + tag: set_file_pe_file_version_from_event_file_pe_file_version + copy_from: beyondtrust_epm.event.file.pe.file_version + ignore_empty_value: true + - set: + field: file.pe.imphash + tag: set_file_pe_imphash_from_event_file_pe_imphash + copy_from: beyondtrust_epm.event.file.pe.imphash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_pe_imphash_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.pe?.imphash != null + value: '{{{beyondtrust_epm.event.file.pe.imphash}}}' + allow_duplicates: false + - set: + field: file.pe.original_file_name + tag: set_file_pe_original_file_name_from_event_file_pe_original_file_name + copy_from: beyondtrust_epm.event.file.pe.original_file_name + ignore_empty_value: true + - set: + field: file.pe.pehash + tag: set_file_pe_pehash_from_event_file_pe_pehash + copy_from: beyondtrust_epm.event.file.pe.pehash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_file_pe_pehash_into_related_hash + if: ctx.beyondtrust_epm?.event?.file?.pe?.pehash != null + value: '{{{beyondtrust_epm.event.file.pe.pehash}}}' + allow_duplicates: false + - set: + field: file.pe.product + tag: set_file_pe_product_from_event_file_pe_product + copy_from: beyondtrust_epm.event.file.pe.product + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.file.size + tag: convert_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.file.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.size + tag: set_file_size_from_event_file_size + copy_from: beyondtrust_epm.event.file.size + ignore_empty_value: true + - set: + field: file.target_path + tag: set_file_target_path_from_event_file_target_path + copy_from: beyondtrust_epm.event.file.target_path + ignore_empty_value: true + - set: + field: file.type + tag: set_file_type_from_event_file_type + copy_from: beyondtrust_epm.event.file.type + ignore_empty_value: true + - set: + field: file.uid + tag: set_file_uid_from_event_file_uid + copy_from: beyondtrust_epm.event.file.uid + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.file.x509.alternative_names + tag: foreach_file_x509_alternative_names + if: ctx.beyondtrust_epm?.event?.file?.x509?.alternative_names instanceof List + processor: + append: + field: file.x509.alternative_names + tag: append_file_x509_alternative_names_into_file_x509_alternative_names + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.x509.issuer.common_name + tag: foreach_file_x509_issuer_common_name + if: ctx.beyondtrust_epm?.event?.file?.x509?.issuer?.common_name instanceof List + processor: + append: + field: file.x509.issuer.common_name + tag: append_file_x509_issuer_common_name_into_file_x509_issuer_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.x509.issuer.country + tag: foreach_file_x509_issuer_country + if: ctx.beyondtrust_epm?.event?.file?.x509?.issuer?.country instanceof List + processor: + append: + field: file.x509.issuer.country + tag: append_file_x509_issuer_country_into_file_x509_issuer_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: file.x509.issuer.distinguished_name + tag: set_file_x509_issuer_distinguished_name_from_event_file_x509_issuer_distinguished_name + copy_from: beyondtrust_epm.event.file.x509.issuer.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.file.x509.issuer.locality + tag: foreach_file_x509_issuer_locality + if: ctx.beyondtrust_epm?.event?.file?.x509?.issuer?.locality instanceof List + processor: + append: + field: file.x509.issuer.locality + tag: append_file_x509_issuer_locality_into_file_x509_issuer_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.x509.issuer.organization + tag: foreach_file_x509_issuer_organization + if: ctx.beyondtrust_epm?.event?.file?.x509?.issuer?.organization instanceof List + processor: + append: + field: file.x509.issuer.organization + tag: append_file_x509_issuer_organization_into_file_x509_issuer_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.x509.issuer.organizational_unit + tag: foreach_file_x509_issuer_organizational_unit + if: ctx.beyondtrust_epm?.event?.file?.x509?.issuer?.organizational_unit instanceof List + processor: + append: + field: file.x509.issuer.organizational_unit + tag: append_file_x509_issuer_organizational_unit_into_file_x509_issuer_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.x509.issuer.state_or_province + tag: foreach_file_x509_issuer_state_or_province + if: ctx.beyondtrust_epm?.event?.file?.x509?.issuer?.state_or_province instanceof List + processor: + append: + field: file.x509.issuer.state_or_province + tag: append_file_x509_issuer_state_or_province_into_file_x509_issuer_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - date: + field: beyondtrust_epm.event.file.x509.not_after + tag: date_file_x509_not_after + if: ctx.beyondtrust_epm?.event?.file?.x509?.not_after != null && ctx.beyondtrust_epm.event.file.x509.not_after != '' + target_field: beyondtrust_epm.event.file.x509.not_after + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.file.x509.not_after + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.x509.not_after + tag: set_file_x509_not_after_from_event_file_x509_not_after + copy_from: beyondtrust_epm.event.file.x509.not_after + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.file.x509.not_before + tag: date_file_x509_not_before + if: ctx.beyondtrust_epm?.event?.file?.x509?.not_before != null && ctx.beyondtrust_epm.event.file.x509.not_before != '' + target_field: beyondtrust_epm.event.file.x509.not_before + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.file.x509.not_before + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.x509.not_before + tag: set_file_x509_not_before_from_event_file_x509_not_before + copy_from: beyondtrust_epm.event.file.x509.not_before + ignore_empty_value: true + - set: + field: file.x509.public_key_algorithm + tag: set_file_x509_public_key_algorithm_from_event_file_x509_public_key_algorithm + copy_from: beyondtrust_epm.event.file.x509.public_key_algorithm + ignore_empty_value: true + - set: + field: file.x509.public_key_curve + tag: set_file_x509_public_key_curve_from_event_file_x509_public_key_curve + copy_from: beyondtrust_epm.event.file.x509.public_key_curve + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.file.x509.public_key_exponent + tag: convert_file_x509_public_key_exponent_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.file.x509.public_key_exponent + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.x509.public_key_exponent + tag: set_file_x509_public_key_exponent_from_event_file_x509_public_key_exponent + copy_from: beyondtrust_epm.event.file.x509.public_key_exponent + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.file.x509.public_key_size + tag: convert_file_x509_public_key_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.file.x509.public_key_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.x509.public_key_size + tag: set_file_x509_public_key_size_from_event_file_x509_public_key_size + copy_from: beyondtrust_epm.event.file.x509.public_key_size + ignore_empty_value: true + - set: + field: file.x509.serial_number + tag: set_file_x509_serial_number_from_event_file_x509_serial_number + copy_from: beyondtrust_epm.event.file.x509.serial_number + ignore_empty_value: true + - set: + field: file.x509.signature_algorithm + tag: set_file_x509_signature_algorithm_from_event_file_x509_signature_algorithm + copy_from: beyondtrust_epm.event.file.x509.signature_algorithm + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.file.x509.subject.common_name + tag: foreach_file_x509_subject_common_name + if: ctx.beyondtrust_epm?.event?.file?.x509?.subject?.common_name instanceof List + processor: + append: + field: file.x509.subject.common_name + tag: append_file_x509_subject_common_name_into_file_x509_subject_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.x509.subject.country + tag: foreach_file_x509_subject_country + if: ctx.beyondtrust_epm?.event?.file?.x509?.subject?.country instanceof List + processor: + append: + field: file.x509.subject.country + tag: append_file_x509_subject_country_into_file_x509_subject_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: file.x509.subject.distinguished_name + tag: set_file_x509_subject_distinguished_name_from_event_file_x509_subject_distinguished_name + copy_from: beyondtrust_epm.event.file.x509.subject.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.file.x509.subject.locality + tag: foreach_file_x509_subject_locality + if: ctx.beyondtrust_epm?.event?.file?.x509?.subject?.locality instanceof List + processor: + append: + field: file.x509.subject.locality + tag: append_file_x509_subject_locality_into_file_x509_subject_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.x509.subject.organization + tag: foreach_file_x509_subject_organization + if: ctx.beyondtrust_epm?.event?.file?.x509?.subject?.organization instanceof List + processor: + append: + field: file.x509.subject.organization + tag: append_file_x509_subject_organization_into_file_x509_subject_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.x509.subject.organizational_unit + tag: foreach_file_x509_subject_organizational_unit + if: ctx.beyondtrust_epm?.event?.file?.x509?.subject?.organizational_unit instanceof List + processor: + append: + field: file.x509.subject.organizational_unit + tag: append_file_x509_subject_organizational_unit_into_file_x509_subject_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.x509.subject.state_or_province + tag: foreach_file_x509_subject_state_or_province + if: ctx.beyondtrust_epm?.event?.file?.x509?.subject?.state_or_province instanceof List + processor: + append: + field: file.x509.subject.state_or_province + tag: append_file_x509_subject_state_or_province_into_file_x509_subject_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: file.x509.version_number + tag: set_file_x509_version_number_from_event_file_x509_version_number + copy_from: beyondtrust_epm.event.file.x509.version_number + ignore_empty_value: true + - set: + field: package.architecture + tag: set_package_architecture_from_event_package_architecture + copy_from: beyondtrust_epm.event.package.architecture + ignore_empty_value: true + - set: + field: package.build_version + tag: set_package_build_version_from_event_package_build_version + copy_from: beyondtrust_epm.event.package.build_version + ignore_empty_value: true + - set: + field: package.checksum + tag: set_package_checksum_from_event_package_checksum + copy_from: beyondtrust_epm.event.package.checksum + ignore_empty_value: true + - set: + field: package.description + tag: set_package_description_from_event_package_description + copy_from: beyondtrust_epm.event.package.description + ignore_empty_value: true + - set: + field: package.install_scope + tag: set_package_install_scope_from_event_package_install_scope + copy_from: beyondtrust_epm.event.package.install_scope + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.package.installed + tag: date_package_installed + if: ctx.beyondtrust_epm?.event?.package?.installed != null && ctx.beyondtrust_epm.event.package.installed != '' + target_field: beyondtrust_epm.event.package.installed + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.package.installed + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: package.installed + tag: set_package_installed_from_event_package_installed + copy_from: beyondtrust_epm.event.package.installed + ignore_empty_value: true + - set: + field: package.license + tag: set_package_license_from_event_package_license + copy_from: beyondtrust_epm.event.package.license + ignore_empty_value: true + - set: + field: package.name + tag: set_package_name_from_event_package_name + copy_from: beyondtrust_epm.event.package.name + ignore_empty_value: true + - set: + field: package.path + tag: set_package_path_from_event_package_path + copy_from: beyondtrust_epm.event.package.path + ignore_empty_value: true + - set: + field: package.reference + tag: set_package_reference_from_event_package_reference + copy_from: beyondtrust_epm.event.package.reference + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.package.size + tag: convert_package_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.package.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: package.size + tag: set_package_size_from_event_package_size + copy_from: beyondtrust_epm.event.package.size + ignore_empty_value: true + - set: + field: package.type + tag: set_package_type_from_event_package_type + copy_from: beyondtrust_epm.event.package.type + ignore_empty_value: true + - set: + field: package.version + tag: set_package_version_from_event_package_version + copy_from: beyondtrust_epm.event.package.version + ignore_empty_value: true + - set: + field: registry.data.bytes + tag: set_registry_data_bytes_from_event_registry_data_bytes + copy_from: beyondtrust_epm.event.registry.data.bytes + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.registry.data.strings + tag: foreach_registry_data_strings + if: ctx.beyondtrust_epm?.event?.registry?.data?.strings instanceof List + processor: + append: + field: registry.data.strings + tag: append_registry_data_strings_into_registry_data_strings + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: registry.data.type + tag: set_registry_data_type_from_event_registry_data_type + copy_from: beyondtrust_epm.event.registry.data.type + ignore_empty_value: true + - set: + field: registry.hive + tag: set_registry_hive_from_event_registry_hive + copy_from: beyondtrust_epm.event.registry.hive + ignore_empty_value: true + - set: + field: registry.key + tag: set_registry_key_from_event_registry_key + copy_from: beyondtrust_epm.event.registry.key + ignore_empty_value: true + - set: + field: registry.path + tag: set_registry_path_from_event_registry_path + copy_from: beyondtrust_epm.event.registry.path + ignore_empty_value: true + - set: + field: registry.value + tag: set_registry_value_from_event_registry_value + copy_from: beyondtrust_epm.event.registry.value + ignore_empty_value: true + - set: + field: file.owner + tag: set_file_owner_from_file_Owner_Name + copy_from: beyondtrust_epm.event.file.Owner.Name + ignore_empty_value: true + override: false + - append: + field: related.user + tag: append_event_file_owner_into_related_user + if: ctx.beyondtrust_epm?.event?.file?.Owner?.Name != null + value: '{{{beyondtrust_epm.event.file.Owner.Name}}}' + allow_duplicates: false + - set: + field: file.origin_url + tag: set_file_origin_url_from_file_SourceUrl + copy_from: beyondtrust_epm.event.file.SourceUrl + ignore_empty_value: true + override: false + - foreach: + field: file.elf.sections.chi2 + tag: foreach_file_elf_sections_chi2_convert_to_long + if: ctx.file?.elf?.sections?.chi2 instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_file_elf_sections_chi2_elements_to_long + type: long + ignore_missing: true + ignore_failure: true + - foreach: + field: file.elf.sections.entropy + tag: foreach_file_elf_sections_entropy_convert_to_long + if: ctx.file?.elf?.sections?.entropy instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_file_elf_sections_entropy_elements_to_long + type: long + ignore_missing: true + ignore_failure: true + - foreach: + field: file.elf.sections.physical_size + tag: foreach_file_elf_sections_physical_size_convert_to_long + if: ctx.file?.elf?.sections?.physical_size instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_file_elf_sections_physical_size_elements_to_long + type: long + ignore_missing: true + ignore_failure: true + - foreach: + field: file.elf.sections.virtual_address + tag: foreach_file_elf_sections_virtual_address_convert_to_long + if: ctx.file?.elf?.sections?.virtual_address instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_file_elf_sections_virtual_address_elements_to_long + type: long + ignore_missing: true + ignore_failure: true + - foreach: + field: file.elf.sections.virtual_size + tag: foreach_file_elf_sections_virtual_size_convert_to_long + if: ctx.file?.elf?.sections?.virtual_size instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_file_elf_sections_virtual_size_elements_to_long + type: long + ignore_missing: true + ignore_failure: true + - append: + field: event.category + tag: append_event_category_file + if: >- + ctx.file != null + && (ctx.event?.category == null || !ctx.event.category.contains('file')) + value: file + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.file.elf.sections + tag: foreach_file_elf_sections + if: ctx.beyondtrust_epm?.event?.file?.elf?.sections instanceof List + processor: + remove: + field: + - _ingest._value.chi2 + - _ingest._value.entropy + - _ingest._value.flags + - _ingest._value.name + - _ingest._value.physical_offset + - _ingest._value.physical_size + - _ingest._value.type + - _ingest._value.virtual_address + - _ingest._value.virtual_size + tag: remove_fields_mapped_with_ecs_from_file_elf_sections + ignore_missing: true + - foreach: + field: beyondtrust_epm.event.file.elf.segments + tag: foreach_file_elf_segments + if: ctx.beyondtrust_epm?.event?.file?.elf?.segments instanceof List + processor: + remove: + field: + - _ingest._value.sections + - _ingest._value.type + tag: remove_fields_mapped_with_ecs_from_file_elf_segments + ignore_missing: true + - remove: + field: + - beyondtrust_epm.event.dll.code_signature.digest_algorithm + - beyondtrust_epm.event.dll.code_signature.exists + - beyondtrust_epm.event.dll.code_signature.signing_id + - beyondtrust_epm.event.dll.code_signature.status + - beyondtrust_epm.event.dll.code_signature.subject_name + - beyondtrust_epm.event.dll.code_signature.team_id + - beyondtrust_epm.event.dll.code_signature.timestamp + - beyondtrust_epm.event.dll.code_signature.trusted + - beyondtrust_epm.event.dll.code_signature.valid + - beyondtrust_epm.event.dll.hash.md5 + - beyondtrust_epm.event.dll.hash.sha1 + - beyondtrust_epm.event.dll.hash.sha256 + - beyondtrust_epm.event.dll.hash.sha384 + - beyondtrust_epm.event.dll.hash.sha512 + - beyondtrust_epm.event.dll.hash.ssdeep + - beyondtrust_epm.event.dll.hash.tlsh + - beyondtrust_epm.event.dll.name + - beyondtrust_epm.event.dll.path + - beyondtrust_epm.event.dll.pe.architecture + - beyondtrust_epm.event.dll.pe.company + - beyondtrust_epm.event.dll.pe.description + - beyondtrust_epm.event.dll.pe.file_version + - beyondtrust_epm.event.dll.pe.imphash + - beyondtrust_epm.event.dll.pe.original_file_name + - beyondtrust_epm.event.dll.pe.pehash + - beyondtrust_epm.event.dll.pe.product + - beyondtrust_epm.event.file.accessed + - beyondtrust_epm.event.file.attributes + - beyondtrust_epm.event.file.code_signature.digest_algorithm + - beyondtrust_epm.event.file.code_signature.exists + - beyondtrust_epm.event.file.code_signature.signing_id + - beyondtrust_epm.event.file.code_signature.status + - beyondtrust_epm.event.file.code_signature.subject_name + - beyondtrust_epm.event.file.code_signature.team_id + - beyondtrust_epm.event.file.code_signature.timestamp + - beyondtrust_epm.event.file.code_signature.trusted + - beyondtrust_epm.event.file.code_signature.valid + - beyondtrust_epm.event.file.created + - beyondtrust_epm.event.file.ctime + - beyondtrust_epm.event.file.device + - beyondtrust_epm.event.file.directory + - beyondtrust_epm.event.file.drive_letter + - beyondtrust_epm.event.file.elf.architecture + - beyondtrust_epm.event.file.elf.byte_order + - beyondtrust_epm.event.file.elf.cpu_type + - beyondtrust_epm.event.file.elf.creation_date + - beyondtrust_epm.event.file.elf.header.abi_version + - beyondtrust_epm.event.file.elf.header.class + - beyondtrust_epm.event.file.elf.header.data + - beyondtrust_epm.event.file.elf.header.entrypoint + - beyondtrust_epm.event.file.elf.header.object_version + - beyondtrust_epm.event.file.elf.header.os_abi + - beyondtrust_epm.event.file.elf.header.type + - beyondtrust_epm.event.file.elf.header.version + - beyondtrust_epm.event.file.elf.shared_libraries + - beyondtrust_epm.event.file.elf.telfhash + - beyondtrust_epm.event.file.extension + - beyondtrust_epm.event.file.fork_name + - beyondtrust_epm.event.file.gid + - beyondtrust_epm.event.file.group + - beyondtrust_epm.event.file.hash.md5 + - beyondtrust_epm.event.file.hash.sha1 + - beyondtrust_epm.event.file.hash.sha256 + - beyondtrust_epm.event.file.hash.sha384 + - beyondtrust_epm.event.file.hash.sha512 + - beyondtrust_epm.event.file.hash.ssdeep + - beyondtrust_epm.event.file.hash.tlsh + - beyondtrust_epm.event.file.inode + - beyondtrust_epm.event.file.mime_type + - beyondtrust_epm.event.file.mode + - beyondtrust_epm.event.file.mtime + - beyondtrust_epm.event.file.name + - beyondtrust_epm.event.file.path + - beyondtrust_epm.event.file.pe.architecture + - beyondtrust_epm.event.file.pe.company + - beyondtrust_epm.event.file.pe.description + - beyondtrust_epm.event.file.pe.file_version + - beyondtrust_epm.event.file.pe.imphash + - beyondtrust_epm.event.file.pe.original_file_name + - beyondtrust_epm.event.file.pe.pehash + - beyondtrust_epm.event.file.pe.product + - beyondtrust_epm.event.file.size + - beyondtrust_epm.event.file.target_path + - beyondtrust_epm.event.file.type + - beyondtrust_epm.event.file.uid + - beyondtrust_epm.event.file.x509.alternative_names + - beyondtrust_epm.event.file.x509.issuer.common_name + - beyondtrust_epm.event.file.x509.issuer.country + - beyondtrust_epm.event.file.x509.issuer.distinguished_name + - beyondtrust_epm.event.file.x509.issuer.locality + - beyondtrust_epm.event.file.x509.issuer.organization + - beyondtrust_epm.event.file.x509.issuer.organizational_unit + - beyondtrust_epm.event.file.x509.issuer.state_or_province + - beyondtrust_epm.event.file.x509.not_after + - beyondtrust_epm.event.file.x509.not_before + - beyondtrust_epm.event.file.x509.public_key_algorithm + - beyondtrust_epm.event.file.x509.public_key_curve + - beyondtrust_epm.event.file.x509.public_key_exponent + - beyondtrust_epm.event.file.x509.public_key_size + - beyondtrust_epm.event.file.x509.serial_number + - beyondtrust_epm.event.file.x509.signature_algorithm + - beyondtrust_epm.event.file.x509.subject.common_name + - beyondtrust_epm.event.file.x509.subject.country + - beyondtrust_epm.event.file.x509.subject.distinguished_name + - beyondtrust_epm.event.file.x509.subject.locality + - beyondtrust_epm.event.file.x509.subject.organization + - beyondtrust_epm.event.file.x509.subject.organizational_unit + - beyondtrust_epm.event.file.x509.subject.state_or_province + - beyondtrust_epm.event.file.x509.version_number + - beyondtrust_epm.event.package.architecture + - beyondtrust_epm.event.package.build_version + - beyondtrust_epm.event.package.checksum + - beyondtrust_epm.event.package.description + - beyondtrust_epm.event.package.install_scope + - beyondtrust_epm.event.package.installed + - beyondtrust_epm.event.package.license + - beyondtrust_epm.event.package.name + - beyondtrust_epm.event.package.path + - beyondtrust_epm.event.package.reference + - beyondtrust_epm.event.package.size + - beyondtrust_epm.event.package.type + - beyondtrust_epm.event.package.version + - beyondtrust_epm.event.registry.data.bytes + - beyondtrust_epm.event.registry.data.strings + - beyondtrust_epm.event.registry.data.type + - beyondtrust_epm.event.registry.hive + - beyondtrust_epm.event.registry.key + - beyondtrust_epm.event.registry.path + - beyondtrust_epm.event.registry.value + tag: remove_fields_mapped_with_ecs + ignore_missing: true diff --git a/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-host-infrastructure.yml b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-host-infrastructure.yml new file mode 100644 index 00000000000..21bc0f4d2db --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-host-infrastructure.yml @@ -0,0 +1,1261 @@ +--- +description: Pipeline for processing host and infrastructure fields (host, cloud, container, orchestrator, observer, faas). +processors: + - set: + field: cloud.account.id + tag: set_cloud_account_id_from_event_EPMWinMac_TenantId + copy_from: beyondtrust_epm.event.EPMWinMac.TenantId + ignore_empty_value: true + - append: + field: cloud.account.id + tag: append_beyondtrust_epm_event_cloud_account_id_into_cloud_account_id + if: ctx.beyondtrust_epm?.event?.cloud?.account?.id != null + value: '{{{beyondtrust_epm.event.cloud.account.id}}}' + allow_duplicates: false + - set: + field: cloud.account.name + tag: set_cloud_account_name_from_event_cloud_account_name + copy_from: beyondtrust_epm.event.cloud.account.name + ignore_empty_value: true + - set: + field: cloud.availability_zone + tag: set_cloud_availability_zone_from_event_cloud_availability_zone + copy_from: beyondtrust_epm.event.cloud.availability_zone + ignore_empty_value: true + - set: + field: cloud.instance.id + tag: set_cloud_instance_id_from_event_cloud_instance_id + copy_from: beyondtrust_epm.event.cloud.instance.id + ignore_empty_value: true + - set: + field: cloud.instance.name + tag: set_cloud_instance_name_from_event_cloud_instance_name + copy_from: beyondtrust_epm.event.cloud.instance.name + ignore_empty_value: true + - set: + field: cloud.machine.type + tag: set_cloud_machine_type_from_event_cloud_machine_type + copy_from: beyondtrust_epm.event.cloud.machine.type + ignore_empty_value: true + - set: + field: cloud.origin.account.id + tag: set_cloud_origin_account_id_from_event_cloud_origin_account_id + copy_from: beyondtrust_epm.event.cloud.origin.account.id + ignore_empty_value: true + - set: + field: cloud.origin.account.name + tag: set_cloud_origin_account_name_from_event_cloud_origin_account_name + copy_from: beyondtrust_epm.event.cloud.origin.account.name + ignore_empty_value: true + - set: + field: cloud.origin.availability_zone + tag: set_cloud_origin_availability_zone_from_event_cloud_origin_availability_zone + copy_from: beyondtrust_epm.event.cloud.origin.availability_zone + ignore_empty_value: true + - set: + field: cloud.origin.instance.id + tag: set_cloud_origin_instance_id_from_event_cloud_origin_instance_id + copy_from: beyondtrust_epm.event.cloud.origin.instance.id + ignore_empty_value: true + - set: + field: cloud.origin.instance.name + tag: set_cloud_origin_instance_name_from_event_cloud_origin_instance_name + copy_from: beyondtrust_epm.event.cloud.origin.instance.name + ignore_empty_value: true + - set: + field: cloud.origin.machine.type + tag: set_cloud_origin_machine_type_from_event_cloud_origin_machine_type + copy_from: beyondtrust_epm.event.cloud.origin.machine.type + ignore_empty_value: true + - set: + field: cloud.origin.project.id + tag: set_cloud_origin_project_id_from_event_cloud_origin_project_id + copy_from: beyondtrust_epm.event.cloud.origin.project.id + ignore_empty_value: true + - set: + field: cloud.origin.project.name + tag: set_cloud_origin_project_name_from_event_cloud_origin_project_name + copy_from: beyondtrust_epm.event.cloud.origin.project.name + ignore_empty_value: true + - set: + field: cloud.origin.provider + tag: set_cloud_origin_provider_from_event_cloud_origin_provider + copy_from: beyondtrust_epm.event.cloud.origin.provider + ignore_empty_value: true + - set: + field: cloud.origin.region + tag: set_cloud_origin_region_from_event_cloud_origin_region + copy_from: beyondtrust_epm.event.cloud.origin.region + ignore_empty_value: true + - set: + field: cloud.origin.service.name + tag: set_cloud_origin_service_name_from_event_cloud_origin_service_name + copy_from: beyondtrust_epm.event.cloud.origin.service.name + ignore_empty_value: true + - set: + field: cloud.project.id + tag: set_cloud_project_id_from_event_cloud_project_id + copy_from: beyondtrust_epm.event.cloud.project.id + ignore_empty_value: true + - set: + field: cloud.project.name + tag: set_cloud_project_name_from_event_cloud_project_name + copy_from: beyondtrust_epm.event.cloud.project.name + ignore_empty_value: true + - set: + field: cloud.provider + tag: set_cloud_provider_from_event_cloud_provider + copy_from: beyondtrust_epm.event.cloud.provider + ignore_empty_value: true + - set: + field: cloud.region + tag: set_cloud_region_from_event_cloud_region + copy_from: beyondtrust_epm.event.cloud.region + ignore_empty_value: true + - set: + field: cloud.service.name + tag: set_cloud_service_name_from_event_cloud_service_name + copy_from: beyondtrust_epm.event.cloud.service.name + ignore_empty_value: true + - set: + field: cloud.target.account.id + tag: set_cloud_target_account_id_from_event_cloud_target_account_id + copy_from: beyondtrust_epm.event.cloud.target.account.id + ignore_empty_value: true + - set: + field: cloud.target.account.name + tag: set_cloud_target_account_name_from_event_cloud_target_account_name + copy_from: beyondtrust_epm.event.cloud.target.account.name + ignore_empty_value: true + - set: + field: cloud.target.availability_zone + tag: set_cloud_target_availability_zone_from_event_cloud_target_availability_zone + copy_from: beyondtrust_epm.event.cloud.target.availability_zone + ignore_empty_value: true + - set: + field: cloud.target.instance.id + tag: set_cloud_target_instance_id_from_event_cloud_target_instance_id + copy_from: beyondtrust_epm.event.cloud.target.instance.id + ignore_empty_value: true + - set: + field: cloud.target.instance.name + tag: set_cloud_target_instance_name_from_event_cloud_target_instance_name + copy_from: beyondtrust_epm.event.cloud.target.instance.name + ignore_empty_value: true + - set: + field: cloud.target.machine.type + tag: set_cloud_target_machine_type_from_event_cloud_target_machine_type + copy_from: beyondtrust_epm.event.cloud.target.machine.type + ignore_empty_value: true + - set: + field: cloud.target.project.id + tag: set_cloud_target_project_id_from_event_cloud_target_project_id + copy_from: beyondtrust_epm.event.cloud.target.project.id + ignore_empty_value: true + - set: + field: cloud.target.project.name + tag: set_cloud_target_project_name_from_event_cloud_target_project_name + copy_from: beyondtrust_epm.event.cloud.target.project.name + ignore_empty_value: true + - set: + field: cloud.target.provider + tag: set_cloud_target_provider_from_event_cloud_target_provider + copy_from: beyondtrust_epm.event.cloud.target.provider + ignore_empty_value: true + - set: + field: cloud.target.region + tag: set_cloud_target_region_from_event_cloud_target_region + copy_from: beyondtrust_epm.event.cloud.target.region + ignore_empty_value: true + - set: + field: cloud.target.service.name + tag: set_cloud_target_service_name_from_event_cloud_target_service_name + copy_from: beyondtrust_epm.event.cloud.target.service.name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.container.cpu.usage + tag: convert_container_cpu_usage_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.container.cpu.usage + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: container.cpu.usage + tag: set_container_cpu_usage_from_event_container_cpu_usage + copy_from: beyondtrust_epm.event.container.cpu.usage + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.container.disk.read.bytes + tag: convert_container_disk_read_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.container.disk.read.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: container.disk.read.bytes + tag: set_container_disk_read_bytes_from_event_container_disk_read_bytes + copy_from: beyondtrust_epm.event.container.disk.read.bytes + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.container.disk.write.bytes + tag: convert_container_disk_write_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.container.disk.write.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: container.disk.write.bytes + tag: set_container_disk_write_bytes_from_event_container_disk_write_bytes + copy_from: beyondtrust_epm.event.container.disk.write.bytes + ignore_empty_value: true + - set: + field: container.id + tag: set_container_id_from_event_container_id + copy_from: beyondtrust_epm.event.container.id + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.container.image.hash.all + tag: foreach_container_image_hash_all + if: ctx.beyondtrust_epm?.event?.container?.image?.hash?.all instanceof List + processor: + append: + field: container.image.hash.all + tag: append_container_image_hash_all_into_container_image_hash_all + value: '{{{_ingest._value}}}' + allow_duplicates: false + # container.image.hash.all values are digest-type-decorated (e.g. + # "sha256:"). Strip the decoration before adding to related.hash so the + # bare digest is searchable for hash identity lookups. + - script: + lang: painless + tag: script_container_image_hash_all_into_related_hash + description: Add bare container image digests to related.hash. + if: ctx.beyondtrust_epm?.event?.container?.image?.hash?.all instanceof List + source: |- + if (ctx.related == null) { + ctx.related = new HashMap(); + } + if (ctx.related.hash == null) { + ctx.related.hash = new ArrayList(); + } + for (def entry : ctx.beyondtrust_epm.event.container.image.hash.all) { + if (entry == null) { + continue; + } + def digest = entry.toString().replace('[', '').replace(']', ''); + int sep = digest.indexOf(':'); + if (sep >= 0) { + digest = digest.substring(sep + 1); + } + if (digest.length() > 0 && !ctx.related.hash.contains(digest)) { + ctx.related.hash.add(digest); + } + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: container.image.name + tag: set_container_image_name_from_event_container_image_name + copy_from: beyondtrust_epm.event.container.image.name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.container.image.tag + tag: foreach_container_image_tag + if: ctx.beyondtrust_epm?.event?.container?.image?.tag instanceof List + processor: + append: + field: container.image.tag + tag: append_container_image_tag_into_container_image_tag + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.container.memory.usage + tag: convert_container_memory_usage_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.container.memory.usage + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: container.memory.usage + tag: set_container_memory_usage_from_event_container_memory_usage + copy_from: beyondtrust_epm.event.container.memory.usage + ignore_empty_value: true + - set: + field: container.name + tag: set_container_name_from_event_container_name + copy_from: beyondtrust_epm.event.container.name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.container.network.egress.bytes + tag: convert_container_network_egress_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.container.network.egress.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: container.network.egress.bytes + tag: set_container_network_egress_bytes_from_event_container_network_egress_bytes + copy_from: beyondtrust_epm.event.container.network.egress.bytes + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.container.network.ingress.bytes + tag: convert_container_network_ingress_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.container.network.ingress.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: container.network.ingress.bytes + tag: set_container_network_ingress_bytes_from_event_container_network_ingress_bytes + copy_from: beyondtrust_epm.event.container.network.ingress.bytes + ignore_empty_value: true + - set: + field: container.runtime + tag: set_container_runtime_from_event_container_runtime + copy_from: beyondtrust_epm.event.container.runtime + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.faas.coldstart + tag: convert_faas_coldstart_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.faas.coldstart + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: faas.coldstart + tag: set_faas_coldstart_from_event_faas_coldstart + copy_from: beyondtrust_epm.event.faas.coldstart + ignore_empty_value: true + - set: + field: faas.execution + tag: set_faas_execution_from_event_faas_execution + copy_from: beyondtrust_epm.event.faas.execution + ignore_empty_value: true + - set: + field: faas.id + tag: set_faas_id_from_event_faas_id + copy_from: beyondtrust_epm.event.faas.id + ignore_empty_value: true + - set: + field: faas.name + tag: set_faas_name_from_event_faas_name + copy_from: beyondtrust_epm.event.faas.name + ignore_empty_value: true + - set: + field: faas.trigger.request_id + tag: set_faas_trigger_request_id_from_event_faas_trigger_request_id + copy_from: beyondtrust_epm.event.faas.trigger.request_id + ignore_empty_value: true + - set: + field: faas.trigger.type + tag: set_faas_trigger_type_from_event_faas_trigger_type + copy_from: beyondtrust_epm.event.faas.trigger.type + ignore_empty_value: true + - set: + field: faas.version + tag: set_faas_version_from_event_faas_version + copy_from: beyondtrust_epm.event.faas.version + ignore_empty_value: true + - set: + field: host.architecture + tag: set_host_architecture_from_event_host_architecture + copy_from: beyondtrust_epm.event.host.architecture + ignore_empty_value: true + - set: + field: host.boot.id + tag: set_host_boot_id_from_event_host_boot_id + copy_from: beyondtrust_epm.event.host.boot.id + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.cpu.usage + tag: convert_host_cpu_usage_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.cpu.usage + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.cpu.usage + tag: set_host_cpu_usage_from_event_host_cpu_usage + copy_from: beyondtrust_epm.event.host.cpu.usage + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.disk.read.bytes + tag: convert_host_disk_read_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.disk.read.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.disk.read.bytes + tag: set_host_disk_read_bytes_from_event_host_disk_read_bytes + copy_from: beyondtrust_epm.event.host.disk.read.bytes + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.disk.write.bytes + tag: convert_host_disk_write_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.disk.write.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.disk.write.bytes + tag: set_host_disk_write_bytes_from_event_host_disk_write_bytes + copy_from: beyondtrust_epm.event.host.disk.write.bytes + ignore_empty_value: true + - set: + field: host.domain + tag: set_host_domain_from_event_host_domain + copy_from: beyondtrust_epm.event.host.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.geo.TimezoneOffset + tag: convert_host_geo_TimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.geo.TimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.geo.city_name + tag: set_host_geo_city_name_from_event_host_geo_city_name + copy_from: beyondtrust_epm.event.host.geo.city_name + ignore_empty_value: true + - set: + field: host.geo.continent_code + tag: set_host_geo_continent_code_from_event_host_geo_continent_code + copy_from: beyondtrust_epm.event.host.geo.continent_code + ignore_empty_value: true + - set: + field: host.geo.continent_name + tag: set_host_geo_continent_name_from_event_host_geo_continent_name + copy_from: beyondtrust_epm.event.host.geo.continent_name + ignore_empty_value: true + - set: + field: host.geo.country_iso_code + tag: set_host_geo_country_iso_code_from_event_host_geo_country_iso_code + copy_from: beyondtrust_epm.event.host.geo.country_iso_code + ignore_empty_value: true + - set: + field: host.geo.country_name + tag: set_host_geo_country_name_from_event_host_geo_country_name + copy_from: beyondtrust_epm.event.host.geo.country_name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.geo.location.lat + tag: convert_host_geo_location_lat_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.geo.location.lat + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.host.geo.location.lon + tag: convert_host_geo_location_lon_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.geo.location.lon + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: set_host_geo_location_from_lat_lon + lang: painless + description: Combine lat/lon into geo_point. + if: >- + ctx.beyondtrust_epm?.event?.host?.geo?.location?.lat != null + && ctx.beyondtrust_epm?.event?.host?.geo?.location?.lon != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.beyondtrust_epm.event.host.geo.location.lat); + location.put('lon', ctx.beyondtrust_epm.event.host.geo.location.lon); + ctx.beyondtrust_epm.event.host.geo.location = location; + - set: + field: host.geo.location + tag: set_host_geo_location_from_event + copy_from: beyondtrust_epm.event.host.geo.location + ignore_empty_value: true + - set: + field: host.geo.name + tag: set_host_geo_name_from_event_host_geo_name + copy_from: beyondtrust_epm.event.host.geo.name + ignore_empty_value: true + - set: + field: host.geo.postal_code + tag: set_host_geo_postal_code_from_event_host_geo_postal_code + copy_from: beyondtrust_epm.event.host.geo.postal_code + ignore_empty_value: true + - set: + field: host.geo.region_iso_code + tag: set_host_geo_region_iso_code_from_event_host_geo_region_iso_code + copy_from: beyondtrust_epm.event.host.geo.region_iso_code + ignore_empty_value: true + - set: + field: host.geo.region_name + tag: set_host_geo_region_name_from_event_host_geo_region_name + copy_from: beyondtrust_epm.event.host.geo.region_name + ignore_empty_value: true + - set: + field: host.geo.timezone + tag: set_host_geo_timezone_from_event_host_geo_timezone + copy_from: beyondtrust_epm.event.host.geo.timezone + ignore_empty_value: true + - set: + field: host.hostname + tag: set_host_hostname_from_event_host_hostname + copy_from: beyondtrust_epm.event.host.hostname + ignore_empty_value: true + - set: + field: host.id + tag: set_host_id_from_event_host_id + copy_from: beyondtrust_epm.event.host.id + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.host.ip + tag: foreach_convert_host_ip_to_ip + if: ctx.beyondtrust_epm?.event?.host?.ip instanceof List + processor: + convert: + field: _ingest._value + tag: convert_host_ip_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.host.ip + tag: foreach_host_ip + if: ctx.beyondtrust_epm?.event?.host?.ip instanceof List + processor: + append: + field: host.ip + tag: append_host_ip_into_host_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.host.ip + tag: foreach_host_ip + if: ctx.beyondtrust_epm?.event?.host?.ip instanceof List + processor: + append: + field: related.ip + tag: append_host_ip_into_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - gsub: + field: beyondtrust_epm.event.host.mac + pattern: '[:.]' + replacement: '-' + tag: gsub_host_mac + ignore_missing: true + - uppercase: + field: beyondtrust_epm.event.host.mac + tag: uppercase_host_mac + ignore_missing: true + - foreach: + field: beyondtrust_epm.event.host.mac + tag: foreach_host_mac + if: ctx.beyondtrust_epm?.event?.host?.mac instanceof List + processor: + append: + field: host.mac + tag: append_host_mac_into_host_mac + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: host.name + tag: set_host_name_from_event_host_name + copy_from: beyondtrust_epm.event.host.name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.network.egress.bytes + tag: convert_host_network_egress_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.network.egress.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.network.egress.bytes + tag: set_host_network_egress_bytes_from_event_host_network_egress_bytes + copy_from: beyondtrust_epm.event.host.network.egress.bytes + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.network.egress.packets + tag: convert_host_network_egress_packets_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.network.egress.packets + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.network.egress.packets + tag: set_host_network_egress_packets_from_event_host_network_egress_packets + copy_from: beyondtrust_epm.event.host.network.egress.packets + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.network.ingress.bytes + tag: convert_host_network_ingress_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.network.ingress.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.network.ingress.bytes + tag: set_host_network_ingress_bytes_from_event_host_network_ingress_bytes + copy_from: beyondtrust_epm.event.host.network.ingress.bytes + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.network.ingress.packets + tag: convert_host_network_ingress_packets_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.network.ingress.packets + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.network.ingress.packets + tag: set_host_network_ingress_packets_from_event_host_network_ingress_packets + copy_from: beyondtrust_epm.event.host.network.ingress.packets + ignore_empty_value: true + - set: + field: host.os.family + tag: set_host_os_family_from_event_host_os_family + copy_from: beyondtrust_epm.event.host.os.family + ignore_empty_value: true + - set: + field: host.os.full + tag: set_host_os_full_from_event_host_os_full + copy_from: beyondtrust_epm.event.host.os.full + ignore_empty_value: true + - set: + field: host.os.kernel + tag: set_host_os_kernel_from_event_host_os_kernel + copy_from: beyondtrust_epm.event.host.os.kernel + ignore_empty_value: true + - set: + field: host.os.name + tag: set_host_os_name_from_event_host_os_name + copy_from: beyondtrust_epm.event.host.os.name + ignore_empty_value: true + - set: + field: host.os.platform + tag: set_host_os_platform_from_event_host_os_platform + copy_from: beyondtrust_epm.event.host.os.platform + ignore_empty_value: true + - set: + field: host.os.type + tag: set_host_os_type_from_event_host_os_type + copy_from: beyondtrust_epm.event.host.os.type + ignore_empty_value: true + - set: + field: host.os.version + tag: set_host_os_version_from_event_host_os_version + copy_from: beyondtrust_epm.event.host.os.version + ignore_empty_value: true + - set: + field: host.pid_ns_ino + tag: set_host_pid_ns_ino_from_event_host_pid_ns_ino + copy_from: beyondtrust_epm.event.host.pid_ns_ino + ignore_empty_value: true + - set: + field: host.type + tag: set_host_type_from_event_host_type + copy_from: beyondtrust_epm.event.host.type + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.host.uptime + tag: convert_host_uptime_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.host.uptime + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.uptime + tag: set_host_uptime_from_event_host_uptime + copy_from: beyondtrust_epm.event.host.uptime + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.observer.geo.TimezoneOffset + tag: convert_observer_geo_TimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.observer.geo.TimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: observer.geo.city_name + tag: set_observer_geo_city_name_from_event_observer_geo_city_name + copy_from: beyondtrust_epm.event.observer.geo.city_name + ignore_empty_value: true + - set: + field: observer.geo.continent_code + tag: set_observer_geo_continent_code_from_event_observer_geo_continent_code + copy_from: beyondtrust_epm.event.observer.geo.continent_code + ignore_empty_value: true + - set: + field: observer.geo.continent_name + tag: set_observer_geo_continent_name_from_event_observer_geo_continent_name + copy_from: beyondtrust_epm.event.observer.geo.continent_name + ignore_empty_value: true + - set: + field: observer.geo.country_iso_code + tag: set_observer_geo_country_iso_code_from_event_observer_geo_country_iso_code + copy_from: beyondtrust_epm.event.observer.geo.country_iso_code + ignore_empty_value: true + - set: + field: observer.geo.country_name + tag: set_observer_geo_country_name_from_event_observer_geo_country_name + copy_from: beyondtrust_epm.event.observer.geo.country_name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.observer.geo.location.lat + tag: convert_observer_geo_location_lat_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.observer.geo.location.lat + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.observer.geo.location.lon + tag: convert_observer_geo_location_lon_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.observer.geo.location.lon + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: set_observer_geo_location_from_lat_lon + lang: painless + description: Combine lat/lon into geo_point. + if: >- + ctx.beyondtrust_epm?.event?.observer?.geo?.location?.lat != null + && ctx.beyondtrust_epm?.event?.observer?.geo?.location?.lon != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.beyondtrust_epm.event.observer.geo.location.lat); + location.put('lon', ctx.beyondtrust_epm.event.observer.geo.location.lon); + ctx.beyondtrust_epm.event.observer.geo.location = location; + - set: + field: observer.geo.location + tag: set_observer_geo_location_from_event + copy_from: beyondtrust_epm.event.observer.geo.location + ignore_empty_value: true + - set: + field: observer.geo.name + tag: set_observer_geo_name_from_event_observer_geo_name + copy_from: beyondtrust_epm.event.observer.geo.name + ignore_empty_value: true + - set: + field: observer.geo.postal_code + tag: set_observer_geo_postal_code_from_event_observer_geo_postal_code + copy_from: beyondtrust_epm.event.observer.geo.postal_code + ignore_empty_value: true + - set: + field: observer.geo.region_iso_code + tag: set_observer_geo_region_iso_code_from_event_observer_geo_region_iso_code + copy_from: beyondtrust_epm.event.observer.geo.region_iso_code + ignore_empty_value: true + - set: + field: observer.geo.region_name + tag: set_observer_geo_region_name_from_event_observer_geo_region_name + copy_from: beyondtrust_epm.event.observer.geo.region_name + ignore_empty_value: true + - set: + field: observer.geo.timezone + tag: set_observer_geo_timezone_from_event_observer_geo_timezone + copy_from: beyondtrust_epm.event.observer.geo.timezone + ignore_empty_value: true + - set: + field: observer.hostname + tag: set_observer_hostname_from_event_observer_hostname + copy_from: beyondtrust_epm.event.observer.hostname + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.observer.ip + tag: foreach_convert_observer_ip_to_ip + if: ctx.beyondtrust_epm?.event?.observer?.ip instanceof List + processor: + convert: + field: _ingest._value + tag: convert_observer_ip_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.observer.ip + tag: foreach_observer_ip + if: ctx.beyondtrust_epm?.event?.observer?.ip instanceof List + processor: + append: + field: observer.ip + tag: append_observer_ip_into_observer_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.observer.ip + tag: foreach_observer_ip + if: ctx.beyondtrust_epm?.event?.observer?.ip instanceof List + processor: + append: + field: related.ip + tag: append_observer_ip_into_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - gsub: + field: beyondtrust_epm.event.observer.mac + pattern: '[:.]' + replacement: '-' + tag: gsub_observer_mac + ignore_missing: true + - uppercase: + field: beyondtrust_epm.event.host.mac + tag: uppercase_observer_mac + ignore_missing: true + - foreach: + field: beyondtrust_epm.event.observer.mac + tag: foreach_observer_mac + if: ctx.beyondtrust_epm?.event?.observer?.mac instanceof List + processor: + append: + field: observer.mac + tag: append_observer_mac_into_observer_mac + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: observer.name + tag: set_observer_name_from_event_observer_name + copy_from: beyondtrust_epm.event.observer.name + ignore_empty_value: true + - set: + field: observer.os.family + tag: set_observer_os_family_from_event_observer_os_family + copy_from: beyondtrust_epm.event.observer.os.family + ignore_empty_value: true + - set: + field: observer.os.full + tag: set_observer_os_full_from_event_observer_os_full + copy_from: beyondtrust_epm.event.observer.os.full + ignore_empty_value: true + - set: + field: observer.os.kernel + tag: set_observer_os_kernel_from_event_observer_os_kernel + copy_from: beyondtrust_epm.event.observer.os.kernel + ignore_empty_value: true + - set: + field: observer.os.name + tag: set_observer_os_name_from_event_observer_os_name + copy_from: beyondtrust_epm.event.observer.os.name + ignore_empty_value: true + - set: + field: observer.os.platform + tag: set_observer_os_platform_from_event_observer_os_platform + copy_from: beyondtrust_epm.event.observer.os.platform + ignore_empty_value: true + - set: + field: observer.os.type + tag: set_observer_os_type_from_event_observer_os_type + copy_from: beyondtrust_epm.event.observer.os.type + ignore_empty_value: true + - set: + field: observer.os.version + tag: set_observer_os_version_from_event_observer_os_version + copy_from: beyondtrust_epm.event.observer.os.version + ignore_empty_value: true + - append: + field: observer.product + tag: append_beyondtrust_epm_event_observer_product_into_observer_product + if: ctx.beyondtrust_epm?.event?.observer?.product != null + value: '{{{beyondtrust_epm.event.observer.product}}}' + allow_duplicates: false + - set: + field: observer.serial_number + tag: set_observer_serial_number_from_event_observer_serial_number + copy_from: beyondtrust_epm.event.observer.serial_number + ignore_empty_value: true + - set: + field: observer.type + tag: set_observer_type_from_event_observer_type + copy_from: beyondtrust_epm.event.observer.type + ignore_empty_value: true + - append: + field: observer.vendor + tag: append_beyondtrust_epm_event_observer_vendor_into_observer_vendor + if: ctx.beyondtrust_epm?.event?.observer?.vendor != null + value: '{{{beyondtrust_epm.event.observer.vendor}}}' + allow_duplicates: false + - set: + field: observer.version + tag: set_observer_version_from_event_observer_version + copy_from: beyondtrust_epm.event.observer.version + ignore_empty_value: true + - set: + field: orchestrator.api_version + tag: set_orchestrator_api_version_from_event_orchestrator_api_version + copy_from: beyondtrust_epm.event.orchestrator.api_version + ignore_empty_value: true + - set: + field: orchestrator.cluster.id + tag: set_orchestrator_cluster_id_from_event_orchestrator_cluster_id + copy_from: beyondtrust_epm.event.orchestrator.cluster.id + ignore_empty_value: true + - set: + field: orchestrator.cluster.name + tag: set_orchestrator_cluster_name_from_event_orchestrator_cluster_name + copy_from: beyondtrust_epm.event.orchestrator.cluster.name + ignore_empty_value: true + - set: + field: orchestrator.cluster.url + tag: set_orchestrator_cluster_url_from_event_orchestrator_cluster_url + copy_from: beyondtrust_epm.event.orchestrator.cluster.url + ignore_empty_value: true + - set: + field: orchestrator.cluster.version + tag: set_orchestrator_cluster_version_from_event_orchestrator_cluster_version + copy_from: beyondtrust_epm.event.orchestrator.cluster.version + ignore_empty_value: true + - set: + field: orchestrator.namespace + tag: set_orchestrator_namespace_from_event_orchestrator_namespace + copy_from: beyondtrust_epm.event.orchestrator.namespace + ignore_empty_value: true + - set: + field: orchestrator.organization + tag: set_orchestrator_organization_from_event_orchestrator_organization + copy_from: beyondtrust_epm.event.orchestrator.organization + ignore_empty_value: true + - set: + field: orchestrator.resource.id + tag: set_orchestrator_resource_id_from_event_orchestrator_resource_id + copy_from: beyondtrust_epm.event.orchestrator.resource.id + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.orchestrator.resource.ip + tag: foreach_convert_orchestrator_resource_ip_to_ip + if: ctx.beyondtrust_epm?.event?.orchestrator?.resource?.ip instanceof List + processor: + convert: + field: _ingest._value + tag: convert_orchestrator_resource_ip_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.orchestrator.resource.ip + tag: foreach_orchestrator_resource_ip + if: ctx.beyondtrust_epm?.event?.orchestrator?.resource?.ip instanceof List + processor: + append: + field: orchestrator.resource.ip + tag: append_orchestrator_resource_ip_into_orchestrator_resource_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.orchestrator.resource.ip + tag: foreach_orchestrator_resource_ip + if: ctx.beyondtrust_epm?.event?.orchestrator?.resource?.ip instanceof List + processor: + append: + field: related.ip + tag: append_orchestrator_resource_ip_into_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: orchestrator.resource.name + tag: set_orchestrator_resource_name_from_event_orchestrator_resource_name + copy_from: beyondtrust_epm.event.orchestrator.resource.name + ignore_empty_value: true + - set: + field: orchestrator.resource.parent.type + tag: set_orchestrator_resource_parent_type_from_event_orchestrator_resource_parent_type + copy_from: beyondtrust_epm.event.orchestrator.resource.parent.type + ignore_empty_value: true + - set: + field: orchestrator.resource.type + tag: set_orchestrator_resource_type_from_event_orchestrator_resource_type + copy_from: beyondtrust_epm.event.orchestrator.resource.type + ignore_empty_value: true + - set: + field: orchestrator.type + tag: set_orchestrator_type_from_event_orchestrator_type + copy_from: beyondtrust_epm.event.orchestrator.type + ignore_empty_value: true + - set: + field: host.name + tag: set_host_name_from_client_Name + copy_from: beyondtrust_epm.event.client.Name + ignore_empty_value: true + override: false + - set: + field: host.type + tag: set_host_type_from_host_ChassisType + copy_from: beyondtrust_epm.event.host.ChassisType + ignore_empty_value: true + override: false + - set: + field: host.domain + tag: set_host_domain_from_host_DomainNetBIOSName + copy_from: beyondtrust_epm.event.host.DomainNetBIOSName + ignore_empty_value: true + override: false + - set: + field: host.os.type + tag: set_host_os_type_from_host_os_ProductType + copy_from: beyondtrust_epm.event.host.os.ProductType + ignore_empty_value: true + override: false + - append: + field: event.category + tag: append_event_category_host + if: >- + ctx.host != null + && (ctx.event?.category == null || !ctx.event.category.contains('host')) + value: host + allow_duplicates: false + - remove: + field: + - beyondtrust_epm.event.EPMWinMac.TenantId + - beyondtrust_epm.event.cloud.account.id + - beyondtrust_epm.event.cloud.account.name + - beyondtrust_epm.event.cloud.availability_zone + - beyondtrust_epm.event.cloud.instance.id + - beyondtrust_epm.event.cloud.instance.name + - beyondtrust_epm.event.cloud.machine.type + - beyondtrust_epm.event.cloud.origin.account.id + - beyondtrust_epm.event.cloud.origin.account.name + - beyondtrust_epm.event.cloud.origin.availability_zone + - beyondtrust_epm.event.cloud.origin.instance.id + - beyondtrust_epm.event.cloud.origin.instance.name + - beyondtrust_epm.event.cloud.origin.machine.type + - beyondtrust_epm.event.cloud.origin.project.id + - beyondtrust_epm.event.cloud.origin.project.name + - beyondtrust_epm.event.cloud.origin.provider + - beyondtrust_epm.event.cloud.origin.region + - beyondtrust_epm.event.cloud.origin.service.name + - beyondtrust_epm.event.cloud.project.id + - beyondtrust_epm.event.cloud.project.name + - beyondtrust_epm.event.cloud.provider + - beyondtrust_epm.event.cloud.region + - beyondtrust_epm.event.cloud.service.name + - beyondtrust_epm.event.cloud.target.account.id + - beyondtrust_epm.event.cloud.target.account.name + - beyondtrust_epm.event.cloud.target.availability_zone + - beyondtrust_epm.event.cloud.target.instance.id + - beyondtrust_epm.event.cloud.target.instance.name + - beyondtrust_epm.event.cloud.target.machine.type + - beyondtrust_epm.event.cloud.target.project.id + - beyondtrust_epm.event.cloud.target.project.name + - beyondtrust_epm.event.cloud.target.provider + - beyondtrust_epm.event.cloud.target.region + - beyondtrust_epm.event.cloud.target.service.name + - beyondtrust_epm.event.container.cpu.usage + - beyondtrust_epm.event.container.disk.read.bytes + - beyondtrust_epm.event.container.disk.write.bytes + - beyondtrust_epm.event.container.id + - beyondtrust_epm.event.container.image.hash.all + - beyondtrust_epm.event.container.image.name + - beyondtrust_epm.event.container.image.tag + - beyondtrust_epm.event.container.memory.usage + - beyondtrust_epm.event.container.name + - beyondtrust_epm.event.container.network.egress.bytes + - beyondtrust_epm.event.container.network.ingress.bytes + - beyondtrust_epm.event.container.runtime + - beyondtrust_epm.event.faas.coldstart + - beyondtrust_epm.event.faas.execution + - beyondtrust_epm.event.faas.id + - beyondtrust_epm.event.faas.name + - beyondtrust_epm.event.faas.trigger.request_id + - beyondtrust_epm.event.faas.trigger.type + - beyondtrust_epm.event.faas.version + - beyondtrust_epm.event.host.architecture + - beyondtrust_epm.event.host.boot.id + - beyondtrust_epm.event.host.cpu.usage + - beyondtrust_epm.event.host.disk.read.bytes + - beyondtrust_epm.event.host.disk.write.bytes + - beyondtrust_epm.event.host.domain + - beyondtrust_epm.event.host.geo.city_name + - beyondtrust_epm.event.host.geo.continent_code + - beyondtrust_epm.event.host.geo.continent_name + - beyondtrust_epm.event.host.geo.country_iso_code + - beyondtrust_epm.event.host.geo.country_name + - beyondtrust_epm.event.host.geo.name + - beyondtrust_epm.event.host.geo.postal_code + - beyondtrust_epm.event.host.geo.region_iso_code + - beyondtrust_epm.event.host.geo.region_name + - beyondtrust_epm.event.host.geo.timezone + - beyondtrust_epm.event.host.hostname + - beyondtrust_epm.event.host.id + - beyondtrust_epm.event.host.ip + - beyondtrust_epm.event.host.mac + - beyondtrust_epm.event.host.name + - beyondtrust_epm.event.host.network.egress.bytes + - beyondtrust_epm.event.host.network.egress.packets + - beyondtrust_epm.event.host.network.ingress.bytes + - beyondtrust_epm.event.host.network.ingress.packets + - beyondtrust_epm.event.host.os.family + - beyondtrust_epm.event.host.os.full + - beyondtrust_epm.event.host.os.kernel + - beyondtrust_epm.event.host.os.name + - beyondtrust_epm.event.host.os.platform + - beyondtrust_epm.event.host.os.type + - beyondtrust_epm.event.host.os.version + - beyondtrust_epm.event.host.pid_ns_ino + - beyondtrust_epm.event.host.type + - beyondtrust_epm.event.host.uptime + - beyondtrust_epm.event.observer.geo.city_name + - beyondtrust_epm.event.observer.geo.continent_code + - beyondtrust_epm.event.observer.geo.continent_name + - beyondtrust_epm.event.observer.geo.country_iso_code + - beyondtrust_epm.event.observer.geo.country_name + - beyondtrust_epm.event.observer.geo.name + - beyondtrust_epm.event.observer.geo.postal_code + - beyondtrust_epm.event.observer.geo.region_iso_code + - beyondtrust_epm.event.observer.geo.region_name + - beyondtrust_epm.event.observer.geo.timezone + - beyondtrust_epm.event.observer.hostname + - beyondtrust_epm.event.observer.ip + - beyondtrust_epm.event.observer.mac + - beyondtrust_epm.event.observer.name + - beyondtrust_epm.event.observer.os.family + - beyondtrust_epm.event.observer.os.full + - beyondtrust_epm.event.observer.os.kernel + - beyondtrust_epm.event.observer.os.name + - beyondtrust_epm.event.observer.os.platform + - beyondtrust_epm.event.observer.os.type + - beyondtrust_epm.event.observer.os.version + - beyondtrust_epm.event.observer.product + - beyondtrust_epm.event.observer.serial_number + - beyondtrust_epm.event.observer.type + - beyondtrust_epm.event.observer.vendor + - beyondtrust_epm.event.observer.version + - beyondtrust_epm.event.orchestrator.api_version + - beyondtrust_epm.event.orchestrator.cluster.id + - beyondtrust_epm.event.orchestrator.cluster.name + - beyondtrust_epm.event.orchestrator.cluster.url + - beyondtrust_epm.event.orchestrator.cluster.version + - beyondtrust_epm.event.orchestrator.namespace + - beyondtrust_epm.event.orchestrator.organization + - beyondtrust_epm.event.orchestrator.resource.id + - beyondtrust_epm.event.orchestrator.resource.ip + - beyondtrust_epm.event.orchestrator.resource.name + - beyondtrust_epm.event.orchestrator.resource.parent.type + - beyondtrust_epm.event.orchestrator.resource.type + - beyondtrust_epm.event.orchestrator.type + tag: remove_fields_mapped_with_ecs + ignore_missing: true diff --git a/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-identity-user.yml b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-identity-user.yml new file mode 100644 index 00000000000..96252850697 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-identity-user.yml @@ -0,0 +1,919 @@ +--- +description: Pipeline for processing identity and user fields (user, group, email, user_agent). +processors: + - set: + field: group.name + tag: set_group_name_from_event_EPMWinMac_PrivilegedGroup_Name + copy_from: beyondtrust_epm.event.EPMWinMac.PrivilegedGroup.Name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_extension + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.extension + tag: append_email_attachments_file_extension_into_email_attachments_file_extension + value: '{{{_ingest._value.file.extension}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_md5 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.hash.md5 + tag: append_email_attachments_file_hash_md5_into_email_attachments_file_hash_md5 + value: '{{{_ingest._value.file.hash.md5}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_md5 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: related.hash + tag: append_email_attachments_file_hash_md5_into_related_hash + value: '{{{_ingest._value.file.hash.md5}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_sha1 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.hash.sha1 + tag: append_email_attachments_file_hash_sha1_into_email_attachments_file_hash_sha1 + value: '{{{_ingest._value.file.hash.sha1}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_sha1 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: related.hash + tag: append_email_attachments_file_hash_sha1_into_related_hash + value: '{{{_ingest._value.file.hash.sha1}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_sha256 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.hash.sha256 + tag: append_email_attachments_file_hash_sha256_into_email_attachments_file_hash_sha256 + value: '{{{_ingest._value.file.hash.sha256}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_sha256 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: related.hash + tag: append_email_attachments_file_hash_sha256_into_related_hash + value: '{{{_ingest._value.file.hash.sha256}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_sha384 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.hash.sha384 + tag: append_email_attachments_file_hash_sha384_into_email_attachments_file_hash_sha384 + value: '{{{_ingest._value.file.hash.sha384}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_sha384 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: related.hash + tag: append_email_attachments_file_hash_sha384_into_related_hash + value: '{{{_ingest._value.file.hash.sha384}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_sha512 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.hash.sha512 + tag: append_email_attachments_file_hash_sha512_into_email_attachments_file_hash_sha512 + value: '{{{_ingest._value.file.hash.sha512}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_sha512 + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: related.hash + tag: append_email_attachments_file_hash_sha512_into_related_hash + value: '{{{_ingest._value.file.hash.sha512}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_ssdeep + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.hash.ssdeep + tag: append_email_attachments_file_hash_ssdeep_into_email_attachments_file_hash_ssdeep + value: '{{{_ingest._value.file.hash.ssdeep}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_ssdeep + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: related.hash + tag: append_email_attachments_file_hash_ssdeep_into_related_hash + value: '{{{_ingest._value.file.hash.ssdeep}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_tlsh + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.hash.tlsh + tag: append_email_attachments_file_hash_tlsh_into_email_attachments_file_hash_tlsh + value: '{{{_ingest._value.file.hash.tlsh}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_hash_tlsh + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: related.hash + tag: append_email_attachments_file_hash_tlsh_into_related_hash + value: '{{{_ingest._value.file.hash.tlsh}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_mime_type + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.mime_type + tag: append_email_attachments_file_mime_type_into_email_attachments_file_mime_type + value: '{{{_ingest._value.file.mime_type}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_name + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.name + tag: append_email_attachments_file_name_into_email_attachments_file_name + value: '{{{_ingest._value.file.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_size + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + convert: + field: _ingest._value.file.size + tag: convert_email_attachments_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.file.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments_file_size + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + append: + field: email.attachments.file.size + tag: append_email_attachments_file_size_into_email_attachments_file_size + value: '{{{_ingest._value.file.size}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.bcc.address + tag: foreach_email_bcc_address + if: ctx.beyondtrust_epm?.event?.email?.bcc?.address instanceof List + processor: + append: + field: email.bcc.address + tag: append_email_bcc_address_into_email_bcc_address + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.cc.address + tag: foreach_email_cc_address + if: ctx.beyondtrust_epm?.event?.email?.cc?.address instanceof List + processor: + append: + field: email.cc.address + tag: append_email_cc_address_into_email_cc_address + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: email.content_type + tag: set_email_content_type_from_event_email_content_type + copy_from: beyondtrust_epm.event.email.content_type + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.email.delivery_timestamp + tag: date_email_delivery_timestamp + if: ctx.beyondtrust_epm?.event?.email?.delivery_timestamp != null && ctx.beyondtrust_epm.event.email.delivery_timestamp != '' + target_field: beyondtrust_epm.event.email.delivery_timestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.email.delivery_timestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: email.delivery_timestamp + tag: set_email_delivery_timestamp_from_event_email_delivery_timestamp + copy_from: beyondtrust_epm.event.email.delivery_timestamp + ignore_empty_value: true + - set: + field: email.direction + tag: set_email_direction_from_event_email_direction + copy_from: beyondtrust_epm.event.email.direction + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.email.from.address + tag: foreach_email_from_address + if: ctx.beyondtrust_epm?.event?.email?.from?.address instanceof List + processor: + append: + field: email.from.address + tag: append_email_from_address_into_email_from_address + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: email.local_id + tag: set_email_local_id_from_event_email_local_id + copy_from: beyondtrust_epm.event.email.local_id + ignore_empty_value: true + - set: + field: email.message_id + tag: set_email_message_id_from_event_email_message_id + copy_from: beyondtrust_epm.event.email.message_id + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.email.origination_timestamp + tag: date_email_origination_timestamp + if: ctx.beyondtrust_epm?.event?.email?.origination_timestamp != null && ctx.beyondtrust_epm.event.email.origination_timestamp != '' + target_field: beyondtrust_epm.event.email.origination_timestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.email.origination_timestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: email.origination_timestamp + tag: set_email_origination_timestamp_from_event_email_origination_timestamp + copy_from: beyondtrust_epm.event.email.origination_timestamp + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.email.reply_to.address + tag: foreach_email_reply_to_address + if: ctx.beyondtrust_epm?.event?.email?.reply_to?.address instanceof List + processor: + append: + field: email.reply_to.address + tag: append_email_reply_to_address_into_email_reply_to_address + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: email.sender.address + tag: set_email_sender_address_from_event_email_sender_address + copy_from: beyondtrust_epm.event.email.sender.address + ignore_empty_value: true + - set: + field: email.subject + tag: set_email_subject_from_event_email_subject + copy_from: beyondtrust_epm.event.email.subject + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.email.to.address + tag: foreach_email_to_address + if: ctx.beyondtrust_epm?.event?.email?.to?.address instanceof List + processor: + append: + field: email.to.address + tag: append_email_to_address_into_email_to_address + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: email.x_mailer + tag: set_email_x_mailer_from_event_email_x_mailer + copy_from: beyondtrust_epm.event.email.x_mailer + ignore_empty_value: true + - set: + field: group.domain + tag: set_group_domain_from_event_group_domain + copy_from: beyondtrust_epm.event.group.domain + ignore_empty_value: true + - set: + field: group.id + tag: set_group_id_from_event_group_id + copy_from: beyondtrust_epm.event.group.id + ignore_empty_value: true + - append: + field: group.name + tag: append_beyondtrust_epm_event_group_name_into_group_name + if: ctx.beyondtrust_epm?.event?.group?.name != null + value: '{{{beyondtrust_epm.event.group.name}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.user.DefaultTimezoneOffset + tag: convert_user_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.user.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.user.LocalIdentifier + tag: convert_user_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.user.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.user.changes.DefaultTimezoneOffset + tag: convert_user_changes_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.user.changes.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.user.changes.LocalIdentifier + tag: convert_user_changes_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.user.changes.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: user.changes.domain + tag: set_user_changes_domain_from_event_user_changes_domain + copy_from: beyondtrust_epm.event.user.changes.domain + ignore_empty_value: true + - set: + field: user.changes.email + tag: set_user_changes_email_from_event_user_changes_email + copy_from: beyondtrust_epm.event.user.changes.email + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_changes_email_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.changes?.email != null + value: '{{{beyondtrust_epm.event.user.changes.email}}}' + allow_duplicates: false + - set: + field: user.changes.full_name + tag: set_user_changes_full_name_from_event_user_changes_full_name + copy_from: beyondtrust_epm.event.user.changes.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_changes_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.changes?.full_name != null + value: '{{{beyondtrust_epm.event.user.changes.full_name}}}' + allow_duplicates: false + - set: + field: user.changes.group.domain + tag: set_user_changes_group_domain_from_event_user_changes_group_domain + copy_from: beyondtrust_epm.event.user.changes.group.domain + ignore_empty_value: true + - set: + field: user.changes.group.id + tag: set_user_changes_group_id_from_event_user_changes_group_id + copy_from: beyondtrust_epm.event.user.changes.group.id + ignore_empty_value: true + - set: + field: user.changes.group.name + tag: set_user_changes_group_name_from_event_user_changes_group_name + copy_from: beyondtrust_epm.event.user.changes.group.name + ignore_empty_value: true + - set: + field: user.changes.hash + tag: set_user_changes_hash_from_event_user_changes_hash + copy_from: beyondtrust_epm.event.user.changes.hash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_user_changes_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.user?.changes?.hash != null + value: '{{{beyondtrust_epm.event.user.changes.hash}}}' + allow_duplicates: false + - set: + field: user.changes.id + tag: set_user_changes_id_from_event_user_changes_id + copy_from: beyondtrust_epm.event.user.changes.id + ignore_empty_value: true + - set: + field: user.changes.name + tag: set_user_changes_name_from_event_user_changes_name + copy_from: beyondtrust_epm.event.user.changes.name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.user.changes.roles + tag: foreach_user_changes_roles + if: ctx.beyondtrust_epm?.event?.user?.changes?.roles instanceof List + processor: + append: + field: user.changes.roles + tag: append_user_changes_roles_into_user_changes_roles + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: user.domain + tag: set_user_domain_from_event_user_domain + copy_from: beyondtrust_epm.event.user.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.user.effective.DefaultTimezoneOffset + tag: convert_user_effective_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.user.effective.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.user.effective.LocalIdentifier + tag: convert_user_effective_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.user.effective.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: user.effective.domain + tag: set_user_effective_domain_from_event_user_effective_domain + copy_from: beyondtrust_epm.event.user.effective.domain + ignore_empty_value: true + - set: + field: user.effective.email + tag: set_user_effective_email_from_event_user_effective_email + copy_from: beyondtrust_epm.event.user.effective.email + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_effective_email_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.effective?.email != null + value: '{{{beyondtrust_epm.event.user.effective.email}}}' + allow_duplicates: false + - set: + field: user.effective.full_name + tag: set_user_effective_full_name_from_event_user_effective_full_name + copy_from: beyondtrust_epm.event.user.effective.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_effective_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.effective?.full_name != null + value: '{{{beyondtrust_epm.event.user.effective.full_name}}}' + allow_duplicates: false + - set: + field: user.effective.group.domain + tag: set_user_effective_group_domain_from_event_user_effective_group_domain + copy_from: beyondtrust_epm.event.user.effective.group.domain + ignore_empty_value: true + - set: + field: user.effective.group.id + tag: set_user_effective_group_id_from_event_user_effective_group_id + copy_from: beyondtrust_epm.event.user.effective.group.id + ignore_empty_value: true + - set: + field: user.effective.group.name + tag: set_user_effective_group_name_from_event_user_effective_group_name + copy_from: beyondtrust_epm.event.user.effective.group.name + ignore_empty_value: true + - set: + field: user.effective.hash + tag: set_user_effective_hash_from_event_user_effective_hash + copy_from: beyondtrust_epm.event.user.effective.hash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_user_effective_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.user?.effective?.hash != null + value: '{{{beyondtrust_epm.event.user.effective.hash}}}' + allow_duplicates: false + - set: + field: user.effective.id + tag: set_user_effective_id_from_event_user_effective_id + copy_from: beyondtrust_epm.event.user.effective.id + ignore_empty_value: true + - set: + field: user.effective.name + tag: set_user_effective_name_from_event_user_effective_name + copy_from: beyondtrust_epm.event.user.effective.name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_effective_name_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.effective?.name != null + value: '{{{beyondtrust_epm.event.user.effective.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.user.effective.roles + tag: foreach_user_effective_roles + if: ctx.beyondtrust_epm?.event?.user?.effective?.roles instanceof List + processor: + append: + field: user.effective.roles + tag: append_user_effective_roles_into_user_effective_roles + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: user.email + tag: set_user_email_from_event_user_email + copy_from: beyondtrust_epm.event.user.email + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_email_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.email != null + value: '{{{beyondtrust_epm.event.user.email}}}' + allow_duplicates: false + - set: + field: user.full_name + tag: set_user_full_name_from_event_user_full_name + copy_from: beyondtrust_epm.event.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.full_name != null + value: '{{{beyondtrust_epm.event.user.full_name}}}' + allow_duplicates: false + - set: + field: user.group.domain + tag: set_user_group_domain_from_event_user_group_domain + copy_from: beyondtrust_epm.event.user.group.domain + ignore_empty_value: true + - set: + field: user.group.id + tag: set_user_group_id_from_event_user_group_id + copy_from: beyondtrust_epm.event.user.group.id + ignore_empty_value: true + - set: + field: user.group.name + tag: set_user_group_name_from_event_user_group_name + copy_from: beyondtrust_epm.event.user.group.name + ignore_empty_value: true + - set: + field: user.hash + tag: set_user_hash_from_event_user_hash + copy_from: beyondtrust_epm.event.user.hash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_user_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.user?.hash != null + value: '{{{beyondtrust_epm.event.user.hash}}}' + allow_duplicates: false + - set: + field: user.id + tag: set_user_id_from_event_user_id + copy_from: beyondtrust_epm.event.user.id + ignore_empty_value: true + - set: + field: user.name + tag: set_user_name_from_event_user_name + copy_from: beyondtrust_epm.event.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_name_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.name != null + value: '{{{beyondtrust_epm.event.user.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.user.roles + tag: foreach_user_roles + if: ctx.beyondtrust_epm?.event?.user?.roles instanceof List + processor: + append: + field: user.roles + tag: append_user_roles_into_user_roles + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.user.target.DefaultTimezoneOffset + tag: convert_user_target_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.user.target.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.user.target.LocalIdentifier + tag: convert_user_target_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.user.target.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: user.target.domain + tag: set_user_target_domain_from_event_user_target_domain + copy_from: beyondtrust_epm.event.user.target.domain + ignore_empty_value: true + - set: + field: user.target.email + tag: set_user_target_email_from_event_user_target_email + copy_from: beyondtrust_epm.event.user.target.email + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_target_email_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.target?.email != null + value: '{{{beyondtrust_epm.event.user.target.email}}}' + allow_duplicates: false + - set: + field: user.target.full_name + tag: set_user_target_full_name_from_event_user_target_full_name + copy_from: beyondtrust_epm.event.user.target.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_target_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.target?.full_name != null + value: '{{{beyondtrust_epm.event.user.target.full_name}}}' + allow_duplicates: false + - set: + field: user.target.group.domain + tag: set_user_target_group_domain_from_event_user_target_group_domain + copy_from: beyondtrust_epm.event.user.target.group.domain + ignore_empty_value: true + - set: + field: user.target.group.id + tag: set_user_target_group_id_from_event_user_target_group_id + copy_from: beyondtrust_epm.event.user.target.group.id + ignore_empty_value: true + - set: + field: user.target.group.name + tag: set_user_target_group_name_from_event_user_target_group_name + copy_from: beyondtrust_epm.event.user.target.group.name + ignore_empty_value: true + - set: + field: user.target.hash + tag: set_user_target_hash_from_event_user_target_hash + copy_from: beyondtrust_epm.event.user.target.hash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_user_target_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.user?.target?.hash != null + value: '{{{beyondtrust_epm.event.user.target.hash}}}' + allow_duplicates: false + - set: + field: user.target.id + tag: set_user_target_id_from_event_user_target_id + copy_from: beyondtrust_epm.event.user.target.id + ignore_empty_value: true + - set: + field: user.target.name + tag: set_user_target_name_from_event_user_target_name + copy_from: beyondtrust_epm.event.user.target.name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_user_target_name_into_related_user + if: ctx.beyondtrust_epm?.event?.user?.target?.name != null + value: '{{{beyondtrust_epm.event.user.target.name}}}' + allow_duplicates: false + - set: + field: user_agent.device.name + tag: set_user_agent_device_name_from_event_user_agent_device_name + copy_from: beyondtrust_epm.event.user_agent.device.name + ignore_empty_value: true + - set: + field: user_agent.name + tag: set_user_agent_name_from_event_user_agent_name + copy_from: beyondtrust_epm.event.user_agent.name + ignore_empty_value: true + - set: + field: user_agent.original + tag: set_user_agent_original_from_event_user_agent_original + copy_from: beyondtrust_epm.event.user_agent.original + ignore_empty_value: true + - set: + field: user_agent.os.family + tag: set_user_agent_os_family_from_event_user_agent_os_family + copy_from: beyondtrust_epm.event.user_agent.os.family + ignore_empty_value: true + - set: + field: user_agent.os.full + tag: set_user_agent_os_full_from_event_user_agent_os_full + copy_from: beyondtrust_epm.event.user_agent.os.full + ignore_empty_value: true + - set: + field: user_agent.os.kernel + tag: set_user_agent_os_kernel_from_event_user_agent_os_kernel + copy_from: beyondtrust_epm.event.user_agent.os.kernel + ignore_empty_value: true + - set: + field: user_agent.os.name + tag: set_user_agent_os_name_from_event_user_agent_os_name + copy_from: beyondtrust_epm.event.user_agent.os.name + ignore_empty_value: true + - set: + field: user_agent.os.platform + tag: set_user_agent_os_platform_from_event_user_agent_os_platform + copy_from: beyondtrust_epm.event.user_agent.os.platform + ignore_empty_value: true + - set: + field: user_agent.os.type + tag: set_user_agent_os_type_from_event_user_agent_os_type + copy_from: beyondtrust_epm.event.user_agent.os.type + ignore_empty_value: true + - set: + field: user_agent.os.version + tag: set_user_agent_os_version_from_event_user_agent_os_version + copy_from: beyondtrust_epm.event.user_agent.os.version + ignore_empty_value: true + - set: + field: user_agent.version + tag: set_user_agent_version_from_event_user_agent_version + copy_from: beyondtrust_epm.event.user_agent.version + ignore_empty_value: true + - set: + field: user.id + tag: set_user_id_from_client_user_DomainIdentifier + copy_from: beyondtrust_epm.event.client.user.DomainIdentifier + ignore_empty_value: true + override: false + - set: + field: user.domain + tag: set_user_domain_from_client_user_DomainNetBIOSName + copy_from: beyondtrust_epm.event.client.user.DomainNetBIOSName + ignore_empty_value: true + override: false + - foreach: + field: email.attachments.file.size + tag: foreach_email_attachments_file_size_convert_to_long + if: ctx.email?.attachments instanceof List && ctx.email.attachments != null && ctx.email.attachments.size() > 0 + processor: + convert: + field: _ingest._value + tag: convert_ecs_email_attachments_file_size_elements_to_long + type: long + ignore_missing: true + ignore_failure: true + - append: + field: event.category + tag: append_event_category_email + if: >- + ctx.email != null + && (ctx.event?.category == null || !ctx.event.category.contains('email')) + value: email + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.email.attachments + tag: foreach_email_attachments + if: ctx.beyondtrust_epm?.event?.email?.attachments instanceof List + processor: + remove: + field: + - _ingest._value.file.extension + - _ingest._value.file.hash.md5 + - _ingest._value.file.hash.sha1 + - _ingest._value.file.hash.sha256 + - _ingest._value.file.hash.sha384 + - _ingest._value.file.hash.sha512 + - _ingest._value.file.hash.ssdeep + - _ingest._value.file.hash.tlsh + - _ingest._value.file.mime_type + - _ingest._value.file.name + - _ingest._value.file.size + tag: remove_fields_mapped_with_ecs_from_email_attachments + ignore_missing: true + - remove: + field: + - beyondtrust_epm.event.EPMWinMac.PrivilegedGroup.Name + - beyondtrust_epm.event.email.bcc.address + - beyondtrust_epm.event.email.cc.address + - beyondtrust_epm.event.email.content_type + - beyondtrust_epm.event.email.delivery_timestamp + - beyondtrust_epm.event.email.direction + - beyondtrust_epm.event.email.from.address + - beyondtrust_epm.event.email.local_id + - beyondtrust_epm.event.email.message_id + - beyondtrust_epm.event.email.origination_timestamp + - beyondtrust_epm.event.email.reply_to.address + - beyondtrust_epm.event.email.sender.address + - beyondtrust_epm.event.email.subject + - beyondtrust_epm.event.email.to.address + - beyondtrust_epm.event.email.x_mailer + - beyondtrust_epm.event.group.domain + - beyondtrust_epm.event.group.id + - beyondtrust_epm.event.group.name + - beyondtrust_epm.event.user.changes.domain + - beyondtrust_epm.event.user.changes.email + - beyondtrust_epm.event.user.changes.full_name + - beyondtrust_epm.event.user.changes.group.domain + - beyondtrust_epm.event.user.changes.group.id + - beyondtrust_epm.event.user.changes.group.name + - beyondtrust_epm.event.user.changes.hash + - beyondtrust_epm.event.user.changes.id + - beyondtrust_epm.event.user.changes.name + - beyondtrust_epm.event.user.changes.roles + - beyondtrust_epm.event.user.domain + - beyondtrust_epm.event.user.effective.domain + - beyondtrust_epm.event.user.effective.email + - beyondtrust_epm.event.user.effective.full_name + - beyondtrust_epm.event.user.effective.group.domain + - beyondtrust_epm.event.user.effective.group.id + - beyondtrust_epm.event.user.effective.group.name + - beyondtrust_epm.event.user.effective.hash + - beyondtrust_epm.event.user.effective.id + - beyondtrust_epm.event.user.effective.name + - beyondtrust_epm.event.user.effective.roles + - beyondtrust_epm.event.user.email + - beyondtrust_epm.event.user.full_name + - beyondtrust_epm.event.user.group.domain + - beyondtrust_epm.event.user.group.id + - beyondtrust_epm.event.user.group.name + - beyondtrust_epm.event.user.hash + - beyondtrust_epm.event.user.id + - beyondtrust_epm.event.user.name + - beyondtrust_epm.event.user.roles + - beyondtrust_epm.event.user.target.domain + - beyondtrust_epm.event.user.target.email + - beyondtrust_epm.event.user.target.full_name + - beyondtrust_epm.event.user.target.group.domain + - beyondtrust_epm.event.user.target.group.id + - beyondtrust_epm.event.user.target.group.name + - beyondtrust_epm.event.user.target.hash + - beyondtrust_epm.event.user.target.id + - beyondtrust_epm.event.user.target.name + - beyondtrust_epm.event.user_agent.device.name + - beyondtrust_epm.event.user_agent.name + - beyondtrust_epm.event.user_agent.original + - beyondtrust_epm.event.user_agent.os.family + - beyondtrust_epm.event.user_agent.os.full + - beyondtrust_epm.event.user_agent.os.kernel + - beyondtrust_epm.event.user_agent.os.name + - beyondtrust_epm.event.user_agent.os.platform + - beyondtrust_epm.event.user_agent.os.type + - beyondtrust_epm.event.user_agent.os.version + - beyondtrust_epm.event.user_agent.version + tag: remove_fields_mapped_with_ecs + ignore_missing: true diff --git a/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-metadata-observability.yml b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-metadata-observability.yml new file mode 100644 index 00000000000..62a19a06dfe --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-metadata-observability.yml @@ -0,0 +1,154 @@ +--- +description: Pipeline for processing metadata and observability fields (timestamp, trace, transaction, span, organization, labels, message). +processors: + - date: + field: beyondtrust_epm.event.@timestamp + tag: date_@timestamp + if: ctx.beyondtrust_epm?.event != null && ctx.beyondtrust_epm.event['@timestamp'] != null && ctx.beyondtrust_epm.event['@timestamp'] != '' + target_field: beyondtrust_epm.event.timestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.@timestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + # Set @timestamp from the event occurrence time. override defaults to true, so + # this overwrites the receipt time (ReceivedAt) seeded earlier in the + # service-application pipeline when both values are present. + - set: + field: '@timestamp' + tag: set_@timestamp_from_event_timestamp + copy_from: beyondtrust_epm.event.timestamp + ignore_empty_value: true + - set: + field: organization.id + tag: set_organization_id_from_event_EPMWinMac_GroupId + copy_from: beyondtrust_epm.event.EPMWinMac.GroupId + ignore_empty_value: true + - set: + field: message + tag: append_beyondtrust_epm_event_message_into_message + if: ctx.beyondtrust_epm?.event?.message != null + copy_from: beyondtrust_epm.event.message + ignore_empty_value: true + - append: + field: organization.id + tag: append_beyondtrust_epm_event_organization_id_into_organization_id + if: ctx.beyondtrust_epm?.event?.organization?.id != null + value: '{{{beyondtrust_epm.event.organization.id}}}' + allow_duplicates: false + - set: + field: organization.name + tag: set_organization_name_from_event_organization_name + copy_from: beyondtrust_epm.event.organization.name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.related.hash + tag: foreach_related_hash + if: ctx.beyondtrust_epm?.event?.related?.hash instanceof List + processor: + append: + field: related.hash + tag: append_related_hash_into_related_hash + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.related.hosts + tag: foreach_related_hosts + if: ctx.beyondtrust_epm?.event?.related?.hosts instanceof List + processor: + append: + field: related.hosts + tag: append_related_hosts_into_related_hosts + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.related.ip + tag: foreach_convert_related_ip_to_ip + if: ctx.beyondtrust_epm?.event?.related?.ip instanceof List + processor: + convert: + field: _ingest._value + tag: convert_related_ip_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.related.ip + tag: foreach_related_ip + if: ctx.beyondtrust_epm?.event?.related?.ip instanceof List + processor: + append: + field: related.ip + tag: append_related_ip_into_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.related.user + tag: foreach_related_user + if: ctx.beyondtrust_epm?.event?.related?.user instanceof List + processor: + append: + field: related.user + tag: append_related_user_into_related_user + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: span.id + tag: set_span_id_from_event_span_id + copy_from: beyondtrust_epm.event.span.id + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tags + tag: foreach_tags + if: ctx.beyondtrust_epm?.event?.tags instanceof List + processor: + append: + field: tags + tag: append_tags_into_tags + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: trace.id + tag: set_trace_id_from_event_trace_id + copy_from: beyondtrust_epm.event.trace.id + ignore_empty_value: true + - set: + field: transaction.id + tag: set_transaction_id_from_event_transaction_id + copy_from: beyondtrust_epm.event.transaction.id + ignore_empty_value: true + - set: + field: message + tag: set_message_from_event_EPMWinMac_Configuration_RuleScript_Outcome_Output + copy_from: beyondtrust_epm.event.EPMWinMac.Configuration.RuleScript.Outcome.Output + ignore_empty_value: true + override: false + - remove: + field: + - beyondtrust_epm.event.EPMWinMac.Configuration.RuleScript.Outcome.Output + - beyondtrust_epm.event.EPMWinMac.GroupId + - beyondtrust_epm.event.message + - beyondtrust_epm.event.organization.id + - beyondtrust_epm.event.organization.name + - beyondtrust_epm.event.related.hash + - beyondtrust_epm.event.related.hosts + - beyondtrust_epm.event.related.ip + - beyondtrust_epm.event.related.user + - beyondtrust_epm.event.span.id + - beyondtrust_epm.event.tags + - beyondtrust_epm.event.timestamp + - beyondtrust_epm.event.trace.id + - beyondtrust_epm.event.transaction.id + tag: remove_fields_mapped_with_ecs + ignore_missing: true diff --git a/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-network-transport.yml b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-network-transport.yml new file mode 100644 index 00000000000..d3b88427d0c --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-network-transport.yml @@ -0,0 +1,3643 @@ +--- +description: Pipeline for processing network and transport fields (client, server, source, destination, network, url, dns, http, tls). +processors: + - set: + field: client.address + tag: set_client_address_from_event_client_address + copy_from: beyondtrust_epm.event.client.address + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.as.number + tag: convert_client_as_number_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.as.number + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: client.as.number + tag: set_client_as_number_from_event_client_as_number + copy_from: beyondtrust_epm.event.client.as.number + ignore_empty_value: true + - set: + field: client.as.organization.name + tag: set_client_as_organization_name_from_event_client_as_organization_name + copy_from: beyondtrust_epm.event.client.as.organization.name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.bytes + tag: convert_client_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: client.bytes + tag: set_client_bytes_from_event_client_bytes + copy_from: beyondtrust_epm.event.client.bytes + ignore_empty_value: true + - set: + field: client.domain + tag: set_client_domain_from_event_client_domain + copy_from: beyondtrust_epm.event.client.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.geo.TimezoneOffset + tag: convert_client_geo_TimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.geo.TimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: client.geo.city_name + tag: set_client_geo_city_name_from_event_client_geo_city_name + copy_from: beyondtrust_epm.event.client.geo.city_name + ignore_empty_value: true + - set: + field: client.geo.continent_code + tag: set_client_geo_continent_code_from_event_client_geo_continent_code + copy_from: beyondtrust_epm.event.client.geo.continent_code + ignore_empty_value: true + - set: + field: client.geo.continent_name + tag: set_client_geo_continent_name_from_event_client_geo_continent_name + copy_from: beyondtrust_epm.event.client.geo.continent_name + ignore_empty_value: true + - set: + field: client.geo.country_iso_code + tag: set_client_geo_country_iso_code_from_event_client_geo_country_iso_code + copy_from: beyondtrust_epm.event.client.geo.country_iso_code + ignore_empty_value: true + - set: + field: client.geo.country_name + tag: set_client_geo_country_name_from_event_client_geo_country_name + copy_from: beyondtrust_epm.event.client.geo.country_name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.geo.location.lat + tag: convert_client_geo_location_lat_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.geo.location.lat + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.client.geo.location.lon + tag: convert_client_geo_location_lon_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.geo.location.lon + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: set_client_geo_location_from_lat_lon + lang: painless + description: Combine lat/lon into geo_point. + if: >- + ctx.beyondtrust_epm?.event?.client?.geo?.location?.lat != null + && ctx.beyondtrust_epm?.event?.client?.geo?.location?.lon != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.beyondtrust_epm.event.client.geo.location.lat); + location.put('lon', ctx.beyondtrust_epm.event.client.geo.location.lon); + ctx.beyondtrust_epm.event.client.geo.location = location; + - set: + field: client.geo.location + tag: set_client_geo_location_from_event + copy_from: beyondtrust_epm.event.client.geo.location + ignore_empty_value: true + - set: + field: client.geo.name + tag: set_client_geo_name_from_event_client_geo_name + copy_from: beyondtrust_epm.event.client.geo.name + ignore_empty_value: true + - set: + field: client.geo.postal_code + tag: set_client_geo_postal_code_from_event_client_geo_postal_code + copy_from: beyondtrust_epm.event.client.geo.postal_code + ignore_empty_value: true + - set: + field: client.geo.region_iso_code + tag: set_client_geo_region_iso_code_from_event_client_geo_region_iso_code + copy_from: beyondtrust_epm.event.client.geo.region_iso_code + ignore_empty_value: true + - set: + field: client.geo.region_name + tag: set_client_geo_region_name_from_event_client_geo_region_name + copy_from: beyondtrust_epm.event.client.geo.region_name + ignore_empty_value: true + - set: + field: client.geo.timezone + tag: set_client_geo_timezone_from_event_client_geo_timezone + copy_from: beyondtrust_epm.event.client.geo.timezone + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.ip + tag: convert_client_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.client?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.client.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: client.ip + tag: set_client_ip_from_event_client_ip + copy_from: beyondtrust_epm.event.client.ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_client_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.client?.ip != null + value: '{{{beyondtrust_epm.event.client.ip}}}' + allow_duplicates: false + - gsub: + field: beyondtrust_epm.event.client.mac + pattern: '[:.]' + replacement: '-' + tag: gsub_client_mac + ignore_missing: true + - uppercase: + field: beyondtrust_epm.event.client.mac + tag: uppercase_client_mac + ignore_missing: true + - set: + field: client.mac + tag: set_client_mac_from_event_client_mac + copy_from: beyondtrust_epm.event.client.mac + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.nat.ip + tag: convert_client_nat_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.client?.nat?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.client.nat.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: client.nat.ip + tag: set_client_nat_ip_from_event_client_nat_ip + copy_from: beyondtrust_epm.event.client.nat.ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_client_nat_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.client?.nat?.ip != null + value: '{{{beyondtrust_epm.event.client.nat.ip}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.client.nat.port + tag: convert_client_nat_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.nat.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: client.nat.port + tag: set_client_nat_port_from_event_client_nat_port + copy_from: beyondtrust_epm.event.client.nat.port + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.packets + tag: convert_client_packets_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.packets + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: client.packets + tag: set_client_packets_from_event_client_packets + copy_from: beyondtrust_epm.event.client.packets + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.port + tag: convert_client_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: client.port + tag: set_client_port_from_event_client_port + copy_from: beyondtrust_epm.event.client.port + ignore_empty_value: true + - set: + field: client.registered_domain + tag: set_client_registered_domain_from_event_client_registered_domain + copy_from: beyondtrust_epm.event.client.registered_domain + ignore_empty_value: true + - set: + field: client.subdomain + tag: set_client_subdomain_from_event_client_subdomain + copy_from: beyondtrust_epm.event.client.subdomain + ignore_empty_value: true + - set: + field: client.top_level_domain + tag: set_client_top_level_domain_from_event_client_top_level_domain + copy_from: beyondtrust_epm.event.client.top_level_domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.user.DefaultTimezoneOffset + tag: convert_client_user_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.user.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.client.user.LocalIdentifier + tag: convert_client_user_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.user.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.client.user.changes.DefaultTimezoneOffset + tag: convert_client_user_changes_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.user.changes.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.client.user.changes.LocalIdentifier + tag: convert_client_user_changes_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.user.changes.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_client_user_changes_email_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.changes?.email != null + value: '{{{beyondtrust_epm.event.client.user.changes.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_client_user_changes_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.changes?.full_name != null + value: '{{{beyondtrust_epm.event.client.user.changes.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_client_user_changes_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.client?.user?.changes?.hash != null + value: '{{{beyondtrust_epm.event.client.user.changes.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_client_user_changes_name_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.changes?.name != null + value: '{{{beyondtrust_epm.event.client.user.changes.name}}}' + allow_duplicates: false + - set: + field: client.user.domain + tag: set_client_user_domain_from_event_client_user_domain + copy_from: beyondtrust_epm.event.client.user.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.client.user.effective.DefaultTimezoneOffset + tag: convert_client_user_effective_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.user.effective.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.client.user.effective.LocalIdentifier + tag: convert_client_user_effective_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.user.effective.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_client_user_effective_email_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.effective?.email != null + value: '{{{beyondtrust_epm.event.client.user.effective.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_client_user_effective_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.effective?.full_name != null + value: '{{{beyondtrust_epm.event.client.user.effective.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_client_user_effective_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.client?.user?.effective?.hash != null + value: '{{{beyondtrust_epm.event.client.user.effective.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_client_user_effective_id_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.effective?.id != null + value: '{{{beyondtrust_epm.event.client.user.effective.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_client_user_effective_name_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.effective?.name != null + value: '{{{beyondtrust_epm.event.client.user.effective.name}}}' + allow_duplicates: false + - set: + field: client.user.email + tag: set_client_user_email_from_event_client_user_email + copy_from: beyondtrust_epm.event.client.user.email + ignore_empty_value: true + - append: + field: related.user + tag: append_event_client_user_email_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.email != null + value: '{{{beyondtrust_epm.event.client.user.email}}}' + allow_duplicates: false + - set: + field: client.user.full_name + tag: set_client_user_full_name_from_event_client_user_full_name + copy_from: beyondtrust_epm.event.client.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_client_user_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.full_name != null + value: '{{{beyondtrust_epm.event.client.user.full_name}}}' + allow_duplicates: false + - set: + field: client.user.group.domain + tag: set_client_user_group_domain_from_event_client_user_group_domain + copy_from: beyondtrust_epm.event.client.user.group.domain + ignore_empty_value: true + - set: + field: client.user.group.id + tag: set_client_user_group_id_from_event_client_user_group_id + copy_from: beyondtrust_epm.event.client.user.group.id + ignore_empty_value: true + - set: + field: client.user.group.name + tag: set_client_user_group_name_from_event_client_user_group_name + copy_from: beyondtrust_epm.event.client.user.group.name + ignore_empty_value: true + - set: + field: client.user.hash + tag: set_client_user_hash_from_event_client_user_hash + copy_from: beyondtrust_epm.event.client.user.hash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_client_user_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.client?.user?.hash != null + value: '{{{beyondtrust_epm.event.client.user.hash}}}' + allow_duplicates: false + - set: + field: client.user.id + tag: set_client_user_id_from_event_client_user_id + copy_from: beyondtrust_epm.event.client.user.id + ignore_empty_value: true + - append: + field: related.user + tag: append_event_client_user_id_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.id != null + value: '{{{beyondtrust_epm.event.client.user.id}}}' + allow_duplicates: false + - set: + field: client.user.name + tag: set_client_user_name_from_event_client_user_name + copy_from: beyondtrust_epm.event.client.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_client_user_name_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.name != null + value: '{{{beyondtrust_epm.event.client.user.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.client.user.roles + tag: foreach_client_user_roles + if: ctx.beyondtrust_epm?.event?.client?.user?.roles instanceof List + processor: + append: + field: client.user.roles + tag: append_client_user_roles_into_client_user_roles + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.client.user.target.DefaultTimezoneOffset + tag: convert_client_user_target_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.user.target.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.client.user.target.LocalIdentifier + tag: convert_client_user_target_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.client.user.target.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_client_user_target_email_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.target?.email != null + value: '{{{beyondtrust_epm.event.client.user.target.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_client_user_target_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.target?.full_name != null + value: '{{{beyondtrust_epm.event.client.user.target.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_client_user_target_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.client?.user?.target?.hash != null + value: '{{{beyondtrust_epm.event.client.user.target.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_client_user_target_id_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.target?.id != null + value: '{{{beyondtrust_epm.event.client.user.target.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_client_user_target_name_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.target?.name != null + value: '{{{beyondtrust_epm.event.client.user.target.name}}}' + allow_duplicates: false + - set: + field: destination.address + tag: set_destination_address_from_event_destination_address + copy_from: beyondtrust_epm.event.destination.address + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.as.number + tag: convert_destination_as_number_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.as.number + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.as.number + tag: set_destination_as_number_from_event_destination_as_number + copy_from: beyondtrust_epm.event.destination.as.number + ignore_empty_value: true + - set: + field: destination.as.organization.name + tag: set_destination_as_organization_name_from_event_destination_as_organization_name + copy_from: beyondtrust_epm.event.destination.as.organization.name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.bytes + tag: convert_destination_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.bytes + tag: set_destination_bytes_from_event_destination_bytes + copy_from: beyondtrust_epm.event.destination.bytes + ignore_empty_value: true + - set: + field: destination.domain + tag: set_destination_domain_from_event_destination_domain + copy_from: beyondtrust_epm.event.destination.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.geo.TimezoneOffset + tag: convert_destination_geo_TimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.geo.TimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.geo.city_name + tag: set_destination_geo_city_name_from_event_destination_geo_city_name + copy_from: beyondtrust_epm.event.destination.geo.city_name + ignore_empty_value: true + - set: + field: destination.geo.continent_code + tag: set_destination_geo_continent_code_from_event_destination_geo_continent_code + copy_from: beyondtrust_epm.event.destination.geo.continent_code + ignore_empty_value: true + - set: + field: destination.geo.continent_name + tag: set_destination_geo_continent_name_from_event_destination_geo_continent_name + copy_from: beyondtrust_epm.event.destination.geo.continent_name + ignore_empty_value: true + - set: + field: destination.geo.country_iso_code + tag: set_destination_geo_country_iso_code_from_event_destination_geo_country_iso_code + copy_from: beyondtrust_epm.event.destination.geo.country_iso_code + ignore_empty_value: true + - set: + field: destination.geo.country_name + tag: set_destination_geo_country_name_from_event_destination_geo_country_name + copy_from: beyondtrust_epm.event.destination.geo.country_name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.geo.location.lat + tag: convert_destination_geo_location_lat_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.geo.location.lat + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.destination.geo.location.lon + tag: convert_destination_geo_location_lon_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.geo.location.lon + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: set_destination_geo_location_from_lat_lon + lang: painless + description: Combine lat/lon into geo_point. + if: >- + ctx.beyondtrust_epm?.event?.destination?.geo?.location?.lat != null + && ctx.beyondtrust_epm?.event?.destination?.geo?.location?.lon != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.beyondtrust_epm.event.destination.geo.location.lat); + location.put('lon', ctx.beyondtrust_epm.event.destination.geo.location.lon); + ctx.beyondtrust_epm.event.destination.geo.location = location; + - set: + field: destination.geo.location + tag: set_destination_geo_location_from_event + copy_from: beyondtrust_epm.event.destination.geo.location + ignore_empty_value: true + - set: + field: destination.geo.name + tag: set_destination_geo_name_from_event_destination_geo_name + copy_from: beyondtrust_epm.event.destination.geo.name + ignore_empty_value: true + - set: + field: destination.geo.postal_code + tag: set_destination_geo_postal_code_from_event_destination_geo_postal_code + copy_from: beyondtrust_epm.event.destination.geo.postal_code + ignore_empty_value: true + - set: + field: destination.geo.region_iso_code + tag: set_destination_geo_region_iso_code_from_event_destination_geo_region_iso_code + copy_from: beyondtrust_epm.event.destination.geo.region_iso_code + ignore_empty_value: true + - set: + field: destination.geo.region_name + tag: set_destination_geo_region_name_from_event_destination_geo_region_name + copy_from: beyondtrust_epm.event.destination.geo.region_name + ignore_empty_value: true + - set: + field: destination.geo.timezone + tag: set_destination_geo_timezone_from_event_destination_geo_timezone + copy_from: beyondtrust_epm.event.destination.geo.timezone + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.ip + tag: convert_destination_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.destination?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.destination.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.ip + tag: set_destination_ip_from_event_destination_ip + copy_from: beyondtrust_epm.event.destination.ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_destination_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.destination?.ip != null + value: '{{{beyondtrust_epm.event.destination.ip}}}' + allow_duplicates: false + - gsub: + field: beyondtrust_epm.event.destination.mac + pattern: '[:.]' + replacement: '-' + tag: gsub_destination_mac + ignore_missing: true + - uppercase: + field: beyondtrust_epm.event.destination.mac + tag: uppercase_gsub_destination_mac + ignore_missing: true + - set: + field: destination.mac + tag: set_destination_mac_from_event_destination_mac + copy_from: beyondtrust_epm.event.destination.mac + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.nat.ip + tag: convert_destination_nat_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.destination?.nat?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.destination.nat.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.nat.ip + tag: set_destination_nat_ip_from_event_destination_nat_ip + copy_from: beyondtrust_epm.event.destination.nat.ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_destination_nat_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.destination?.nat?.ip != null + value: '{{{beyondtrust_epm.event.destination.nat.ip}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.destination.nat.port + tag: convert_destination_nat_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.nat.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.nat.port + tag: set_destination_nat_port_from_event_destination_nat_port + copy_from: beyondtrust_epm.event.destination.nat.port + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.packets + tag: convert_destination_packets_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.packets + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.packets + tag: set_destination_packets_from_event_destination_packets + copy_from: beyondtrust_epm.event.destination.packets + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.port + tag: convert_destination_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.port + tag: set_destination_port_from_event_destination_port + copy_from: beyondtrust_epm.event.destination.port + ignore_empty_value: true + - set: + field: destination.registered_domain + tag: set_destination_registered_domain_from_event_destination_registered_domain + copy_from: beyondtrust_epm.event.destination.registered_domain + ignore_empty_value: true + - set: + field: destination.subdomain + tag: set_destination_subdomain_from_event_destination_subdomain + copy_from: beyondtrust_epm.event.destination.subdomain + ignore_empty_value: true + - set: + field: destination.top_level_domain + tag: set_destination_top_level_domain_from_event_destination_top_level_domain + copy_from: beyondtrust_epm.event.destination.top_level_domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.user.DefaultTimezoneOffset + tag: convert_destination_user_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.user.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.destination.user.LocalIdentifier + tag: convert_destination_user_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.user.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.destination.user.changes.DefaultTimezoneOffset + tag: convert_destination_user_changes_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.user.changes.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.destination.user.changes.LocalIdentifier + tag: convert_destination_user_changes_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.user.changes.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_destination_user_changes_email_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.changes?.email != null + value: '{{{beyondtrust_epm.event.destination.user.changes.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_destination_user_changes_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.changes?.full_name != null + value: '{{{beyondtrust_epm.event.destination.user.changes.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_destination_user_changes_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.destination?.user?.changes?.hash != null + value: '{{{beyondtrust_epm.event.destination.user.changes.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_destination_user_changes_name_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.changes?.name != null + value: '{{{beyondtrust_epm.event.destination.user.changes.name}}}' + allow_duplicates: false + - set: + field: destination.user.domain + tag: set_destination_user_domain_from_event_destination_user_domain + copy_from: beyondtrust_epm.event.destination.user.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.destination.user.effective.DefaultTimezoneOffset + tag: convert_destination_user_effective_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.user.effective.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.destination.user.effective.LocalIdentifier + tag: convert_destination_user_effective_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.user.effective.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_destination_user_effective_email_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.effective?.email != null + value: '{{{beyondtrust_epm.event.destination.user.effective.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_destination_user_effective_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.effective?.full_name != null + value: '{{{beyondtrust_epm.event.destination.user.effective.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_destination_user_effective_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.destination?.user?.effective?.hash != null + value: '{{{beyondtrust_epm.event.destination.user.effective.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_destination_user_effective_id_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.effective?.id != null + value: '{{{beyondtrust_epm.event.destination.user.effective.id}}}' + allow_duplicates: false + - set: + field: destination.user.email + tag: set_destination_user_email_from_event_destination_user_email + copy_from: beyondtrust_epm.event.destination.user.email + ignore_empty_value: true + - append: + field: related.user + tag: append_event_destination_user_email_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.email != null + value: '{{{beyondtrust_epm.event.destination.user.email}}}' + allow_duplicates: false + - set: + field: destination.user.full_name + tag: set_destination_user_full_name_from_event_destination_user_full_name + copy_from: beyondtrust_epm.event.destination.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_destination_user_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.full_name != null + value: '{{{beyondtrust_epm.event.destination.user.full_name}}}' + allow_duplicates: false + - set: + field: destination.user.group.domain + tag: set_destination_user_group_domain_from_event_destination_user_group_domain + copy_from: beyondtrust_epm.event.destination.user.group.domain + ignore_empty_value: true + - set: + field: destination.user.group.id + tag: set_destination_user_group_id_from_event_destination_user_group_id + copy_from: beyondtrust_epm.event.destination.user.group.id + ignore_empty_value: true + - set: + field: destination.user.group.name + tag: set_destination_user_group_name_from_event_destination_user_group_name + copy_from: beyondtrust_epm.event.destination.user.group.name + ignore_empty_value: true + - set: + field: destination.user.hash + tag: set_destination_user_hash_from_event_destination_user_hash + copy_from: beyondtrust_epm.event.destination.user.hash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_destination_user_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.destination?.user?.hash != null + value: '{{{beyondtrust_epm.event.destination.user.hash}}}' + allow_duplicates: false + - set: + field: destination.user.id + tag: set_destination_user_id_from_event_destination_user_id + copy_from: beyondtrust_epm.event.destination.user.id + ignore_empty_value: true + - append: + field: related.user + tag: append_event_destination_user_id_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.id != null + value: '{{{beyondtrust_epm.event.destination.user.id}}}' + allow_duplicates: false + - set: + field: destination.user.name + tag: set_destination_user_name_from_event_destination_user_name + copy_from: beyondtrust_epm.event.destination.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_destination_user_name_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.name != null + value: '{{{beyondtrust_epm.event.destination.user.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.destination.user.roles + tag: foreach_destination_user_roles + if: ctx.beyondtrust_epm?.event?.destination?.user?.roles instanceof List + processor: + append: + field: destination.user.roles + tag: append_destination_user_roles_into_destination_user_roles + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.destination.user.target.DefaultTimezoneOffset + tag: convert_destination_user_target_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.user.target.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.destination.user.target.LocalIdentifier + tag: convert_destination_user_target_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.destination.user.target.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_destination_user_target_email_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.target?.email != null + value: '{{{beyondtrust_epm.event.destination.user.target.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_destination_user_target_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.target?.full_name != null + value: '{{{beyondtrust_epm.event.destination.user.target.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_destination_user_target_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.destination?.user?.target?.hash != null + value: '{{{beyondtrust_epm.event.destination.user.target.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_destination_user_target_id_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.target?.id != null + value: '{{{beyondtrust_epm.event.destination.user.target.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_destination_user_target_name_into_related_user + if: ctx.beyondtrust_epm?.event?.destination?.user?.target?.name != null + value: '{{{beyondtrust_epm.event.destination.user.target.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.dns.header_flags + tag: foreach_dns_header_flags + if: ctx.beyondtrust_epm?.event?.dns?.header_flags instanceof List + processor: + append: + field: dns.header_flags + tag: append_dns_header_flags_into_dns_header_flags + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: dns.id + tag: set_dns_id_from_event_dns_id + copy_from: beyondtrust_epm.event.dns.id + ignore_empty_value: true + - set: + field: dns.op_code + tag: set_dns_op_code_from_event_dns_op_code + copy_from: beyondtrust_epm.event.dns.op_code + ignore_empty_value: true + - set: + field: dns.question.class + tag: set_dns_question_class_from_event_dns_question_class + copy_from: beyondtrust_epm.event.dns.question.class + ignore_empty_value: true + - set: + field: dns.question.name + tag: set_dns_question_name_from_event_dns_question_name + copy_from: beyondtrust_epm.event.dns.question.name + ignore_empty_value: true + - set: + field: dns.question.registered_domain + tag: set_dns_question_registered_domain_from_event_dns_question_registered_domain + copy_from: beyondtrust_epm.event.dns.question.registered_domain + ignore_empty_value: true + - set: + field: dns.question.subdomain + tag: set_dns_question_subdomain_from_event_dns_question_subdomain + copy_from: beyondtrust_epm.event.dns.question.subdomain + ignore_empty_value: true + - set: + field: dns.question.top_level_domain + tag: set_dns_question_top_level_domain_from_event_dns_question_top_level_domain + copy_from: beyondtrust_epm.event.dns.question.top_level_domain + ignore_empty_value: true + - set: + field: dns.question.type + tag: set_dns_question_type_from_event_dns_question_type + copy_from: beyondtrust_epm.event.dns.question.type + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.dns.resolved_ip + tag: foreach_convert_dns_resolved_ip_to_ip + if: ctx.beyondtrust_epm?.event?.dns?.resolved_ip instanceof List + processor: + convert: + field: _ingest._value + tag: convert_dns_resolved_ip_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.dns.resolved_ip + tag: foreach_dns_resolved_ip + if: ctx.beyondtrust_epm?.event?.dns?.resolved_ip instanceof List + processor: + append: + field: dns.resolved_ip + tag: append_dns_resolved_ip_into_dns_resolved_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.dns.resolved_ip + tag: foreach_dns_resolved_ip + if: ctx.beyondtrust_epm?.event?.dns?.resolved_ip instanceof List + processor: + append: + field: related.ip + tag: append_dns_resolved_ip_into_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: dns.response_code + tag: set_dns_response_code_from_event_dns_response_code + copy_from: beyondtrust_epm.event.dns.response_code + ignore_empty_value: true + - set: + field: dns.type + tag: set_dns_type_from_event_dns_type + copy_from: beyondtrust_epm.event.dns.type + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.http.request.body.bytes + tag: convert_http_request_body_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.http.request.body.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: http.request.body.bytes + tag: set_http_request_body_bytes_from_event_http_request_body_bytes + copy_from: beyondtrust_epm.event.http.request.body.bytes + ignore_empty_value: true + - set: + field: http.request.body.content + tag: set_http_request_body_content_from_event_http_request_body_content + copy_from: beyondtrust_epm.event.http.request.body.content + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.http.request.bytes + tag: convert_http_request_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.http.request.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: http.request.bytes + tag: set_http_request_bytes_from_event_http_request_bytes + copy_from: beyondtrust_epm.event.http.request.bytes + ignore_empty_value: true + - set: + field: http.request.id + tag: set_http_request_id_from_event_http_request_id + copy_from: beyondtrust_epm.event.http.request.id + ignore_empty_value: true + - set: + field: http.request.method + tag: set_http_request_method_from_event_http_request_method + copy_from: beyondtrust_epm.event.http.request.method + ignore_empty_value: true + - set: + field: http.request.mime_type + tag: set_http_request_mime_type_from_event_http_request_mime_type + copy_from: beyondtrust_epm.event.http.request.mime_type + ignore_empty_value: true + - set: + field: http.request.referrer + tag: set_http_request_referrer_from_event_http_request_referrer + copy_from: beyondtrust_epm.event.http.request.referrer + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.http.response.body.bytes + tag: convert_http_response_body_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.http.response.body.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: http.response.body.bytes + tag: set_http_response_body_bytes_from_event_http_response_body_bytes + copy_from: beyondtrust_epm.event.http.response.body.bytes + ignore_empty_value: true + - set: + field: http.response.body.content + tag: set_http_response_body_content_from_event_http_response_body_content + copy_from: beyondtrust_epm.event.http.response.body.content + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.http.response.bytes + tag: convert_http_response_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.http.response.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: http.response.bytes + tag: set_http_response_bytes_from_event_http_response_bytes + copy_from: beyondtrust_epm.event.http.response.bytes + ignore_empty_value: true + - set: + field: http.response.mime_type + tag: set_http_response_mime_type_from_event_http_response_mime_type + copy_from: beyondtrust_epm.event.http.response.mime_type + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.http.response.status_code + tag: convert_http_response_status_code_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.http.response.status_code + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: http.response.status_code + tag: set_http_response_status_code_from_event_http_response_status_code + copy_from: beyondtrust_epm.event.http.response.status_code + ignore_empty_value: true + - set: + field: http.version + tag: set_http_version_from_event_http_version + copy_from: beyondtrust_epm.event.http.version + ignore_empty_value: true + - set: + field: network.application + tag: set_network_application_from_event_network_application + copy_from: beyondtrust_epm.event.network.application + ignore_empty_value: true + - lowercase: + field: network.application + tag: lowercase_network_application + ignore_missing: true + - convert: + field: beyondtrust_epm.event.network.bytes + tag: convert_network_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.network.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: network.bytes + tag: set_network_bytes_from_event_network_bytes + copy_from: beyondtrust_epm.event.network.bytes + ignore_empty_value: true + - set: + field: network.community_id + tag: set_network_community_id_from_event_network_community_id + copy_from: beyondtrust_epm.event.network.community_id + ignore_empty_value: true + - set: + field: network.direction + tag: set_network_direction_from_event_network_direction + copy_from: beyondtrust_epm.event.network.direction + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.network.forwarded_ip + tag: convert_network_forwarded_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.network?.forwarded_ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.network.forwarded_ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: network.forwarded_ip + tag: set_network_forwarded_ip_from_event_network_forwarded_ip + copy_from: beyondtrust_epm.event.network.forwarded_ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_network_forwarded_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.network?.forwarded_ip != null + value: '{{{beyondtrust_epm.event.network.forwarded_ip}}}' + allow_duplicates: false + - set: + field: network.iana_number + tag: set_network_iana_number_from_event_network_iana_number + copy_from: beyondtrust_epm.event.network.iana_number + ignore_empty_value: true + - set: + field: network.name + tag: set_network_name_from_event_network_name + copy_from: beyondtrust_epm.event.network.name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.network.packets + tag: convert_network_packets_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.network.packets + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: network.packets + tag: set_network_packets_from_event_network_packets + copy_from: beyondtrust_epm.event.network.packets + ignore_empty_value: true + - set: + field: network.protocol + tag: set_network_protocol_from_event_network_protocol + copy_from: beyondtrust_epm.event.network.protocol + ignore_empty_value: true + - lowercase: + field: network.protocol + tag: lowercase_network_protocol + ignore_missing: true + - set: + field: network.transport + tag: set_network_transport_from_event_network_transport + copy_from: beyondtrust_epm.event.network.transport + ignore_empty_value: true + - lowercase: + field: network.transport + tag: lowercase_network_transport + ignore_missing: true + - set: + field: network.type + tag: set_network_type_from_event_network_type + copy_from: beyondtrust_epm.event.network.type + ignore_empty_value: true + - lowercase: + field: network.type + tag: lowercase_network_type + ignore_missing: true + - set: + field: network.vlan.id + tag: set_network_vlan_id_from_event_network_vlan_id + copy_from: beyondtrust_epm.event.network.vlan.id + ignore_empty_value: true + - set: + field: network.vlan.name + tag: set_network_vlan_name_from_event_network_vlan_name + copy_from: beyondtrust_epm.event.network.vlan.name + ignore_empty_value: true + - set: + field: server.address + tag: set_server_address_from_event_server_address + copy_from: beyondtrust_epm.event.server.address + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.as.number + tag: convert_server_as_number_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.as.number + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: server.as.number + tag: set_server_as_number_from_event_server_as_number + copy_from: beyondtrust_epm.event.server.as.number + ignore_empty_value: true + - set: + field: server.as.organization.name + tag: set_server_as_organization_name_from_event_server_as_organization_name + copy_from: beyondtrust_epm.event.server.as.organization.name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.bytes + tag: convert_server_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: server.bytes + tag: set_server_bytes_from_event_server_bytes + copy_from: beyondtrust_epm.event.server.bytes + ignore_empty_value: true + - set: + field: server.domain + tag: set_server_domain_from_event_server_domain + copy_from: beyondtrust_epm.event.server.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.geo.TimezoneOffset + tag: convert_server_geo_TimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.geo.TimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: server.geo.city_name + tag: set_server_geo_city_name_from_event_server_geo_city_name + copy_from: beyondtrust_epm.event.server.geo.city_name + ignore_empty_value: true + - set: + field: server.geo.continent_code + tag: set_server_geo_continent_code_from_event_server_geo_continent_code + copy_from: beyondtrust_epm.event.server.geo.continent_code + ignore_empty_value: true + - set: + field: server.geo.continent_name + tag: set_server_geo_continent_name_from_event_server_geo_continent_name + copy_from: beyondtrust_epm.event.server.geo.continent_name + ignore_empty_value: true + - set: + field: server.geo.country_iso_code + tag: set_server_geo_country_iso_code_from_event_server_geo_country_iso_code + copy_from: beyondtrust_epm.event.server.geo.country_iso_code + ignore_empty_value: true + - set: + field: server.geo.country_name + tag: set_server_geo_country_name_from_event_server_geo_country_name + copy_from: beyondtrust_epm.event.server.geo.country_name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.geo.location.lat + tag: convert_server_geo_location_lat_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.geo.location.lat + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.server.geo.location.lon + tag: convert_server_geo_location_lon_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.geo.location.lon + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: set_server_geo_location_from_lat_lon + lang: painless + description: Combine lat/lon into geo_point. + if: >- + ctx.beyondtrust_epm?.event?.server?.geo?.location?.lat != null + && ctx.beyondtrust_epm?.event?.server?.geo?.location?.lon != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.beyondtrust_epm.event.server.geo.location.lat); + location.put('lon', ctx.beyondtrust_epm.event.server.geo.location.lon); + ctx.beyondtrust_epm.event.server.geo.location = location; + - set: + field: server.geo.location + tag: set_server_geo_location_from_event + copy_from: beyondtrust_epm.event.server.geo.location + ignore_empty_value: true + - set: + field: server.geo.name + tag: set_server_geo_name_from_event_server_geo_name + copy_from: beyondtrust_epm.event.server.geo.name + ignore_empty_value: true + - set: + field: server.geo.postal_code + tag: set_server_geo_postal_code_from_event_server_geo_postal_code + copy_from: beyondtrust_epm.event.server.geo.postal_code + ignore_empty_value: true + - set: + field: server.geo.region_iso_code + tag: set_server_geo_region_iso_code_from_event_server_geo_region_iso_code + copy_from: beyondtrust_epm.event.server.geo.region_iso_code + ignore_empty_value: true + - set: + field: server.geo.region_name + tag: set_server_geo_region_name_from_event_server_geo_region_name + copy_from: beyondtrust_epm.event.server.geo.region_name + ignore_empty_value: true + - set: + field: server.geo.timezone + tag: set_server_geo_timezone_from_event_server_geo_timezone + copy_from: beyondtrust_epm.event.server.geo.timezone + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.ip + tag: convert_server_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.server?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.server.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: server.ip + tag: set_server_ip_from_event_server_ip + copy_from: beyondtrust_epm.event.server.ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_server_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.server?.ip != null + value: '{{{beyondtrust_epm.event.server.ip}}}' + allow_duplicates: false + - gsub: + field: beyondtrust_epm.event.server.mac + pattern: '[:.]' + replacement: '-' + tag: gsub_server_mac + ignore_missing: true + - uppercase: + field: beyondtrust_epm.event.server.mac + tag: uppercase_server_mac + ignore_missing: true + - set: + field: server.mac + tag: set_server_mac_from_event_server_mac + copy_from: beyondtrust_epm.event.server.mac + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.nat.ip + tag: convert_server_nat_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.server?.nat?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.server.nat.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: server.nat.ip + tag: set_server_nat_ip_from_event_server_nat_ip + copy_from: beyondtrust_epm.event.server.nat.ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_server_nat_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.server?.nat?.ip != null + value: '{{{beyondtrust_epm.event.server.nat.ip}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.server.nat.port + tag: convert_server_nat_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.nat.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: server.nat.port + tag: set_server_nat_port_from_event_server_nat_port + copy_from: beyondtrust_epm.event.server.nat.port + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.packets + tag: convert_server_packets_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.packets + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: server.packets + tag: set_server_packets_from_event_server_packets + copy_from: beyondtrust_epm.event.server.packets + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.port + tag: convert_server_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: server.port + tag: set_server_port_from_event_server_port + copy_from: beyondtrust_epm.event.server.port + ignore_empty_value: true + - set: + field: server.registered_domain + tag: set_server_registered_domain_from_event_server_registered_domain + copy_from: beyondtrust_epm.event.server.registered_domain + ignore_empty_value: true + - set: + field: server.subdomain + tag: set_server_subdomain_from_event_server_subdomain + copy_from: beyondtrust_epm.event.server.subdomain + ignore_empty_value: true + - set: + field: server.top_level_domain + tag: set_server_top_level_domain_from_event_server_top_level_domain + copy_from: beyondtrust_epm.event.server.top_level_domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.user.DefaultTimezoneOffset + tag: convert_server_user_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.user.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.server.user.LocalIdentifier + tag: convert_server_user_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.user.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.server.user.changes.DefaultTimezoneOffset + tag: convert_server_user_changes_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.user.changes.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.server.user.changes.LocalIdentifier + tag: convert_server_user_changes_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.user.changes.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_server_user_changes_email_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.changes?.email != null + value: '{{{beyondtrust_epm.event.server.user.changes.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_server_user_changes_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.changes?.full_name != null + value: '{{{beyondtrust_epm.event.server.user.changes.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_server_user_changes_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.server?.user?.changes?.hash != null + value: '{{{beyondtrust_epm.event.server.user.changes.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_server_user_changes_name_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.changes?.name != null + value: '{{{beyondtrust_epm.event.server.user.changes.name}}}' + allow_duplicates: false + - set: + field: server.user.domain + tag: set_server_user_domain_from_event_server_user_domain + copy_from: beyondtrust_epm.event.server.user.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.server.user.effective.DefaultTimezoneOffset + tag: convert_server_user_effective_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.user.effective.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.server.user.effective.LocalIdentifier + tag: convert_server_user_effective_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.user.effective.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_server_user_effective_email_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.effective?.email != null + value: '{{{beyondtrust_epm.event.server.user.effective.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_server_user_effective_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.effective?.full_name != null + value: '{{{beyondtrust_epm.event.server.user.effective.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_server_user_effective_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.server?.user?.effective?.hash != null + value: '{{{beyondtrust_epm.event.server.user.effective.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_server_user_effective_id_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.effective?.id != null + value: '{{{beyondtrust_epm.event.server.user.effective.id}}}' + allow_duplicates: false + - set: + field: server.user.email + tag: set_server_user_email_from_event_server_user_email + copy_from: beyondtrust_epm.event.server.user.email + ignore_empty_value: true + - append: + field: related.user + tag: append_event_server_user_email_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.email != null + value: '{{{beyondtrust_epm.event.server.user.email}}}' + allow_duplicates: false + - set: + field: server.user.full_name + tag: set_server_user_full_name_from_event_server_user_full_name + copy_from: beyondtrust_epm.event.server.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_server_user_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.full_name != null + value: '{{{beyondtrust_epm.event.server.user.full_name}}}' + allow_duplicates: false + - set: + field: server.user.group.domain + tag: set_server_user_group_domain_from_event_server_user_group_domain + copy_from: beyondtrust_epm.event.server.user.group.domain + ignore_empty_value: true + - set: + field: server.user.group.id + tag: set_server_user_group_id_from_event_server_user_group_id + copy_from: beyondtrust_epm.event.server.user.group.id + ignore_empty_value: true + - set: + field: server.user.group.name + tag: set_server_user_group_name_from_event_server_user_group_name + copy_from: beyondtrust_epm.event.server.user.group.name + ignore_empty_value: true + - set: + field: server.user.hash + tag: set_server_user_hash_from_event_server_user_hash + copy_from: beyondtrust_epm.event.server.user.hash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_server_user_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.server?.user?.hash != null + value: '{{{beyondtrust_epm.event.server.user.hash}}}' + allow_duplicates: false + - set: + field: server.user.id + tag: set_server_user_id_from_event_server_user_id + copy_from: beyondtrust_epm.event.server.user.id + ignore_empty_value: true + - append: + field: related.user + tag: append_event_server_user_id_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.id != null + value: '{{{beyondtrust_epm.event.server.user.id}}}' + allow_duplicates: false + - set: + field: server.user.name + tag: set_server_user_name_from_event_server_user_name + copy_from: beyondtrust_epm.event.server.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_server_user_name_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.name != null + value: '{{{beyondtrust_epm.event.server.user.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.server.user.roles + tag: foreach_server_user_roles + if: ctx.beyondtrust_epm?.event?.server?.user?.roles instanceof List + processor: + append: + field: server.user.roles + tag: append_server_user_roles_into_server_user_roles + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.server.user.target.DefaultTimezoneOffset + tag: convert_server_user_target_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.user.target.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.server.user.target.LocalIdentifier + tag: convert_server_user_target_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.server.user.target.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_server_user_target_email_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.target?.email != null + value: '{{{beyondtrust_epm.event.server.user.target.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_server_user_target_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.target?.full_name != null + value: '{{{beyondtrust_epm.event.server.user.target.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_server_user_target_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.server?.user?.target?.hash != null + value: '{{{beyondtrust_epm.event.server.user.target.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_server_user_target_id_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.target?.id != null + value: '{{{beyondtrust_epm.event.server.user.target.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_server_user_target_name_into_related_user + if: ctx.beyondtrust_epm?.event?.server?.user?.target?.name != null + value: '{{{beyondtrust_epm.event.server.user.target.name}}}' + allow_duplicates: false + - set: + field: source.address + tag: set_source_address_from_event_source_address + copy_from: beyondtrust_epm.event.source.address + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.as.number + tag: convert_source_as_number_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.as.number + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.as.number + tag: set_source_as_number_from_event_source_as_number + copy_from: beyondtrust_epm.event.source.as.number + ignore_empty_value: true + - set: + field: source.as.organization.name + tag: set_source_as_organization_name_from_event_source_as_organization_name + copy_from: beyondtrust_epm.event.source.as.organization.name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.bytes + tag: convert_source_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.bytes + tag: set_source_bytes_from_event_source_bytes + copy_from: beyondtrust_epm.event.source.bytes + ignore_empty_value: true + - set: + field: source.domain + tag: set_source_domain_from_event_source_domain + copy_from: beyondtrust_epm.event.source.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.geo.TimezoneOffset + tag: convert_source_geo_TimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.geo.TimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.geo.city_name + tag: set_source_geo_city_name_from_event_source_geo_city_name + copy_from: beyondtrust_epm.event.source.geo.city_name + ignore_empty_value: true + - set: + field: source.geo.continent_code + tag: set_source_geo_continent_code_from_event_source_geo_continent_code + copy_from: beyondtrust_epm.event.source.geo.continent_code + ignore_empty_value: true + - set: + field: source.geo.continent_name + tag: set_source_geo_continent_name_from_event_source_geo_continent_name + copy_from: beyondtrust_epm.event.source.geo.continent_name + ignore_empty_value: true + - set: + field: source.geo.country_iso_code + tag: set_source_geo_country_iso_code_from_event_source_geo_country_iso_code + copy_from: beyondtrust_epm.event.source.geo.country_iso_code + ignore_empty_value: true + - set: + field: source.geo.country_name + tag: set_source_geo_country_name_from_event_source_geo_country_name + copy_from: beyondtrust_epm.event.source.geo.country_name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.geo.location.lat + tag: convert_source_geo_location_lat_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.geo.location.lat + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.source.geo.location.lon + tag: convert_source_geo_location_lon_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.geo.location.lon + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: set_source_geo_location_from_lat_lon + lang: painless + description: Combine lat/lon into geo_point. + if: >- + ctx.beyondtrust_epm?.event?.source?.geo?.location?.lat != null + && ctx.beyondtrust_epm?.event?.source?.geo?.location?.lon != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.beyondtrust_epm.event.source.geo.location.lat); + location.put('lon', ctx.beyondtrust_epm.event.source.geo.location.lon); + ctx.beyondtrust_epm.event.source.geo.location = location; + - set: + field: source.geo.location + tag: set_source_geo_location_from_event + copy_from: beyondtrust_epm.event.source.geo.location + ignore_empty_value: true + - set: + field: source.geo.name + tag: set_source_geo_name_from_event_source_geo_name + copy_from: beyondtrust_epm.event.source.geo.name + ignore_empty_value: true + - set: + field: source.geo.postal_code + tag: set_source_geo_postal_code_from_event_source_geo_postal_code + copy_from: beyondtrust_epm.event.source.geo.postal_code + ignore_empty_value: true + - set: + field: source.geo.region_iso_code + tag: set_source_geo_region_iso_code_from_event_source_geo_region_iso_code + copy_from: beyondtrust_epm.event.source.geo.region_iso_code + ignore_empty_value: true + - set: + field: source.geo.region_name + tag: set_source_geo_region_name_from_event_source_geo_region_name + copy_from: beyondtrust_epm.event.source.geo.region_name + ignore_empty_value: true + - set: + field: source.geo.timezone + tag: set_source_geo_timezone_from_event_source_geo_timezone + copy_from: beyondtrust_epm.event.source.geo.timezone + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.ip + tag: convert_source_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.source?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.source.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.ip + tag: set_source_ip_from_event_source_ip + copy_from: beyondtrust_epm.event.source.ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_source_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.source?.ip != null + value: '{{{beyondtrust_epm.event.source.ip}}}' + allow_duplicates: false + - gsub: + field: beyondtrust_epm.event.source.mac + pattern: '[:.]' + replacement: '-' + tag: gsub_source_mac + ignore_missing: true + - uppercase: + field: beyondtrust_epm.event.source.mac + tag: uppercase_source_mac + ignore_missing: true + - set: + field: source.mac + tag: set_source_mac_from_event_source_mac + copy_from: beyondtrust_epm.event.source.mac + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.nat.ip + tag: convert_source_nat_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.source?.nat?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.source.nat.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.nat.ip + tag: set_source_nat_ip_from_event_source_nat_ip + copy_from: beyondtrust_epm.event.source.nat.ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_source_nat_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.source?.nat?.ip != null + value: '{{{beyondtrust_epm.event.source.nat.ip}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.source.nat.port + tag: convert_source_nat_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.nat.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.nat.port + tag: set_source_nat_port_from_event_source_nat_port + copy_from: beyondtrust_epm.event.source.nat.port + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.packets + tag: convert_source_packets_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.packets + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.packets + tag: set_source_packets_from_event_source_packets + copy_from: beyondtrust_epm.event.source.packets + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.port + tag: convert_source_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.port + tag: set_source_port_from_event_source_port + copy_from: beyondtrust_epm.event.source.port + ignore_empty_value: true + - set: + field: source.registered_domain + tag: set_source_registered_domain_from_event_source_registered_domain + copy_from: beyondtrust_epm.event.source.registered_domain + ignore_empty_value: true + - set: + field: source.subdomain + tag: set_source_subdomain_from_event_source_subdomain + copy_from: beyondtrust_epm.event.source.subdomain + ignore_empty_value: true + - set: + field: source.top_level_domain + tag: set_source_top_level_domain_from_event_source_top_level_domain + copy_from: beyondtrust_epm.event.source.top_level_domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.user.DefaultTimezoneOffset + tag: convert_source_user_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.user.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.source.user.LocalIdentifier + tag: convert_source_user_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.user.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.source.user.changes.DefaultTimezoneOffset + tag: convert_source_user_changes_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.user.changes.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.source.user.changes.LocalIdentifier + tag: convert_source_user_changes_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.user.changes.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_source_user_changes_email_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.changes?.email != null + value: '{{{beyondtrust_epm.event.source.user.changes.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_source_user_changes_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.changes?.full_name != null + value: '{{{beyondtrust_epm.event.source.user.changes.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_source_user_changes_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.source?.user?.changes?.hash != null + value: '{{{beyondtrust_epm.event.source.user.changes.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_source_user_changes_name_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.changes?.name != null + value: '{{{beyondtrust_epm.event.source.user.changes.name}}}' + allow_duplicates: false + - set: + field: source.user.domain + tag: set_source_user_domain_from_event_source_user_domain + copy_from: beyondtrust_epm.event.source.user.domain + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.source.user.effective.DefaultTimezoneOffset + tag: convert_source_user_effective_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.user.effective.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.source.user.effective.LocalIdentifier + tag: convert_source_user_effective_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.user.effective.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_source_user_effective_email_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.effective?.email != null + value: '{{{beyondtrust_epm.event.source.user.effective.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_source_user_effective_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.effective?.full_name != null + value: '{{{beyondtrust_epm.event.source.user.effective.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_source_user_effective_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.source?.user?.effective?.hash != null + value: '{{{beyondtrust_epm.event.source.user.effective.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_source_user_effective_id_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.effective?.id != null + value: '{{{beyondtrust_epm.event.source.user.effective.id}}}' + allow_duplicates: false + - set: + field: source.user.email + tag: set_source_user_email_from_event_source_user_email + copy_from: beyondtrust_epm.event.source.user.email + ignore_empty_value: true + - append: + field: related.user + tag: append_event_source_user_email_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.email != null + value: '{{{beyondtrust_epm.event.source.user.email}}}' + allow_duplicates: false + - set: + field: source.user.full_name + tag: set_source_user_full_name_from_event_source_user_full_name + copy_from: beyondtrust_epm.event.source.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_source_user_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.full_name != null + value: '{{{beyondtrust_epm.event.source.user.full_name}}}' + allow_duplicates: false + - set: + field: source.user.group.domain + tag: set_source_user_group_domain_from_event_source_user_group_domain + copy_from: beyondtrust_epm.event.source.user.group.domain + ignore_empty_value: true + - set: + field: source.user.group.id + tag: set_source_user_group_id_from_event_source_user_group_id + copy_from: beyondtrust_epm.event.source.user.group.id + ignore_empty_value: true + - set: + field: source.user.group.name + tag: set_source_user_group_name_from_event_source_user_group_name + copy_from: beyondtrust_epm.event.source.user.group.name + ignore_empty_value: true + - set: + field: source.user.hash + tag: set_source_user_hash_from_event_source_user_hash + copy_from: beyondtrust_epm.event.source.user.hash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_source_user_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.source?.user?.hash != null + value: '{{{beyondtrust_epm.event.source.user.hash}}}' + allow_duplicates: false + - set: + field: source.user.id + tag: set_source_user_id_from_event_source_user_id + copy_from: beyondtrust_epm.event.source.user.id + ignore_empty_value: true + - append: + field: related.user + tag: append_event_source_user_id_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.id != null + value: '{{{beyondtrust_epm.event.source.user.id}}}' + allow_duplicates: false + - set: + field: source.user.name + tag: set_source_user_name_from_event_source_user_name + copy_from: beyondtrust_epm.event.source.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_source_user_name_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.name != null + value: '{{{beyondtrust_epm.event.source.user.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.source.user.roles + tag: foreach_source_user_roles + if: ctx.beyondtrust_epm?.event?.source?.user?.roles instanceof List + processor: + append: + field: source.user.roles + tag: append_source_user_roles_into_source_user_roles + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.source.user.target.DefaultTimezoneOffset + tag: convert_source_user_target_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.user.target.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.source.user.target.LocalIdentifier + tag: convert_source_user_target_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.source.user.target.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_source_user_target_email_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.target?.email != null + value: '{{{beyondtrust_epm.event.source.user.target.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_source_user_target_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.target?.full_name != null + value: '{{{beyondtrust_epm.event.source.user.target.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_source_user_target_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.source?.user?.target?.hash != null + value: '{{{beyondtrust_epm.event.source.user.target.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_source_user_target_id_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.target?.id != null + value: '{{{beyondtrust_epm.event.source.user.target.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_source_user_target_name_into_related_user + if: ctx.beyondtrust_epm?.event?.source?.user?.target?.name != null + value: '{{{beyondtrust_epm.event.source.user.target.name}}}' + allow_duplicates: false + - set: + field: tls.cipher + tag: set_tls_cipher_from_event_tls_cipher + copy_from: beyondtrust_epm.event.tls.cipher + ignore_empty_value: true + - set: + field: tls.client.certificate + tag: set_tls_client_certificate_from_event_tls_client_certificate + copy_from: beyondtrust_epm.event.tls.client.certificate + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.client.certificate_chain + tag: foreach_tls_client_certificate_chain + if: ctx.beyondtrust_epm?.event?.tls?.client?.certificate_chain instanceof List + processor: + append: + field: tls.client.certificate_chain + tag: append_tls_client_certificate_chain_into_tls_client_certificate_chain + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: tls.client.hash.md5 + tag: set_tls_client_hash_md5_from_event_tls_client_hash_md5 + copy_from: beyondtrust_epm.event.tls.client.hash.md5 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_tls_client_hash_md5_into_related_hash + if: ctx.beyondtrust_epm?.event?.tls?.client?.hash?.md5 != null + value: '{{{beyondtrust_epm.event.tls.client.hash.md5}}}' + allow_duplicates: false + - set: + field: tls.client.hash.sha1 + tag: set_tls_client_hash_sha1_from_event_tls_client_hash_sha1 + copy_from: beyondtrust_epm.event.tls.client.hash.sha1 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_tls_client_hash_sha1_into_related_hash + if: ctx.beyondtrust_epm?.event?.tls?.client?.hash?.sha1 != null + value: '{{{beyondtrust_epm.event.tls.client.hash.sha1}}}' + allow_duplicates: false + - set: + field: tls.client.hash.sha256 + tag: set_tls_client_hash_sha256_from_event_tls_client_hash_sha256 + copy_from: beyondtrust_epm.event.tls.client.hash.sha256 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_tls_client_hash_sha256_into_related_hash + if: ctx.beyondtrust_epm?.event?.tls?.client?.hash?.sha256 != null + value: '{{{beyondtrust_epm.event.tls.client.hash.sha256}}}' + allow_duplicates: false + - set: + field: tls.client.issuer + tag: set_tls_client_issuer_from_event_tls_client_issuer + copy_from: beyondtrust_epm.event.tls.client.issuer + ignore_empty_value: true + - set: + field: tls.client.ja3 + tag: set_tls_client_ja3_from_event_tls_client_ja3 + copy_from: beyondtrust_epm.event.tls.client.ja3 + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.tls.client.not_after + tag: date_tls_client_not_after + if: ctx.beyondtrust_epm?.event?.tls?.client?.not_after != null && ctx.beyondtrust_epm.event.tls.client.not_after != '' + target_field: beyondtrust_epm.event.tls.client.not_after + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.tls.client.not_after + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.client.not_after + tag: set_tls_client_not_after_from_event_tls_client_not_after + copy_from: beyondtrust_epm.event.tls.client.not_after + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.tls.client.not_before + tag: date_tls_client_not_before + if: ctx.beyondtrust_epm?.event?.tls?.client?.not_before != null && ctx.beyondtrust_epm.event.tls.client.not_before != '' + target_field: beyondtrust_epm.event.tls.client.not_before + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.tls.client.not_before + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.client.not_before + tag: set_tls_client_not_before_from_event_tls_client_not_before + copy_from: beyondtrust_epm.event.tls.client.not_before + ignore_empty_value: true + - set: + field: tls.client.server_name + tag: set_tls_client_server_name_from_event_tls_client_server_name + copy_from: beyondtrust_epm.event.tls.client.server_name + ignore_empty_value: true + - set: + field: tls.client.subject + tag: set_tls_client_subject_from_event_tls_client_subject + copy_from: beyondtrust_epm.event.tls.client.subject + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.client.supported_ciphers + tag: foreach_tls_client_supported_ciphers + if: ctx.beyondtrust_epm?.event?.tls?.client?.supported_ciphers instanceof List + processor: + append: + field: tls.client.supported_ciphers + tag: append_tls_client_supported_ciphers_into_tls_client_supported_ciphers + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.alternative_names + tag: foreach_tls_client_x509_alternative_names + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.alternative_names instanceof List + processor: + append: + field: tls.client.x509.alternative_names + tag: append_tls_client_x509_alternative_names_into_tls_client_x509_alternative_names + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.issuer.common_name + tag: foreach_tls_client_x509_issuer_common_name + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.issuer?.common_name instanceof List + processor: + append: + field: tls.client.x509.issuer.common_name + tag: append_tls_client_x509_issuer_common_name_into_tls_client_x509_issuer_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.issuer.country + tag: foreach_tls_client_x509_issuer_country + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.issuer?.country instanceof List + processor: + append: + field: tls.client.x509.issuer.country + tag: append_tls_client_x509_issuer_country_into_tls_client_x509_issuer_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: tls.client.x509.issuer.distinguished_name + tag: set_tls_client_x509_issuer_distinguished_name_from_event_tls_client_x509_issuer_distinguished_name + copy_from: beyondtrust_epm.event.tls.client.x509.issuer.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.client.x509.issuer.locality + tag: foreach_tls_client_x509_issuer_locality + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.issuer?.locality instanceof List + processor: + append: + field: tls.client.x509.issuer.locality + tag: append_tls_client_x509_issuer_locality_into_tls_client_x509_issuer_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.issuer.organization + tag: foreach_tls_client_x509_issuer_organization + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.issuer?.organization instanceof List + processor: + append: + field: tls.client.x509.issuer.organization + tag: append_tls_client_x509_issuer_organization_into_tls_client_x509_issuer_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.issuer.organizational_unit + tag: foreach_tls_client_x509_issuer_organizational_unit + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.issuer?.organizational_unit instanceof List + processor: + append: + field: tls.client.x509.issuer.organizational_unit + tag: append_tls_client_x509_issuer_organizational_unit_into_tls_client_x509_issuer_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.issuer.state_or_province + tag: foreach_tls_client_x509_issuer_state_or_province + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.issuer?.state_or_province instanceof List + processor: + append: + field: tls.client.x509.issuer.state_or_province + tag: append_tls_client_x509_issuer_state_or_province_into_tls_client_x509_issuer_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - date: + field: beyondtrust_epm.event.tls.client.x509.not_after + tag: date_tls_client_x509_not_after + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.not_after != null && ctx.beyondtrust_epm.event.tls.client.x509.not_after != '' + target_field: beyondtrust_epm.event.tls.client.x509.not_after + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.tls.client.x509.not_after + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.client.x509.not_after + tag: set_tls_client_x509_not_after_from_event_tls_client_x509_not_after + copy_from: beyondtrust_epm.event.tls.client.x509.not_after + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.tls.client.x509.not_before + tag: date_tls_client_x509_not_before + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.not_before != null && ctx.beyondtrust_epm.event.tls.client.x509.not_before != '' + target_field: beyondtrust_epm.event.tls.client.x509.not_before + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.tls.client.x509.not_before + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.client.x509.not_before + tag: set_tls_client_x509_not_before_from_event_tls_client_x509_not_before + copy_from: beyondtrust_epm.event.tls.client.x509.not_before + ignore_empty_value: true + - set: + field: tls.client.x509.public_key_algorithm + tag: set_tls_client_x509_public_key_algorithm_from_event_tls_client_x509_public_key_algorithm + copy_from: beyondtrust_epm.event.tls.client.x509.public_key_algorithm + ignore_empty_value: true + - set: + field: tls.client.x509.public_key_curve + tag: set_tls_client_x509_public_key_curve_from_event_tls_client_x509_public_key_curve + copy_from: beyondtrust_epm.event.tls.client.x509.public_key_curve + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.tls.client.x509.public_key_exponent + tag: convert_tls_client_x509_public_key_exponent_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.tls.client.x509.public_key_exponent + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.client.x509.public_key_exponent + tag: set_tls_client_x509_public_key_exponent_from_event_tls_client_x509_public_key_exponent + copy_from: beyondtrust_epm.event.tls.client.x509.public_key_exponent + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.tls.client.x509.public_key_size + tag: convert_tls_client_x509_public_key_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.tls.client.x509.public_key_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.client.x509.public_key_size + tag: set_tls_client_x509_public_key_size_from_event_tls_client_x509_public_key_size + copy_from: beyondtrust_epm.event.tls.client.x509.public_key_size + ignore_empty_value: true + - set: + field: tls.client.x509.serial_number + tag: set_tls_client_x509_serial_number_from_event_tls_client_x509_serial_number + copy_from: beyondtrust_epm.event.tls.client.x509.serial_number + ignore_empty_value: true + - set: + field: tls.client.x509.signature_algorithm + tag: set_tls_client_x509_signature_algorithm_from_event_tls_client_x509_signature_algorithm + copy_from: beyondtrust_epm.event.tls.client.x509.signature_algorithm + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.client.x509.subject.common_name + tag: foreach_tls_client_x509_subject_common_name + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.subject?.common_name instanceof List + processor: + append: + field: tls.client.x509.subject.common_name + tag: append_tls_client_x509_subject_common_name_into_tls_client_x509_subject_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.subject.country + tag: foreach_tls_client_x509_subject_country + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.subject?.country instanceof List + processor: + append: + field: tls.client.x509.subject.country + tag: append_tls_client_x509_subject_country_into_tls_client_x509_subject_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: tls.client.x509.subject.distinguished_name + tag: set_tls_client_x509_subject_distinguished_name_from_event_tls_client_x509_subject_distinguished_name + copy_from: beyondtrust_epm.event.tls.client.x509.subject.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.client.x509.subject.locality + tag: foreach_tls_client_x509_subject_locality + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.subject?.locality instanceof List + processor: + append: + field: tls.client.x509.subject.locality + tag: append_tls_client_x509_subject_locality_into_tls_client_x509_subject_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.subject.organization + tag: foreach_tls_client_x509_subject_organization + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.subject?.organization instanceof List + processor: + append: + field: tls.client.x509.subject.organization + tag: append_tls_client_x509_subject_organization_into_tls_client_x509_subject_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.subject.organizational_unit + tag: foreach_tls_client_x509_subject_organizational_unit + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.subject?.organizational_unit instanceof List + processor: + append: + field: tls.client.x509.subject.organizational_unit + tag: append_tls_client_x509_subject_organizational_unit_into_tls_client_x509_subject_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.client.x509.subject.state_or_province + tag: foreach_tls_client_x509_subject_state_or_province + if: ctx.beyondtrust_epm?.event?.tls?.client?.x509?.subject?.state_or_province instanceof List + processor: + append: + field: tls.client.x509.subject.state_or_province + tag: append_tls_client_x509_subject_state_or_province_into_tls_client_x509_subject_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: tls.client.x509.version_number + tag: set_tls_client_x509_version_number_from_event_tls_client_x509_version_number + copy_from: beyondtrust_epm.event.tls.client.x509.version_number + ignore_empty_value: true + - set: + field: tls.curve + tag: set_tls_curve_from_event_tls_curve + copy_from: beyondtrust_epm.event.tls.curve + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.tls.established + tag: convert_tls_established_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.tls.established + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.established + tag: set_tls_established_from_event_tls_established + copy_from: beyondtrust_epm.event.tls.established + ignore_empty_value: true + - set: + field: tls.next_protocol + tag: set_tls_next_protocol_from_event_tls_next_protocol + copy_from: beyondtrust_epm.event.tls.next_protocol + ignore_empty_value: true + - lowercase: + field: tls.next_protocol + tag: lowercase_tls_next_protocol + ignore_missing: true + - convert: + field: beyondtrust_epm.event.tls.resumed + tag: convert_tls_resumed_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.tls.resumed + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.resumed + tag: set_tls_resumed_from_event_tls_resumed + copy_from: beyondtrust_epm.event.tls.resumed + ignore_empty_value: true + - set: + field: tls.server.certificate + tag: set_tls_server_certificate_from_event_tls_server_certificate + copy_from: beyondtrust_epm.event.tls.server.certificate + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.server.certificate_chain + tag: foreach_tls_server_certificate_chain + if: ctx.beyondtrust_epm?.event?.tls?.server?.certificate_chain instanceof List + processor: + append: + field: tls.server.certificate_chain + tag: append_tls_server_certificate_chain_into_tls_server_certificate_chain + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: tls.server.hash.md5 + tag: set_tls_server_hash_md5_from_event_tls_server_hash_md5 + copy_from: beyondtrust_epm.event.tls.server.hash.md5 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_tls_server_hash_md5_into_related_hash + if: ctx.beyondtrust_epm?.event?.tls?.server?.hash?.md5 != null + value: '{{{beyondtrust_epm.event.tls.server.hash.md5}}}' + allow_duplicates: false + - set: + field: tls.server.hash.sha1 + tag: set_tls_server_hash_sha1_from_event_tls_server_hash_sha1 + copy_from: beyondtrust_epm.event.tls.server.hash.sha1 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_tls_server_hash_sha1_into_related_hash + if: ctx.beyondtrust_epm?.event?.tls?.server?.hash?.sha1 != null + value: '{{{beyondtrust_epm.event.tls.server.hash.sha1}}}' + allow_duplicates: false + - set: + field: tls.server.hash.sha256 + tag: set_tls_server_hash_sha256_from_event_tls_server_hash_sha256 + copy_from: beyondtrust_epm.event.tls.server.hash.sha256 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_tls_server_hash_sha256_into_related_hash + if: ctx.beyondtrust_epm?.event?.tls?.server?.hash?.sha256 != null + value: '{{{beyondtrust_epm.event.tls.server.hash.sha256}}}' + allow_duplicates: false + - set: + field: tls.server.issuer + tag: set_tls_server_issuer_from_event_tls_server_issuer + copy_from: beyondtrust_epm.event.tls.server.issuer + ignore_empty_value: true + - set: + field: tls.server.ja3s + tag: set_tls_server_ja3s_from_event_tls_server_ja3s + copy_from: beyondtrust_epm.event.tls.server.ja3s + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.tls.server.not_after + tag: date_tls_server_not_after + if: ctx.beyondtrust_epm?.event?.tls?.server?.not_after != null && ctx.beyondtrust_epm.event.tls.server.not_after != '' + target_field: beyondtrust_epm.event.tls.server.not_after + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.tls.server.not_after + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.server.not_after + tag: set_tls_server_not_after_from_event_tls_server_not_after + copy_from: beyondtrust_epm.event.tls.server.not_after + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.tls.server.not_before + tag: date_tls_server_not_before + if: ctx.beyondtrust_epm?.event?.tls?.server?.not_before != null && ctx.beyondtrust_epm.event.tls.server.not_before != '' + target_field: beyondtrust_epm.event.tls.server.not_before + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.tls.server.not_before + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.server.not_before + tag: set_tls_server_not_before_from_event_tls_server_not_before + copy_from: beyondtrust_epm.event.tls.server.not_before + ignore_empty_value: true + - set: + field: tls.server.subject + tag: set_tls_server_subject_from_event_tls_server_subject + copy_from: beyondtrust_epm.event.tls.server.subject + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.server.x509.alternative_names + tag: foreach_tls_server_x509_alternative_names + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.alternative_names instanceof List + processor: + append: + field: tls.server.x509.alternative_names + tag: append_tls_server_x509_alternative_names_into_tls_server_x509_alternative_names + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.server.x509.issuer.common_name + tag: foreach_tls_server_x509_issuer_common_name + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.issuer?.common_name instanceof List + processor: + append: + field: tls.server.x509.issuer.common_name + tag: append_tls_server_x509_issuer_common_name_into_tls_server_x509_issuer_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.server.x509.issuer.country + tag: foreach_tls_server_x509_issuer_country + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.issuer?.country instanceof List + processor: + append: + field: tls.server.x509.issuer.country + tag: append_tls_server_x509_issuer_country_into_tls_server_x509_issuer_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: tls.server.x509.issuer.distinguished_name + tag: set_tls_server_x509_issuer_distinguished_name_from_event_tls_server_x509_issuer_distinguished_name + copy_from: beyondtrust_epm.event.tls.server.x509.issuer.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.server.x509.issuer.locality + tag: foreach_tls_server_x509_issuer_locality + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.issuer?.locality instanceof List + processor: + append: + field: tls.server.x509.issuer.locality + tag: append_tls_server_x509_issuer_locality_into_tls_server_x509_issuer_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.server.x509.issuer.organization + tag: foreach_tls_server_x509_issuer_organization + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.issuer?.organization instanceof List + processor: + append: + field: tls.server.x509.issuer.organization + tag: append_tls_server_x509_issuer_organization_into_tls_server_x509_issuer_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.server.x509.issuer.organizational_unit + tag: foreach_tls_server_x509_issuer_organizational_unit + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.issuer?.organizational_unit instanceof List + processor: + append: + field: tls.server.x509.issuer.organizational_unit + tag: append_tls_server_x509_issuer_organizational_unit_into_tls_server_x509_issuer_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.server.x509.issuer.state_or_province + tag: foreach_tls_server_x509_issuer_state_or_province + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.issuer?.state_or_province instanceof List + processor: + append: + field: tls.server.x509.issuer.state_or_province + tag: append_tls_server_x509_issuer_state_or_province_into_tls_server_x509_issuer_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - date: + field: beyondtrust_epm.event.tls.server.x509.not_after + tag: date_tls_server_x509_not_after + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.not_after != null && ctx.beyondtrust_epm.event.tls.server.x509.not_after != '' + target_field: beyondtrust_epm.event.tls.server.x509.not_after + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.tls.server.x509.not_after + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.server.x509.not_after + tag: set_tls_server_x509_not_after_from_event_tls_server_x509_not_after + copy_from: beyondtrust_epm.event.tls.server.x509.not_after + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.tls.server.x509.not_before + tag: date_tls_server_x509_not_before + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.not_before != null && ctx.beyondtrust_epm.event.tls.server.x509.not_before != '' + target_field: beyondtrust_epm.event.tls.server.x509.not_before + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.tls.server.x509.not_before + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.server.x509.not_before + tag: set_tls_server_x509_not_before_from_event_tls_server_x509_not_before + copy_from: beyondtrust_epm.event.tls.server.x509.not_before + ignore_empty_value: true + - set: + field: tls.server.x509.public_key_algorithm + tag: set_tls_server_x509_public_key_algorithm_from_event_tls_server_x509_public_key_algorithm + copy_from: beyondtrust_epm.event.tls.server.x509.public_key_algorithm + ignore_empty_value: true + - set: + field: tls.server.x509.public_key_curve + tag: set_tls_server_x509_public_key_curve_from_event_tls_server_x509_public_key_curve + copy_from: beyondtrust_epm.event.tls.server.x509.public_key_curve + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.tls.server.x509.public_key_exponent + tag: convert_tls_server_x509_public_key_exponent_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.tls.server.x509.public_key_exponent + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.server.x509.public_key_exponent + tag: set_tls_server_x509_public_key_exponent_from_event_tls_server_x509_public_key_exponent + copy_from: beyondtrust_epm.event.tls.server.x509.public_key_exponent + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.tls.server.x509.public_key_size + tag: convert_tls_server_x509_public_key_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.tls.server.x509.public_key_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.server.x509.public_key_size + tag: set_tls_server_x509_public_key_size_from_event_tls_server_x509_public_key_size + copy_from: beyondtrust_epm.event.tls.server.x509.public_key_size + ignore_empty_value: true + - set: + field: tls.server.x509.serial_number + tag: set_tls_server_x509_serial_number_from_event_tls_server_x509_serial_number + copy_from: beyondtrust_epm.event.tls.server.x509.serial_number + ignore_empty_value: true + - set: + field: tls.server.x509.signature_algorithm + tag: set_tls_server_x509_signature_algorithm_from_event_tls_server_x509_signature_algorithm + copy_from: beyondtrust_epm.event.tls.server.x509.signature_algorithm + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.server.x509.subject.common_name + tag: foreach_tls_server_x509_subject_common_name + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.subject?.common_name instanceof List + processor: + append: + field: tls.server.x509.subject.common_name + tag: append_tls_server_x509_subject_common_name_into_tls_server_x509_subject_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.server.x509.subject.country + tag: foreach_tls_server_x509_subject_country + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.subject?.country instanceof List + processor: + append: + field: tls.server.x509.subject.country + tag: append_tls_server_x509_subject_country_into_tls_server_x509_subject_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: tls.server.x509.subject.distinguished_name + tag: set_tls_server_x509_subject_distinguished_name_from_event_tls_server_x509_subject_distinguished_name + copy_from: beyondtrust_epm.event.tls.server.x509.subject.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.tls.server.x509.subject.locality + tag: foreach_tls_server_x509_subject_locality + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.subject?.locality instanceof List + processor: + append: + field: tls.server.x509.subject.locality + tag: append_tls_server_x509_subject_locality_into_tls_server_x509_subject_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.server.x509.subject.organization + tag: foreach_tls_server_x509_subject_organization + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.subject?.organization instanceof List + processor: + append: + field: tls.server.x509.subject.organization + tag: append_tls_server_x509_subject_organization_into_tls_server_x509_subject_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.server.x509.subject.organizational_unit + tag: foreach_tls_server_x509_subject_organizational_unit + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.subject?.organizational_unit instanceof List + processor: + append: + field: tls.server.x509.subject.organizational_unit + tag: append_tls_server_x509_subject_organizational_unit_into_tls_server_x509_subject_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.tls.server.x509.subject.state_or_province + tag: foreach_tls_server_x509_subject_state_or_province + if: ctx.beyondtrust_epm?.event?.tls?.server?.x509?.subject?.state_or_province instanceof List + processor: + append: + field: tls.server.x509.subject.state_or_province + tag: append_tls_server_x509_subject_state_or_province_into_tls_server_x509_subject_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: tls.server.x509.version_number + tag: set_tls_server_x509_version_number_from_event_tls_server_x509_version_number + copy_from: beyondtrust_epm.event.tls.server.x509.version_number + ignore_empty_value: true + - set: + field: tls.version + tag: set_tls_version_from_event_tls_version + copy_from: beyondtrust_epm.event.tls.version + ignore_empty_value: true + - set: + field: tls.version_protocol + tag: set_tls_version_protocol_from_event_tls_version_protocol + copy_from: beyondtrust_epm.event.tls.version_protocol + ignore_empty_value: true + - lowercase: + field: tls.version_protocol + tag: lowercase_tls_version_protocol + ignore_missing: true + - set: + field: url.domain + tag: set_url_domain_from_event_url_domain + copy_from: beyondtrust_epm.event.url.domain + ignore_empty_value: true + - set: + field: url.extension + tag: set_url_extension_from_event_url_extension + copy_from: beyondtrust_epm.event.url.extension + ignore_empty_value: true + - set: + field: url.fragment + tag: set_url_fragment_from_event_url_fragment + copy_from: beyondtrust_epm.event.url.fragment + ignore_empty_value: true + - set: + field: url.full + tag: set_url_full_from_event_url_full + copy_from: beyondtrust_epm.event.url.full + ignore_empty_value: true + - set: + field: url.original + tag: set_url_original_from_event_url_original + copy_from: beyondtrust_epm.event.url.original + ignore_empty_value: true + - set: + field: url.password + tag: set_url_password_from_event_url_password + copy_from: beyondtrust_epm.event.url.password + ignore_empty_value: true + - set: + field: url.path + tag: set_url_path_from_event_url_path + copy_from: beyondtrust_epm.event.url.path + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.url.port + tag: convert_url_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.url.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: url.port + tag: set_url_port_from_event_url_port + copy_from: beyondtrust_epm.event.url.port + ignore_empty_value: true + - set: + field: url.query + tag: set_url_query_from_event_url_query + copy_from: beyondtrust_epm.event.url.query + ignore_empty_value: true + - set: + field: url.registered_domain + tag: set_url_registered_domain_from_event_url_registered_domain + copy_from: beyondtrust_epm.event.url.registered_domain + ignore_empty_value: true + - set: + field: url.scheme + tag: set_url_scheme_from_event_url_scheme + copy_from: beyondtrust_epm.event.url.scheme + ignore_empty_value: true + - set: + field: url.subdomain + tag: set_url_subdomain_from_event_url_subdomain + copy_from: beyondtrust_epm.event.url.subdomain + ignore_empty_value: true + - set: + field: url.top_level_domain + tag: set_url_top_level_domain_from_event_url_top_level_domain + copy_from: beyondtrust_epm.event.url.top_level_domain + ignore_empty_value: true + - set: + field: url.username + tag: set_url_username_from_event_url_username + copy_from: beyondtrust_epm.event.url.username + ignore_empty_value: true + - append: + field: related.user + tag: append_event_url_username_into_related_user + if: ctx.beyondtrust_epm?.event?.url?.username != null + value: '{{{beyondtrust_epm.event.url.username}}}' + allow_duplicates: false + - append: + field: related.hosts + tag: append_event_client_Name_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.Name != null + value: '{{{beyondtrust_epm.event.client.Name}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_client_user_DomainIdentifier_into_related_user + if: ctx.beyondtrust_epm?.event?.client?.user?.DomainIdentifier != null + value: '{{{beyondtrust_epm.event.client.user.DomainIdentifier}}}' + allow_duplicates: false + - remove: + field: + - beyondtrust_epm.event.client.address + - beyondtrust_epm.event.client.as.number + - beyondtrust_epm.event.client.as.organization.name + - beyondtrust_epm.event.client.bytes + - beyondtrust_epm.event.client.domain + - beyondtrust_epm.event.client.geo.city_name + - beyondtrust_epm.event.client.geo.continent_code + - beyondtrust_epm.event.client.geo.continent_name + - beyondtrust_epm.event.client.geo.country_iso_code + - beyondtrust_epm.event.client.geo.country_name + - beyondtrust_epm.event.client.geo.name + - beyondtrust_epm.event.client.geo.postal_code + - beyondtrust_epm.event.client.geo.region_iso_code + - beyondtrust_epm.event.client.geo.region_name + - beyondtrust_epm.event.client.geo.timezone + - beyondtrust_epm.event.client.ip + - beyondtrust_epm.event.client.mac + - beyondtrust_epm.event.client.nat.ip + - beyondtrust_epm.event.client.nat.port + - beyondtrust_epm.event.client.packets + - beyondtrust_epm.event.client.port + - beyondtrust_epm.event.client.registered_domain + - beyondtrust_epm.event.client.subdomain + - beyondtrust_epm.event.client.top_level_domain + - beyondtrust_epm.event.client.user.domain + - beyondtrust_epm.event.client.user.email + - beyondtrust_epm.event.client.user.full_name + - beyondtrust_epm.event.client.user.group.domain + - beyondtrust_epm.event.client.user.group.id + - beyondtrust_epm.event.client.user.group.name + - beyondtrust_epm.event.client.user.hash + - beyondtrust_epm.event.client.user.id + - beyondtrust_epm.event.client.user.name + - beyondtrust_epm.event.client.user.roles + - beyondtrust_epm.event.destination.address + - beyondtrust_epm.event.destination.as.number + - beyondtrust_epm.event.destination.as.organization.name + - beyondtrust_epm.event.destination.bytes + - beyondtrust_epm.event.destination.domain + - beyondtrust_epm.event.destination.geo.city_name + - beyondtrust_epm.event.destination.geo.continent_code + - beyondtrust_epm.event.destination.geo.continent_name + - beyondtrust_epm.event.destination.geo.country_iso_code + - beyondtrust_epm.event.destination.geo.country_name + - beyondtrust_epm.event.destination.geo.name + - beyondtrust_epm.event.destination.geo.postal_code + - beyondtrust_epm.event.destination.geo.region_iso_code + - beyondtrust_epm.event.destination.geo.region_name + - beyondtrust_epm.event.destination.geo.timezone + - beyondtrust_epm.event.destination.ip + - beyondtrust_epm.event.destination.mac + - beyondtrust_epm.event.destination.nat.ip + - beyondtrust_epm.event.destination.nat.port + - beyondtrust_epm.event.destination.packets + - beyondtrust_epm.event.destination.port + - beyondtrust_epm.event.destination.registered_domain + - beyondtrust_epm.event.destination.subdomain + - beyondtrust_epm.event.destination.top_level_domain + - beyondtrust_epm.event.destination.user.domain + - beyondtrust_epm.event.destination.user.email + - beyondtrust_epm.event.destination.user.full_name + - beyondtrust_epm.event.destination.user.group.domain + - beyondtrust_epm.event.destination.user.group.id + - beyondtrust_epm.event.destination.user.group.name + - beyondtrust_epm.event.destination.user.hash + - beyondtrust_epm.event.destination.user.id + - beyondtrust_epm.event.destination.user.name + - beyondtrust_epm.event.destination.user.roles + - beyondtrust_epm.event.dns.header_flags + - beyondtrust_epm.event.dns.id + - beyondtrust_epm.event.dns.op_code + - beyondtrust_epm.event.dns.question.class + - beyondtrust_epm.event.dns.question.name + - beyondtrust_epm.event.dns.question.registered_domain + - beyondtrust_epm.event.dns.question.subdomain + - beyondtrust_epm.event.dns.question.top_level_domain + - beyondtrust_epm.event.dns.question.type + - beyondtrust_epm.event.dns.resolved_ip + - beyondtrust_epm.event.dns.response_code + - beyondtrust_epm.event.dns.type + - beyondtrust_epm.event.http.request.body.bytes + - beyondtrust_epm.event.http.request.body.content + - beyondtrust_epm.event.http.request.bytes + - beyondtrust_epm.event.http.request.id + - beyondtrust_epm.event.http.request.method + - beyondtrust_epm.event.http.request.mime_type + - beyondtrust_epm.event.http.request.referrer + - beyondtrust_epm.event.http.response.body.bytes + - beyondtrust_epm.event.http.response.body.content + - beyondtrust_epm.event.http.response.bytes + - beyondtrust_epm.event.http.response.mime_type + - beyondtrust_epm.event.http.response.status_code + - beyondtrust_epm.event.http.version + - beyondtrust_epm.event.network.application + - beyondtrust_epm.event.network.bytes + - beyondtrust_epm.event.network.community_id + - beyondtrust_epm.event.network.direction + - beyondtrust_epm.event.network.forwarded_ip + - beyondtrust_epm.event.network.iana_number + - beyondtrust_epm.event.network.name + - beyondtrust_epm.event.network.packets + - beyondtrust_epm.event.network.protocol + - beyondtrust_epm.event.network.transport + - beyondtrust_epm.event.network.type + - beyondtrust_epm.event.network.vlan.id + - beyondtrust_epm.event.network.vlan.name + - beyondtrust_epm.event.server.address + - beyondtrust_epm.event.server.as.number + - beyondtrust_epm.event.server.as.organization.name + - beyondtrust_epm.event.server.bytes + - beyondtrust_epm.event.server.domain + - beyondtrust_epm.event.server.geo.city_name + - beyondtrust_epm.event.server.geo.continent_code + - beyondtrust_epm.event.server.geo.continent_name + - beyondtrust_epm.event.server.geo.country_iso_code + - beyondtrust_epm.event.server.geo.country_name + - beyondtrust_epm.event.server.geo.name + - beyondtrust_epm.event.server.geo.postal_code + - beyondtrust_epm.event.server.geo.region_iso_code + - beyondtrust_epm.event.server.geo.region_name + - beyondtrust_epm.event.server.geo.timezone + - beyondtrust_epm.event.server.ip + - beyondtrust_epm.event.server.mac + - beyondtrust_epm.event.server.nat.ip + - beyondtrust_epm.event.server.nat.port + - beyondtrust_epm.event.server.packets + - beyondtrust_epm.event.server.port + - beyondtrust_epm.event.server.registered_domain + - beyondtrust_epm.event.server.subdomain + - beyondtrust_epm.event.server.top_level_domain + - beyondtrust_epm.event.server.user.domain + - beyondtrust_epm.event.server.user.email + - beyondtrust_epm.event.server.user.full_name + - beyondtrust_epm.event.server.user.group.domain + - beyondtrust_epm.event.server.user.group.id + - beyondtrust_epm.event.server.user.group.name + - beyondtrust_epm.event.server.user.hash + - beyondtrust_epm.event.server.user.id + - beyondtrust_epm.event.server.user.name + - beyondtrust_epm.event.server.user.roles + - beyondtrust_epm.event.source.address + - beyondtrust_epm.event.source.as.number + - beyondtrust_epm.event.source.as.organization.name + - beyondtrust_epm.event.source.bytes + - beyondtrust_epm.event.source.domain + - beyondtrust_epm.event.source.geo.city_name + - beyondtrust_epm.event.source.geo.continent_code + - beyondtrust_epm.event.source.geo.continent_name + - beyondtrust_epm.event.source.geo.country_iso_code + - beyondtrust_epm.event.source.geo.country_name + - beyondtrust_epm.event.source.geo.name + - beyondtrust_epm.event.source.geo.postal_code + - beyondtrust_epm.event.source.geo.region_iso_code + - beyondtrust_epm.event.source.geo.region_name + - beyondtrust_epm.event.source.geo.timezone + - beyondtrust_epm.event.source.ip + - beyondtrust_epm.event.source.mac + - beyondtrust_epm.event.source.nat.ip + - beyondtrust_epm.event.source.nat.port + - beyondtrust_epm.event.source.packets + - beyondtrust_epm.event.source.port + - beyondtrust_epm.event.source.registered_domain + - beyondtrust_epm.event.source.subdomain + - beyondtrust_epm.event.source.top_level_domain + - beyondtrust_epm.event.source.user.domain + - beyondtrust_epm.event.source.user.email + - beyondtrust_epm.event.source.user.full_name + - beyondtrust_epm.event.source.user.group.domain + - beyondtrust_epm.event.source.user.group.id + - beyondtrust_epm.event.source.user.group.name + - beyondtrust_epm.event.source.user.hash + - beyondtrust_epm.event.source.user.id + - beyondtrust_epm.event.source.user.name + - beyondtrust_epm.event.source.user.roles + - beyondtrust_epm.event.tls.cipher + - beyondtrust_epm.event.tls.client.certificate + - beyondtrust_epm.event.tls.client.certificate_chain + - beyondtrust_epm.event.tls.client.hash.md5 + - beyondtrust_epm.event.tls.client.hash.sha1 + - beyondtrust_epm.event.tls.client.hash.sha256 + - beyondtrust_epm.event.tls.client.issuer + - beyondtrust_epm.event.tls.client.ja3 + - beyondtrust_epm.event.tls.client.not_after + - beyondtrust_epm.event.tls.client.not_before + - beyondtrust_epm.event.tls.client.server_name + - beyondtrust_epm.event.tls.client.subject + - beyondtrust_epm.event.tls.client.supported_ciphers + - beyondtrust_epm.event.tls.client.x509.alternative_names + - beyondtrust_epm.event.tls.client.x509.issuer.common_name + - beyondtrust_epm.event.tls.client.x509.issuer.country + - beyondtrust_epm.event.tls.client.x509.issuer.distinguished_name + - beyondtrust_epm.event.tls.client.x509.issuer.locality + - beyondtrust_epm.event.tls.client.x509.issuer.organization + - beyondtrust_epm.event.tls.client.x509.issuer.organizational_unit + - beyondtrust_epm.event.tls.client.x509.issuer.state_or_province + - beyondtrust_epm.event.tls.client.x509.not_after + - beyondtrust_epm.event.tls.client.x509.not_before + - beyondtrust_epm.event.tls.client.x509.public_key_algorithm + - beyondtrust_epm.event.tls.client.x509.public_key_curve + - beyondtrust_epm.event.tls.client.x509.public_key_exponent + - beyondtrust_epm.event.tls.client.x509.public_key_size + - beyondtrust_epm.event.tls.client.x509.serial_number + - beyondtrust_epm.event.tls.client.x509.signature_algorithm + - beyondtrust_epm.event.tls.client.x509.subject.common_name + - beyondtrust_epm.event.tls.client.x509.subject.country + - beyondtrust_epm.event.tls.client.x509.subject.distinguished_name + - beyondtrust_epm.event.tls.client.x509.subject.locality + - beyondtrust_epm.event.tls.client.x509.subject.organization + - beyondtrust_epm.event.tls.client.x509.subject.organizational_unit + - beyondtrust_epm.event.tls.client.x509.subject.state_or_province + - beyondtrust_epm.event.tls.client.x509.version_number + - beyondtrust_epm.event.tls.curve + - beyondtrust_epm.event.tls.established + - beyondtrust_epm.event.tls.next_protocol + - beyondtrust_epm.event.tls.resumed + - beyondtrust_epm.event.tls.server.certificate + - beyondtrust_epm.event.tls.server.certificate_chain + - beyondtrust_epm.event.tls.server.hash.md5 + - beyondtrust_epm.event.tls.server.hash.sha1 + - beyondtrust_epm.event.tls.server.hash.sha256 + - beyondtrust_epm.event.tls.server.issuer + - beyondtrust_epm.event.tls.server.ja3s + - beyondtrust_epm.event.tls.server.not_after + - beyondtrust_epm.event.tls.server.not_before + - beyondtrust_epm.event.tls.server.subject + - beyondtrust_epm.event.tls.server.x509.alternative_names + - beyondtrust_epm.event.tls.server.x509.issuer.common_name + - beyondtrust_epm.event.tls.server.x509.issuer.country + - beyondtrust_epm.event.tls.server.x509.issuer.distinguished_name + - beyondtrust_epm.event.tls.server.x509.issuer.locality + - beyondtrust_epm.event.tls.server.x509.issuer.organization + - beyondtrust_epm.event.tls.server.x509.issuer.organizational_unit + - beyondtrust_epm.event.tls.server.x509.issuer.state_or_province + - beyondtrust_epm.event.tls.server.x509.not_after + - beyondtrust_epm.event.tls.server.x509.not_before + - beyondtrust_epm.event.tls.server.x509.public_key_algorithm + - beyondtrust_epm.event.tls.server.x509.public_key_curve + - beyondtrust_epm.event.tls.server.x509.public_key_exponent + - beyondtrust_epm.event.tls.server.x509.public_key_size + - beyondtrust_epm.event.tls.server.x509.serial_number + - beyondtrust_epm.event.tls.server.x509.signature_algorithm + - beyondtrust_epm.event.tls.server.x509.subject.common_name + - beyondtrust_epm.event.tls.server.x509.subject.country + - beyondtrust_epm.event.tls.server.x509.subject.distinguished_name + - beyondtrust_epm.event.tls.server.x509.subject.locality + - beyondtrust_epm.event.tls.server.x509.subject.organization + - beyondtrust_epm.event.tls.server.x509.subject.organizational_unit + - beyondtrust_epm.event.tls.server.x509.subject.state_or_province + - beyondtrust_epm.event.tls.server.x509.version_number + - beyondtrust_epm.event.tls.version + - beyondtrust_epm.event.tls.version_protocol + - beyondtrust_epm.event.url.domain + - beyondtrust_epm.event.url.extension + - beyondtrust_epm.event.url.fragment + - beyondtrust_epm.event.url.full + - beyondtrust_epm.event.url.original + - beyondtrust_epm.event.url.password + - beyondtrust_epm.event.url.path + - beyondtrust_epm.event.url.port + - beyondtrust_epm.event.url.query + - beyondtrust_epm.event.url.registered_domain + - beyondtrust_epm.event.url.scheme + - beyondtrust_epm.event.url.subdomain + - beyondtrust_epm.event.url.top_level_domain + - beyondtrust_epm.event.url.username + tag: remove_fields_mapped_with_ecs + ignore_missing: true diff --git a/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-process.yml b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-process.yml new file mode 100644 index 00000000000..5107f5934ad --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-process.yml @@ -0,0 +1,1955 @@ +--- +description: Pipeline for processing process fields. +processors: + - rename: + field: beyondtrust_epm.event.process.HostedFile.owner + tag: rename_process_hosted_file_owner + target_field: beyondtrust_epm.event.process.HostedFile.OwnerKeyword + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.owner instanceof String + - convert: + field: beyondtrust_epm.event.process.ElevationRequired + tag: convert_process_ElevationRequired_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.ElevationRequired + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.event.process.HostedFile.accessed + tag: date_process_HostedFile_accessed + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.accessed != null && ctx.beyondtrust_epm.event.process.HostedFile.accessed != '' + target_field: beyondtrust_epm.event.process.HostedFile.accessed + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.accessed + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.HostedFile.code_signature.exists + tag: convert_process_HostedFile_code_signature_exists_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.code_signature.exists + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.event.process.HostedFile.code_signature.timestamp + tag: date_process_HostedFile_code_signature_timestamp + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.code_signature?.timestamp != null && ctx.beyondtrust_epm.event.process.HostedFile.code_signature.timestamp != '' + target_field: beyondtrust_epm.event.process.HostedFile.code_signature.timestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.code_signature.timestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.HostedFile.code_signature.trusted + tag: convert_process_HostedFile_code_signature_trusted_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.code_signature.trusted + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.HostedFile.code_signature.valid + tag: convert_process_HostedFile_code_signature_valid_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.code_signature.valid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.event.process.HostedFile.created + tag: date_process_HostedFile_created + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.created != null && ctx.beyondtrust_epm.event.process.HostedFile.created != '' + target_field: beyondtrust_epm.event.process.HostedFile.created + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.created + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.event.process.HostedFile.ctime + tag: date_process_HostedFile_ctime + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.ctime != null && ctx.beyondtrust_epm.event.process.HostedFile.ctime != '' + target_field: beyondtrust_epm.event.process.HostedFile.ctime + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.ctime + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.event.process.HostedFile.elf.creation_date + tag: date_process_HostedFile_elf_creation_date + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.elf?.creation_date != null && ctx.beyondtrust_epm.event.process.HostedFile.elf.creation_date != '' + target_field: beyondtrust_epm.event.process.HostedFile.elf.creation_date + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.elf.creation_date + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.HostedFile.elf.header.entrypoint + tag: convert_process_HostedFile_elf_header_entrypoint_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.elf.header.entrypoint + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.HostedFile.elf.sections + tag: foreach_process_HostedFile_elf_sections_chi2 + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.chi2 + tag: convert_process_HostedFile_elf_sections_chi2_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.chi2 + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.HostedFile.elf.sections + tag: foreach_process_HostedFile_elf_sections_entropy + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.entropy + tag: convert_process_HostedFile_elf_sections_entropy_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.entropy + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.HostedFile.elf.sections + tag: foreach_process_HostedFile_elf_sections_physical_size + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.physical_size + tag: convert_process_HostedFile_elf_sections_physical_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.physical_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.HostedFile.elf.sections + tag: foreach_process_HostedFile_elf_sections_virtual_address + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.virtual_address + tag: convert_process_HostedFile_elf_sections_virtual_address_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.virtual_address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.HostedFile.elf.sections + tag: foreach_process_HostedFile_elf_sections_virtual_size + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.virtual_size + tag: convert_process_HostedFile_elf_sections_virtual_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.virtual_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hash + tag: append_event_process_HostedFile_elf_telfhash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.elf?.telfhash != null + value: '{{{beyondtrust_epm.event.process.HostedFile.elf.telfhash}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_HostedFile_hash_md5_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.hash?.md5 != null + value: '{{{beyondtrust_epm.event.process.HostedFile.hash.md5}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_HostedFile_hash_sha1_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.hash?.sha1 != null + value: '{{{beyondtrust_epm.event.process.HostedFile.hash.sha1}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_HostedFile_hash_sha256_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.hash?.sha256 != null + value: '{{{beyondtrust_epm.event.process.HostedFile.hash.sha256}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_HostedFile_hash_sha384_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.hash?.sha384 != null + value: '{{{beyondtrust_epm.event.process.HostedFile.hash.sha384}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_HostedFile_hash_sha512_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.hash?.sha512 != null + value: '{{{beyondtrust_epm.event.process.HostedFile.hash.sha512}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_HostedFile_hash_ssdeep_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.hash?.ssdeep != null + value: '{{{beyondtrust_epm.event.process.HostedFile.hash.ssdeep}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_HostedFile_hash_tlsh_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.hash?.tlsh != null + value: '{{{beyondtrust_epm.event.process.HostedFile.hash.tlsh}}}' + allow_duplicates: false + - date: + field: beyondtrust_epm.event.process.HostedFile.mtime + tag: date_process_HostedFile_mtime + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.mtime != null && ctx.beyondtrust_epm.event.process.HostedFile.mtime != '' + target_field: beyondtrust_epm.event.process.HostedFile.mtime + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.mtime + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hash + tag: append_event_process_HostedFile_pe_imphash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.pe?.imphash != null + value: '{{{beyondtrust_epm.event.process.HostedFile.pe.imphash}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_HostedFile_pe_pehash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.pe?.pehash != null + value: '{{{beyondtrust_epm.event.process.HostedFile.pe.pehash}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.process.HostedFile.size + tag: convert_process_HostedFile_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.event.process.HostedFile.x509.not_after + tag: date_process_HostedFile_x509_not_after + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.x509?.not_after != null && ctx.beyondtrust_epm.event.process.HostedFile.x509.not_after != '' + target_field: beyondtrust_epm.event.process.HostedFile.x509.not_after + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.x509.not_after + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.event.process.HostedFile.x509.not_before + tag: date_process_HostedFile_x509_not_before + if: ctx.beyondtrust_epm?.event?.process?.HostedFile?.x509?.not_before != null && ctx.beyondtrust_epm.event.process.HostedFile.x509.not_before != '' + target_field: beyondtrust_epm.event.process.HostedFile.x509.not_before + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.x509.not_before + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.HostedFile.x509.public_key_exponent + tag: convert_process_HostedFile_x509_public_key_exponent_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.x509.public_key_exponent + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.HostedFile.x509.public_key_size + tag: convert_process_HostedFile_x509_public_key_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.HostedFile.x509.public_key_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.args + tag: foreach_process_args + if: ctx.beyondtrust_epm?.event?.process?.args instanceof List + processor: + append: + field: process.args + tag: append_process_args_into_process_args + value: '{{{_ingest._value}}}' + allow_duplicates: true + - convert: + field: beyondtrust_epm.event.process.args_count + tag: convert_process_args_count_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.args_count + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.args_count + tag: set_process_args_count_from_event_process_args_count + copy_from: beyondtrust_epm.event.process.args_count + ignore_empty_value: true + - set: + field: process.code_signature.digest_algorithm + tag: set_process_code_signature_digest_algorithm_from_event_process_code_signature_digest_algorithm + copy_from: beyondtrust_epm.event.process.code_signature.digest_algorithm + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.code_signature.exists + tag: convert_process_code_signature_exists_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.code_signature.exists + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.code_signature.exists + tag: set_process_code_signature_exists_from_event_process_code_signature_exists + copy_from: beyondtrust_epm.event.process.code_signature.exists + ignore_empty_value: true + - set: + field: process.code_signature.signing_id + tag: set_process_code_signature_signing_id_from_event_process_code_signature_signing_id + copy_from: beyondtrust_epm.event.process.code_signature.signing_id + ignore_empty_value: true + - set: + field: process.code_signature.status + tag: set_process_code_signature_status_from_event_process_code_signature_status + copy_from: beyondtrust_epm.event.process.code_signature.status + ignore_empty_value: true + - set: + field: process.code_signature.subject_name + tag: set_process_code_signature_subject_name_from_event_process_code_signature_subject_name + copy_from: beyondtrust_epm.event.process.code_signature.subject_name + ignore_empty_value: true + - set: + field: process.code_signature.team_id + tag: set_process_code_signature_team_id_from_event_process_code_signature_team_id + copy_from: beyondtrust_epm.event.process.code_signature.team_id + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.process.code_signature.timestamp + tag: date_process_code_signature_timestamp + if: ctx.beyondtrust_epm?.event?.process?.code_signature?.timestamp != null && ctx.beyondtrust_epm.event.process.code_signature.timestamp != '' + target_field: beyondtrust_epm.event.process.code_signature.timestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.code_signature.timestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.code_signature.timestamp + tag: set_process_code_signature_timestamp_from_event_process_code_signature_timestamp + copy_from: beyondtrust_epm.event.process.code_signature.timestamp + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.code_signature.trusted + tag: convert_process_code_signature_trusted_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.code_signature.trusted + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.code_signature.trusted + tag: set_process_code_signature_trusted_from_event_process_code_signature_trusted + copy_from: beyondtrust_epm.event.process.code_signature.trusted + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.code_signature.valid + tag: convert_process_code_signature_valid_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.code_signature.valid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.code_signature.valid + tag: set_process_code_signature_valid_from_event_process_code_signature_valid + copy_from: beyondtrust_epm.event.process.code_signature.valid + ignore_empty_value: true + - set: + field: process.command_line + tag: set_process_command_line_from_event_process_command_line + copy_from: beyondtrust_epm.event.process.command_line + ignore_empty_value: true + override: true + - set: + field: process.command_line + tag: set_process_command_line_from_event_EPMWinMac_RemotePowerShell_Command + copy_from: beyondtrust_epm.event.EPMWinMac.RemotePowerShell.Command + if: ctx.process?.command_line == null + ignore_empty_value: true + - set: + field: process.elf.architecture + tag: set_process_elf_architecture_from_event_process_elf_architecture + copy_from: beyondtrust_epm.event.process.elf.architecture + ignore_empty_value: true + - set: + field: process.elf.byte_order + tag: set_process_elf_byte_order_from_event_process_elf_byte_order + copy_from: beyondtrust_epm.event.process.elf.byte_order + ignore_empty_value: true + - set: + field: process.elf.cpu_type + tag: set_process_elf_cpu_type_from_event_process_elf_cpu_type + copy_from: beyondtrust_epm.event.process.elf.cpu_type + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.process.elf.creation_date + tag: date_process_elf_creation_date + if: ctx.beyondtrust_epm?.event?.process?.elf?.creation_date != null && ctx.beyondtrust_epm.event.process.elf.creation_date != '' + target_field: beyondtrust_epm.event.process.elf.creation_date + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.elf.creation_date + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.elf.creation_date + tag: set_process_elf_creation_date_from_event_process_elf_creation_date + copy_from: beyondtrust_epm.event.process.elf.creation_date + ignore_empty_value: true + - set: + field: process.elf.header.abi_version + tag: set_process_elf_header_abi_version_from_event_process_elf_header_abi_version + copy_from: beyondtrust_epm.event.process.elf.header.abi_version + ignore_empty_value: true + - set: + field: process.elf.header.class + tag: set_process_elf_header_class_from_event_process_elf_header_class + copy_from: beyondtrust_epm.event.process.elf.header.class + ignore_empty_value: true + - set: + field: process.elf.header.data + tag: set_process_elf_header_data_from_event_process_elf_header_data + copy_from: beyondtrust_epm.event.process.elf.header.data + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.elf.header.entrypoint + tag: convert_process_elf_header_entrypoint_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.elf.header.entrypoint + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.elf.header.entrypoint + tag: set_process_elf_header_entrypoint_from_event_process_elf_header_entrypoint + copy_from: beyondtrust_epm.event.process.elf.header.entrypoint + ignore_empty_value: true + - set: + field: process.elf.header.object_version + tag: set_process_elf_header_object_version_from_event_process_elf_header_object_version + copy_from: beyondtrust_epm.event.process.elf.header.object_version + ignore_empty_value: true + - set: + field: process.elf.header.os_abi + tag: set_process_elf_header_os_abi_from_event_process_elf_header_os_abi + copy_from: beyondtrust_epm.event.process.elf.header.os_abi + ignore_empty_value: true + - set: + field: process.elf.header.type + tag: set_process_elf_header_type_from_event_process_elf_header_type + copy_from: beyondtrust_epm.event.process.elf.header.type + ignore_empty_value: true + - set: + field: process.elf.header.version + tag: set_process_elf_header_version_from_event_process_elf_header_version + copy_from: beyondtrust_epm.event.process.elf.header.version + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections_chi2 + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.chi2 + tag: convert_process_elf_sections_chi2_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.chi2 + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections_entropy + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.entropy + tag: convert_process_elf_sections_entropy_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.entropy + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections_physical_size + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.physical_size + tag: convert_process_elf_sections_physical_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.physical_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections_virtual_address + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.virtual_address + tag: convert_process_elf_sections_virtual_address_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.virtual_address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections_virtual_size + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.virtual_size + tag: convert_process_elf_sections_virtual_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.virtual_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_append_process_elf_sections_chi2 + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + append: + field: process.elf.sections.chi2 + tag: append_process_elf_sections_chi2_into_process_elf_sections_chi2 + value: '{{{_ingest._value.chi2}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_append_process_elf_sections_entropy + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + append: + field: process.elf.sections.entropy + tag: append_process_elf_sections_entropy_into_process_elf_sections_entropy + value: '{{{_ingest._value.entropy}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections_flags + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + append: + field: process.elf.sections.flags + tag: append_process_elf_sections_flags_into_process_elf_sections_flags + value: '{{{_ingest._value.flags}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections_name + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + append: + field: process.elf.sections.name + tag: append_process_elf_sections_name_into_process_elf_sections_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections_physical_offset + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + append: + field: process.elf.sections.physical_offset + tag: append_process_elf_sections_physical_offset_into_process_elf_sections_physical_offset + value: '{{{_ingest._value.physical_offset}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_append_process_elf_sections_physical_size + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + append: + field: process.elf.sections.physical_size + tag: append_process_elf_sections_physical_size_into_process_elf_sections_physical_size + value: '{{{_ingest._value.physical_size}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections_type + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + append: + field: process.elf.sections.type + tag: append_process_elf_sections_type_into_process_elf_sections_type + value: '{{{_ingest._value.type}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_append_process_elf_sections_virtual_address + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + append: + field: process.elf.sections.virtual_address + tag: append_process_elf_sections_virtual_address_into_process_elf_sections_virtual_address + value: '{{{_ingest._value.virtual_address}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_append_process_elf_sections_virtual_size + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + append: + field: process.elf.sections.virtual_size + tag: append_process_elf_sections_virtual_size_into_process_elf_sections_virtual_size + value: '{{{_ingest._value.virtual_size}}}' + allow_duplicates: false + - foreach: + field: process.elf.sections.chi2 + tag: foreach_process_elf_sections_chi2_convert_to_long + if: ctx.process?.elf?.sections?.chi2 instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_process_elf_sections_chi2_elements_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: process.elf.sections.entropy + tag: foreach_process_elf_sections_entropy_convert_to_long + if: ctx.process?.elf?.sections?.entropy instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_process_elf_sections_entropy_elements_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: process.elf.sections.physical_size + tag: foreach_process_elf_sections_physical_size_convert_to_long + if: ctx.process?.elf?.sections?.physical_size instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_process_elf_sections_physical_size_elements_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: process.elf.sections.virtual_address + tag: foreach_process_elf_sections_virtual_address_convert_to_long + if: ctx.process?.elf?.sections?.virtual_address instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_process_elf_sections_virtual_address_elements_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: process.elf.sections.virtual_size + tag: foreach_process_elf_sections_virtual_size_convert_to_long + if: ctx.process?.elf?.sections?.virtual_size instanceof List + processor: + convert: + field: _ingest._value + tag: convert_ecs_process_elf_sections_virtual_size_elements_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.process.elf.segments + tag: foreach_process_elf_segments_sections + if: ctx.beyondtrust_epm?.event?.process?.elf?.segments instanceof List + processor: + append: + field: process.elf.segments.sections + tag: append_process_elf_segments_sections_into_process_elf_segments_sections + value: '{{{_ingest._value.sections}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.segments + tag: foreach_process_elf_segments_type + if: ctx.beyondtrust_epm?.event?.process?.elf?.segments instanceof List + processor: + append: + field: process.elf.segments.type + tag: append_process_elf_segments_type_into_process_elf_segments_type + value: '{{{_ingest._value.type}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.shared_libraries + tag: foreach_process_elf_shared_libraries + if: ctx.beyondtrust_epm?.event?.process?.elf?.shared_libraries instanceof List + processor: + append: + field: process.elf.shared_libraries + tag: append_process_elf_shared_libraries_into_process_elf_shared_libraries + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: process.elf.telfhash + tag: set_process_elf_telfhash_from_event_process_elf_telfhash + copy_from: beyondtrust_epm.event.process.elf.telfhash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_elf_telfhash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.elf?.telfhash != null + value: '{{{beyondtrust_epm.event.process.elf.telfhash}}}' + allow_duplicates: false + - date: + field: beyondtrust_epm.event.process.end + tag: date_process_end + if: ctx.beyondtrust_epm?.event?.process?.end != null && ctx.beyondtrust_epm.event.process.end != '' + target_field: beyondtrust_epm.event.process.end + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.end + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.end + tag: set_process_end_from_event_process_end + copy_from: beyondtrust_epm.event.process.end + ignore_empty_value: true + - set: + field: process.entity_id + tag: set_process_entity_id_from_event_process_entity_id + copy_from: beyondtrust_epm.event.process.entity_id + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.as.number + tag: convert_process_entry_meta_source_as_number_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.as.number + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.bytes + tag: convert_process_entry_meta_source_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.geo.TimezoneOffset + tag: convert_process_entry_meta_source_geo_TimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.geo.TimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.geo.location.lat + tag: convert_process_entry_meta_source_geo_location_lat_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.geo.location.lat + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.geo.location.lon + tag: convert_process_entry_meta_source_geo_location_lon_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.geo.location.lon + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: set_process_entry_meta_source_geo_location_from_lat_lon + lang: painless + description: Combine lat/lon into geo_point. + if: >- + ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.geo?.location?.lat != null + && ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.geo?.location?.lon != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.beyondtrust_epm.event.process.entry_meta.source.geo.location.lat); + location.put('lon', ctx.beyondtrust_epm.event.process.entry_meta.source.geo.location.lon); + ctx.beyondtrust_epm.event.process.entry_meta.source.geo.location = location; + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.ip + tag: convert_process_entry_meta_source_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_event_process_entry_meta_source_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.ip != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.ip}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.nat.ip + tag: convert_process_entry_meta_source_nat_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.nat?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.nat.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_event_process_entry_meta_source_nat_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.nat?.ip != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.nat.ip}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.nat.port + tag: convert_process_entry_meta_source_nat_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.nat.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.packets + tag: convert_process_entry_meta_source_packets_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.packets + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.port + tag: convert_process_entry_meta_source_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.user.DefaultTimezoneOffset + tag: convert_process_entry_meta_source_user_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.user.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.user.LocalIdentifier + tag: convert_process_entry_meta_source_user_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.user.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.user.changes.DefaultTimezoneOffset + tag: convert_process_entry_meta_source_user_changes_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.user.changes.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.user.changes.LocalIdentifier + tag: convert_process_entry_meta_source_user_changes_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.user.changes.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_changes_email_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.changes?.email != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.changes.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_changes_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.changes?.full_name != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.changes.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_entry_meta_source_user_changes_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.changes?.hash != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.changes.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_changes_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.changes?.name != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.changes.name}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.user.effective.DefaultTimezoneOffset + tag: convert_process_entry_meta_source_user_effective_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.user.effective.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.user.effective.LocalIdentifier + tag: convert_process_entry_meta_source_user_effective_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.user.effective.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_effective_email_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.effective?.email != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.effective.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_effective_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.effective?.full_name != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.effective.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_entry_meta_source_user_effective_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.effective?.hash != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.effective.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_effective_id_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.effective?.id != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.effective.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_email_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.email != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.full_name != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_entry_meta_source_user_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.hash != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_id_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.id != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.name != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.name}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.user.target.DefaultTimezoneOffset + tag: convert_process_entry_meta_source_user_target_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.user.target.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.entry_meta.source.user.target.LocalIdentifier + tag: convert_process_entry_meta_source_user_target_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.entry_meta.source.user.target.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_target_email_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.target?.email != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.target.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_target_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.target?.full_name != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.target.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_entry_meta_source_user_target_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.target?.hash != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.target.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_target_id_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.target?.id != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.target.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_entry_meta_source_user_target_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.entry_meta?.source?.user?.target?.name != null + value: '{{{beyondtrust_epm.event.process.entry_meta.source.user.target.name}}}' + allow_duplicates: false + - append: + field: process.env_vars + tag: append_beyondtrust_epm_event_process_env_vars_into_process_env_vars + if: ctx.beyondtrust_epm?.event?.process?.env_vars != null + value: '{{{beyondtrust_epm.event.process.env_vars}}}' + allow_duplicates: false + - set: + field: process.executable + tag: set_process_executable_from_event_process_executable + copy_from: beyondtrust_epm.event.process.executable + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.exit_code + tag: convert_process_exit_code_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.exit_code + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.exit_code + tag: set_process_exit_code_from_event_process_exit_code + copy_from: beyondtrust_epm.event.process.exit_code + ignore_empty_value: true + - set: + field: process.group.id + tag: set_process_group_id_from_event_process_group_id + copy_from: beyondtrust_epm.event.process.group.id + ignore_empty_value: true + - set: + field: process.group.name + tag: set_process_group_name_from_event_process_group_name + copy_from: beyondtrust_epm.event.process.group.name + ignore_empty_value: true + - set: + field: process.hash.md5 + tag: set_process_hash_md5_from_event_process_hash_md5 + copy_from: beyondtrust_epm.event.process.hash.md5 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_hash_md5_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.hash?.md5 != null + value: '{{{beyondtrust_epm.event.process.hash.md5}}}' + allow_duplicates: false + - set: + field: process.hash.sha1 + tag: set_process_hash_sha1_from_event_process_hash_sha1 + copy_from: beyondtrust_epm.event.process.hash.sha1 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_hash_sha1_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.hash?.sha1 != null + value: '{{{beyondtrust_epm.event.process.hash.sha1}}}' + allow_duplicates: false + - set: + field: process.hash.sha256 + tag: set_process_hash_sha256_from_event_process_hash_sha256 + copy_from: beyondtrust_epm.event.process.hash.sha256 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_hash_sha256_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.hash?.sha256 != null + value: '{{{beyondtrust_epm.event.process.hash.sha256}}}' + allow_duplicates: false + - set: + field: process.hash.sha384 + tag: set_process_hash_sha384_from_event_process_hash_sha384 + copy_from: beyondtrust_epm.event.process.hash.sha384 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_hash_sha384_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.hash?.sha384 != null + value: '{{{beyondtrust_epm.event.process.hash.sha384}}}' + allow_duplicates: false + - set: + field: process.hash.sha512 + tag: set_process_hash_sha512_from_event_process_hash_sha512 + copy_from: beyondtrust_epm.event.process.hash.sha512 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_hash_sha512_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.hash?.sha512 != null + value: '{{{beyondtrust_epm.event.process.hash.sha512}}}' + allow_duplicates: false + - set: + field: process.hash.ssdeep + tag: set_process_hash_ssdeep_from_event_process_hash_ssdeep + copy_from: beyondtrust_epm.event.process.hash.ssdeep + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_hash_ssdeep_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.hash?.ssdeep != null + value: '{{{beyondtrust_epm.event.process.hash.ssdeep}}}' + allow_duplicates: false + - set: + field: process.hash.tlsh + tag: set_process_hash_tlsh_from_event_process_hash_tlsh + copy_from: beyondtrust_epm.event.process.hash.tlsh + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_hash_tlsh_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.hash?.tlsh != null + value: '{{{beyondtrust_epm.event.process.hash.tlsh}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.process.interactive + tag: convert_process_interactive_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.interactive + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.interactive + tag: set_process_interactive_from_event_process_interactive + copy_from: beyondtrust_epm.event.process.interactive + ignore_empty_value: true + - set: + field: process.name + tag: set_process_name_from_event_process_name + copy_from: beyondtrust_epm.event.process.name + ignore_empty_value: true + - set: + field: process.pe.architecture + tag: set_process_pe_architecture_from_event_process_pe_architecture + copy_from: beyondtrust_epm.event.process.pe.architecture + ignore_empty_value: true + - set: + field: process.pe.company + tag: set_process_pe_company_from_event_process_pe_company + copy_from: beyondtrust_epm.event.process.pe.company + ignore_empty_value: true + - set: + field: process.pe.description + tag: set_process_pe_description_from_event_process_pe_description + copy_from: beyondtrust_epm.event.process.pe.description + ignore_empty_value: true + - set: + field: process.pe.file_version + tag: set_process_pe_file_version_from_event_process_pe_file_version + copy_from: beyondtrust_epm.event.process.pe.file_version + ignore_empty_value: true + - set: + field: process.pe.imphash + tag: set_process_pe_imphash_from_event_process_pe_imphash + copy_from: beyondtrust_epm.event.process.pe.imphash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_pe_imphash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.pe?.imphash != null + value: '{{{beyondtrust_epm.event.process.pe.imphash}}}' + allow_duplicates: false + - set: + field: process.pe.original_file_name + tag: set_process_pe_original_file_name_from_event_process_pe_original_file_name + copy_from: beyondtrust_epm.event.process.pe.original_file_name + ignore_empty_value: true + - set: + field: process.pe.pehash + tag: set_process_pe_pehash_from_event_process_pe_pehash + copy_from: beyondtrust_epm.event.process.pe.pehash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_process_pe_pehash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.pe?.pehash != null + value: '{{{beyondtrust_epm.event.process.pe.pehash}}}' + allow_duplicates: false + - set: + field: process.pe.product + tag: set_process_pe_product_from_event_process_pe_product + copy_from: beyondtrust_epm.event.process.pe.product + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.pgid + tag: convert_process_pgid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.pgid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.pid + tag: convert_process_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.pid + tag: set_process_pid_from_event_process_pid + copy_from: beyondtrust_epm.event.process.pid + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.same_as_process + tag: convert_process_same_as_process_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.same_as_process + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: beyondtrust_epm.event.process.start + tag: date_process_start + if: ctx.beyondtrust_epm?.event?.process?.start != null && ctx.beyondtrust_epm.event.process.start != '' + target_field: beyondtrust_epm.event.process.start + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.process.start + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.start + tag: set_process_start_from_event_process_start + copy_from: beyondtrust_epm.event.process.start + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.thread.id + tag: convert_process_thread_id_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.thread.id + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.thread.id + tag: set_process_thread_id_from_event_process_thread_id + copy_from: beyondtrust_epm.event.process.thread.id + ignore_empty_value: true + - set: + field: process.thread.name + tag: set_process_thread_name_from_event_process_thread_name + copy_from: beyondtrust_epm.event.process.thread.name + ignore_empty_value: true + - set: + field: process.title + tag: set_process_title_from_event_process_title + copy_from: beyondtrust_epm.event.process.title + ignore_empty_value: true + - set: + field: process.tty + tag: set_process_tty_from_event_process_tty + copy_from: beyondtrust_epm.event.process.tty + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.uptime + tag: convert_process_uptime_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.uptime + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.uptime + tag: set_process_uptime_from_event_process_uptime + copy_from: beyondtrust_epm.event.process.uptime + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.process.user.DefaultTimezoneOffset + tag: convert_process_user_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.user.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.user.LocalIdentifier + tag: convert_process_user_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.user.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.user.changes.DefaultTimezoneOffset + tag: convert_process_user_changes_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.user.changes.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.user.changes.LocalIdentifier + tag: convert_process_user_changes_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.user.changes.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_process_user_changes_email_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.changes?.email != null + value: '{{{beyondtrust_epm.event.process.user.changes.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_user_changes_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.changes?.full_name != null + value: '{{{beyondtrust_epm.event.process.user.changes.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_user_changes_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.user?.changes?.hash != null + value: '{{{beyondtrust_epm.event.process.user.changes.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_user_changes_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.changes?.name != null + value: '{{{beyondtrust_epm.event.process.user.changes.name}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.process.user.effective.DefaultTimezoneOffset + tag: convert_process_user_effective_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.user.effective.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.user.effective.LocalIdentifier + tag: convert_process_user_effective_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.user.effective.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_process_user_effective_email_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.effective?.email != null + value: '{{{beyondtrust_epm.event.process.user.effective.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_user_effective_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.effective?.full_name != null + value: '{{{beyondtrust_epm.event.process.user.effective.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_user_effective_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.user?.effective?.hash != null + value: '{{{beyondtrust_epm.event.process.user.effective.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_user_effective_id_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.effective?.id != null + value: '{{{beyondtrust_epm.event.process.user.effective.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_user_email_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.email != null + value: '{{{beyondtrust_epm.event.process.user.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_user_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.full_name != null + value: '{{{beyondtrust_epm.event.process.user.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_user_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.user?.hash != null + value: '{{{beyondtrust_epm.event.process.user.hash}}}' + allow_duplicates: false + - set: + field: process.user.id + tag: set_process_user_id_from_event_process_user_id + copy_from: beyondtrust_epm.event.process.user.id + ignore_empty_value: true + - append: + field: related.user + tag: append_event_process_user_id_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.id != null + value: '{{{beyondtrust_epm.event.process.user.id}}}' + allow_duplicates: false + - set: + field: process.user.name + tag: set_process_user_name_from_event_process_user_name + copy_from: beyondtrust_epm.event.process.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_event_process_user_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.name != null + value: '{{{beyondtrust_epm.event.process.user.name}}}' + allow_duplicates: false + - convert: + field: beyondtrust_epm.event.process.user.target.DefaultTimezoneOffset + tag: convert_process_user_target_DefaultTimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.user.target.DefaultTimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.process.user.target.LocalIdentifier + tag: convert_process_user_target_LocalIdentifier_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.process.user.target.LocalIdentifier + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_event_process_user_target_email_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.target?.email != null + value: '{{{beyondtrust_epm.event.process.user.target.email}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_user_target_full_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.target?.full_name != null + value: '{{{beyondtrust_epm.event.process.user.target.full_name}}}' + allow_duplicates: false + - append: + field: related.hash + tag: append_event_process_user_target_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.process?.user?.target?.hash != null + value: '{{{beyondtrust_epm.event.process.user.target.hash}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_user_target_id_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.target?.id != null + value: '{{{beyondtrust_epm.event.process.user.target.id}}}' + allow_duplicates: false + - append: + field: related.user + tag: append_event_process_user_target_name_into_related_user + if: ctx.beyondtrust_epm?.event?.process?.user?.target?.name != null + value: '{{{beyondtrust_epm.event.process.user.target.name}}}' + allow_duplicates: false + - set: + field: process.working_directory + tag: set_process_working_directory_from_event_process_working_directory + copy_from: beyondtrust_epm.event.process.working_directory + ignore_empty_value: true + - set: + field: process.code_signature.exists + tag: set_process_code_signature_exists_from_process_HostedFile_code_signature_exists + copy_from: beyondtrust_epm.event.process.HostedFile.code_signature.exists + ignore_empty_value: true + override: false + - set: + field: process.code_signature.subject_name + tag: set_process_code_signature_subject_name_from_process_HostedFile_code_signature_subject_name + copy_from: beyondtrust_epm.event.process.HostedFile.code_signature.subject_name + ignore_empty_value: true + override: false + - set: + field: process.code_signature.valid + tag: set_process_code_signature_valid_from_process_HostedFile_code_signature_valid + copy_from: beyondtrust_epm.event.process.HostedFile.code_signature.valid + ignore_empty_value: true + override: false + - set: + field: process.hash.md5 + tag: set_process_hash_md5_from_process_HostedFile_hash_md5 + copy_from: beyondtrust_epm.event.process.HostedFile.hash.md5 + ignore_empty_value: true + override: false + - set: + field: process.hash.sha1 + tag: set_process_hash_sha1_from_process_HostedFile_hash_sha1 + copy_from: beyondtrust_epm.event.process.HostedFile.hash.sha1 + ignore_empty_value: true + override: false + - set: + field: process.hash.sha256 + tag: set_process_hash_sha256_from_process_HostedFile_hash_sha256 + copy_from: beyondtrust_epm.event.process.HostedFile.hash.sha256 + ignore_empty_value: true + override: false + - set: + field: process.name + tag: set_process_name_from_process_HostedFile_name + copy_from: beyondtrust_epm.event.process.HostedFile.name + ignore_empty_value: true + override: false + - set: + field: process.executable + tag: set_process_executable_from_process_HostedFile_path + copy_from: beyondtrust_epm.event.process.HostedFile.path + ignore_empty_value: true + override: false + - set: + field: process.pe.company + tag: set_process_pe_company_from_process_HostedFile_pe_company + copy_from: beyondtrust_epm.event.process.HostedFile.pe.company + ignore_empty_value: true + override: false + - set: + field: process.pe.description + tag: set_process_pe_description_from_process_HostedFile_pe_description + copy_from: beyondtrust_epm.event.process.HostedFile.pe.description + ignore_empty_value: true + override: false + - set: + field: process.pe.original_file_name + tag: set_process_pe_original_file_name_from_process_HostedFile_pe_original_file_name + copy_from: beyondtrust_epm.event.process.HostedFile.pe.original_file_name + ignore_empty_value: true + override: false + - append: + field: event.category + tag: append_event_category_process + if: >- + ctx.process != null + && (ctx.event?.category == null || !ctx.event.category.contains('process')) + value: process + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.process.elf.sections + tag: foreach_process_elf_sections + if: ctx.beyondtrust_epm?.event?.process?.elf?.sections instanceof List + processor: + remove: + field: + - _ingest._value.chi2 + - _ingest._value.entropy + - _ingest._value.flags + - _ingest._value.name + - _ingest._value.physical_offset + - _ingest._value.physical_size + - _ingest._value.type + - _ingest._value.virtual_address + - _ingest._value.virtual_size + tag: remove_fields_mapped_with_ecs_from_process_elf_sections + ignore_missing: true + - foreach: + field: beyondtrust_epm.event.process.elf.segments + tag: foreach_process_elf_segments + if: ctx.beyondtrust_epm?.event?.process?.elf?.segments instanceof List + processor: + remove: + field: + - _ingest._value.sections + - _ingest._value.type + tag: remove_fields_mapped_with_ecs_from_process_elf_segments + ignore_missing: true + - remove: + field: + - beyondtrust_epm.event.EPMWinMac.RemotePowerShell.Command + - beyondtrust_epm.event.process.args + - beyondtrust_epm.event.process.args_count + - beyondtrust_epm.event.process.code_signature.digest_algorithm + - beyondtrust_epm.event.process.code_signature.exists + - beyondtrust_epm.event.process.code_signature.signing_id + - beyondtrust_epm.event.process.code_signature.status + - beyondtrust_epm.event.process.code_signature.subject_name + - beyondtrust_epm.event.process.code_signature.team_id + - beyondtrust_epm.event.process.code_signature.timestamp + - beyondtrust_epm.event.process.code_signature.trusted + - beyondtrust_epm.event.process.code_signature.valid + - beyondtrust_epm.event.process.command_line + - beyondtrust_epm.event.process.elf.architecture + - beyondtrust_epm.event.process.elf.byte_order + - beyondtrust_epm.event.process.elf.cpu_type + - beyondtrust_epm.event.process.elf.creation_date + - beyondtrust_epm.event.process.elf.header.abi_version + - beyondtrust_epm.event.process.elf.header.class + - beyondtrust_epm.event.process.elf.header.data + - beyondtrust_epm.event.process.elf.header.entrypoint + - beyondtrust_epm.event.process.elf.header.object_version + - beyondtrust_epm.event.process.elf.header.os_abi + - beyondtrust_epm.event.process.elf.header.type + - beyondtrust_epm.event.process.elf.header.version + - beyondtrust_epm.event.process.elf.shared_libraries + - beyondtrust_epm.event.process.elf.telfhash + - beyondtrust_epm.event.process.end + - beyondtrust_epm.event.process.entity_id + - beyondtrust_epm.event.process.env_vars + - beyondtrust_epm.event.process.executable + - beyondtrust_epm.event.process.exit_code + - beyondtrust_epm.event.process.group.id + - beyondtrust_epm.event.process.group.name + - beyondtrust_epm.event.process.hash.md5 + - beyondtrust_epm.event.process.hash.sha1 + - beyondtrust_epm.event.process.hash.sha256 + - beyondtrust_epm.event.process.hash.sha384 + - beyondtrust_epm.event.process.hash.sha512 + - beyondtrust_epm.event.process.hash.ssdeep + - beyondtrust_epm.event.process.hash.tlsh + - beyondtrust_epm.event.process.interactive + - beyondtrust_epm.event.process.name + - beyondtrust_epm.event.process.pe.architecture + - beyondtrust_epm.event.process.pe.company + - beyondtrust_epm.event.process.pe.description + - beyondtrust_epm.event.process.pe.file_version + - beyondtrust_epm.event.process.pe.imphash + - beyondtrust_epm.event.process.pe.original_file_name + - beyondtrust_epm.event.process.pe.pehash + - beyondtrust_epm.event.process.pe.product + - beyondtrust_epm.event.process.pid + - beyondtrust_epm.event.process.start + - beyondtrust_epm.event.process.thread.id + - beyondtrust_epm.event.process.thread.name + - beyondtrust_epm.event.process.title + - beyondtrust_epm.event.process.uptime + - beyondtrust_epm.event.process.user.id + - beyondtrust_epm.event.process.user.name + - beyondtrust_epm.event.process.working_directory + tag: remove_fields_mapped_with_ecs + ignore_missing: true diff --git a/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-service-application.yml b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-service-application.yml new file mode 100644 index 00000000000..fd0747bd3e1 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-service-application.yml @@ -0,0 +1,580 @@ +--- +description: Pipeline for processing service and application fields (service, agent, log, error, event, data_stream). +processors: + - set: + field: event.reason + tag: set_event_reason_from_event_EPMWinMac_Configuration_Message_UserReason + copy_from: beyondtrust_epm.event.EPMWinMac.Configuration.Message.UserReason + ignore_empty_value: true + - set: + field: event.action + tag: set_event_action_from_event_EPMWinMac_Event_Action + copy_from: beyondtrust_epm.event.EPMWinMac.Event.Action + ignore_empty_value: true + - lowercase: + field: event.action + tag: lowercase_event_action + ignore_missing: true + - set: + field: event.code + tag: set_event_code_from_event_EPMWinMac_Event_Type + copy_from: beyondtrust_epm.event.EPMWinMac.Event.Type + ignore_empty_value: true + - set: + field: service.name + tag: set_service_name_from_event_EPMWinMac_ServiceControl_Service_DisplayName + copy_from: beyondtrust_epm.event.EPMWinMac.ServiceControl.Service.DisplayName + ignore_empty_value: true + - set: + field: error.code + tag: set_error_code_from_event_error_code + copy_from: beyondtrust_epm.event.error.code + ignore_empty_value: true + - set: + field: error.id + tag: set_error_id_from_event_error_id + copy_from: beyondtrust_epm.event.error.id + ignore_empty_value: true + - set: + field: error.stack_trace + tag: set_error_stack_trace_from_event_error_stack_trace + copy_from: beyondtrust_epm.event.error.stack_trace + ignore_empty_value: true + - set: + field: error.type + tag: set_error_type_from_event_error_type + copy_from: beyondtrust_epm.event.error.type + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.event.ReceivedAt + tag: date_event_ReceivedAt + if: ctx.beyondtrust_epm?.event?.event?.ReceivedAt != null && ctx.beyondtrust_epm.event.event.ReceivedAt != '' + target_field: beyondtrust_epm.event.event.ReceivedAt + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.event.ReceivedAt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: event.action + tag: append_beyondtrust_epm_event_event_action_into_event_action + if: ctx.beyondtrust_epm?.event?.event?.action != null + value: '{{{beyondtrust_epm.event.event.action}}}' + allow_duplicates: false + - set: + field: event.agent_id_status + tag: set_event_agent_id_status_from_event_event_agent_id_status + copy_from: beyondtrust_epm.event.event.agent_id_status + ignore_empty_value: true + - append: + field: event.code + tag: append_beyondtrust_epm_event_event_code_into_event_code + if: ctx.beyondtrust_epm?.event?.event?.code != null + value: '{{{beyondtrust_epm.event.event.code}}}' + allow_duplicates: false + - date: + field: beyondtrust_epm.event.event.created + tag: date_event_created + if: ctx.beyondtrust_epm?.event?.event?.created != null && ctx.beyondtrust_epm.event.event.created != '' + target_field: beyondtrust_epm.event.event.created + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.event.created + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.created + tag: set_event_created_from_event_event_created + copy_from: beyondtrust_epm.event.event.created + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.event.duration + tag: convert_event_duration_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.event.duration + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.duration + tag: set_event_duration_from_event_event_duration + copy_from: beyondtrust_epm.event.event.duration + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.event.end + tag: date_event_end + if: ctx.beyondtrust_epm?.event?.event?.end != null && ctx.beyondtrust_epm.event.event.end != '' + target_field: beyondtrust_epm.event.event.end + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.event.end + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.end + tag: set_event_end_from_event_event_end + copy_from: beyondtrust_epm.event.event.end + ignore_empty_value: true + - set: + field: event.hash + tag: set_event_hash_from_event_event_hash + copy_from: beyondtrust_epm.event.event.hash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_event_hash_into_related_hash + if: ctx.beyondtrust_epm?.event?.event?.hash != null + value: '{{{beyondtrust_epm.event.event.hash}}}' + allow_duplicates: false + - set: + field: event.id + tag: set_event_id_from_event_event_id + if: ctx.beyondtrust_epm?.event?.event?.id != null + copy_from: beyondtrust_epm.event.event.id + ignore_empty_value: true + - set: + field: event.id + tag: set_event_id_from_event_EPMWinMac_Session_JITAdmin_RequestIdentifier + copy_from: beyondtrust_epm.event.EPMWinMac.Session.JITAdmin.RequestIdentifier + ignore_empty_value: true + override: false + - date: + field: beyondtrust_epm.event.event.ingested + tag: date_event_ingested + if: ctx.beyondtrust_epm?.event?.event?.ingested != null && ctx.beyondtrust_epm.event.event.ingested != '' + target_field: beyondtrust_epm.event.event.ingested + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.event.ingested + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.outcome + tag: set_event_outcome_from_event_event_outcome + copy_from: beyondtrust_epm.event.event.outcome + ignore_empty_value: true + - set: + field: event.provider + tag: set_event_provider_from_event_event_provider + copy_from: beyondtrust_epm.event.event.provider + ignore_empty_value: true + - append: + field: event.reason + tag: append_beyondtrust_epm_event_event_reason_into_event_reason + if: ctx.beyondtrust_epm?.event?.event?.reason != null + value: '{{{beyondtrust_epm.event.event.reason}}}' + allow_duplicates: false + - set: + field: event.reference + tag: set_event_reference_from_event_event_reference + copy_from: beyondtrust_epm.event.event.reference + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.event.risk_score + tag: convert_event_risk_score_to_float + type: float + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.event.risk_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.risk_score + tag: set_event_risk_score_from_event_event_risk_score + copy_from: beyondtrust_epm.event.event.risk_score + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.event.risk_score_norm + tag: convert_event_risk_score_norm_to_float + type: float + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.event.risk_score_norm + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.risk_score_norm + tag: set_event_risk_score_norm_from_event_event_risk_score_norm + copy_from: beyondtrust_epm.event.event.risk_score_norm + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.event.sequence + tag: convert_event_sequence_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.event.sequence + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.sequence + tag: set_event_sequence_from_event_event_sequence + copy_from: beyondtrust_epm.event.event.sequence + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.event.severity + tag: convert_event_severity_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.event.severity + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.severity + tag: set_event_severity_from_event_event_severity + copy_from: beyondtrust_epm.event.event.severity + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.event.start + tag: date_event_start + if: ctx.beyondtrust_epm?.event?.event?.start != null && ctx.beyondtrust_epm.event.event.start != '' + target_field: beyondtrust_epm.event.event.start + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.event.start + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.start + tag: set_event_start_from_event_event_start + copy_from: beyondtrust_epm.event.event.start + ignore_empty_value: true + - set: + field: event.timezone + tag: set_event_timezone_from_event_event_timezone + copy_from: beyondtrust_epm.event.event.timezone + ignore_empty_value: true + - set: + field: event.url + tag: set_event_url_from_event_event_url + copy_from: beyondtrust_epm.event.event.url + ignore_empty_value: true + - set: + field: log.file.path + tag: set_log_file_path_from_event_log_file_path + copy_from: beyondtrust_epm.event.log.file.path + ignore_empty_value: true + - set: + field: log.level + tag: set_log_level_from_event_log_level + copy_from: beyondtrust_epm.event.log.level + ignore_empty_value: true + - set: + field: log.logger + tag: set_log_logger_from_event_log_logger + copy_from: beyondtrust_epm.event.log.logger + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.log.origin.file.line + tag: convert_log_origin_file_line_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.log.origin.file.line + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: log.origin.file.line + tag: set_log_origin_file_line_from_event_log_origin_file_line + copy_from: beyondtrust_epm.event.log.origin.file.line + ignore_empty_value: true + - set: + field: log.origin.file.name + tag: set_log_origin_file_name_from_event_log_origin_file_name + copy_from: beyondtrust_epm.event.log.origin.file.name + ignore_empty_value: true + - set: + field: log.origin.function + tag: set_log_origin_function_from_event_log_origin_function + copy_from: beyondtrust_epm.event.log.origin.function + ignore_empty_value: true + - set: + field: service.address + tag: set_service_address_from_event_service_address + copy_from: beyondtrust_epm.event.service.address + ignore_empty_value: true + - set: + field: service.environment + tag: set_service_environment_from_event_service_environment + copy_from: beyondtrust_epm.event.service.environment + ignore_empty_value: true + - set: + field: service.ephemeral_id + tag: set_service_ephemeral_id_from_event_service_ephemeral_id + copy_from: beyondtrust_epm.event.service.ephemeral_id + ignore_empty_value: true + - set: + field: service.id + tag: set_service_id_from_event_service_id + copy_from: beyondtrust_epm.event.service.id + ignore_empty_value: true + - append: + field: service.name + tag: append_beyondtrust_epm_event_service_name_into_service_name + if: ctx.beyondtrust_epm?.event?.service?.name != null + value: '{{{beyondtrust_epm.event.service.name}}}' + allow_duplicates: false + - set: + field: service.node.name + tag: set_service_node_name_from_event_service_node_name + copy_from: beyondtrust_epm.event.service.node.name + ignore_empty_value: true + - set: + field: service.node.role + tag: set_service_node_role_from_event_service_node_role + copy_from: beyondtrust_epm.event.service.node.role + ignore_empty_value: true + - set: + field: service.origin.address + tag: set_service_origin_address_from_event_service_origin_address + copy_from: beyondtrust_epm.event.service.origin.address + ignore_empty_value: true + - set: + field: service.origin.environment + tag: set_service_origin_environment_from_event_service_origin_environment + copy_from: beyondtrust_epm.event.service.origin.environment + ignore_empty_value: true + - set: + field: service.origin.ephemeral_id + tag: set_service_origin_ephemeral_id_from_event_service_origin_ephemeral_id + copy_from: beyondtrust_epm.event.service.origin.ephemeral_id + ignore_empty_value: true + - set: + field: service.origin.id + tag: set_service_origin_id_from_event_service_origin_id + copy_from: beyondtrust_epm.event.service.origin.id + ignore_empty_value: true + - set: + field: service.origin.name + tag: set_service_origin_name_from_event_service_origin_name + copy_from: beyondtrust_epm.event.service.origin.name + ignore_empty_value: true + - set: + field: service.origin.node.name + tag: set_service_origin_node_name_from_event_service_origin_node_name + copy_from: beyondtrust_epm.event.service.origin.node.name + ignore_empty_value: true + - set: + field: service.origin.node.role + tag: set_service_origin_node_role_from_event_service_origin_node_role + copy_from: beyondtrust_epm.event.service.origin.node.role + ignore_empty_value: true + - set: + field: service.origin.state + tag: set_service_origin_state_from_event_service_origin_state + copy_from: beyondtrust_epm.event.service.origin.state + ignore_empty_value: true + - set: + field: service.origin.type + tag: set_service_origin_type_from_event_service_origin_type + copy_from: beyondtrust_epm.event.service.origin.type + ignore_empty_value: true + - set: + field: service.origin.version + tag: set_service_origin_version_from_event_service_origin_version + copy_from: beyondtrust_epm.event.service.origin.version + ignore_empty_value: true + - set: + field: service.state + tag: set_service_state_from_event_service_state + copy_from: beyondtrust_epm.event.service.state + ignore_empty_value: true + - set: + field: service.target.address + tag: set_service_target_address_from_event_service_target_address + copy_from: beyondtrust_epm.event.service.target.address + ignore_empty_value: true + - set: + field: service.target.environment + tag: set_service_target_environment_from_event_service_target_environment + copy_from: beyondtrust_epm.event.service.target.environment + ignore_empty_value: true + - set: + field: service.target.ephemeral_id + tag: set_service_target_ephemeral_id_from_event_service_target_ephemeral_id + copy_from: beyondtrust_epm.event.service.target.ephemeral_id + ignore_empty_value: true + - set: + field: service.target.id + tag: set_service_target_id_from_event_service_target_id + copy_from: beyondtrust_epm.event.service.target.id + ignore_empty_value: true + - set: + field: service.target.name + tag: set_service_target_name_from_event_service_target_name + copy_from: beyondtrust_epm.event.service.target.name + ignore_empty_value: true + - set: + field: service.target.node.name + tag: set_service_target_node_name_from_event_service_target_node_name + copy_from: beyondtrust_epm.event.service.target.node.name + ignore_empty_value: true + - set: + field: service.target.node.role + tag: set_service_target_node_role_from_event_service_target_node_role + copy_from: beyondtrust_epm.event.service.target.node.role + ignore_empty_value: true + - set: + field: service.target.state + tag: set_service_target_state_from_event_service_target_state + copy_from: beyondtrust_epm.event.service.target.state + ignore_empty_value: true + - set: + field: service.target.type + tag: set_service_target_type_from_event_service_target_type + copy_from: beyondtrust_epm.event.service.target.type + ignore_empty_value: true + - set: + field: service.target.version + tag: set_service_target_version_from_event_service_target_version + copy_from: beyondtrust_epm.event.service.target.version + ignore_empty_value: true + - set: + field: service.type + tag: set_service_type_from_event_service_type + copy_from: beyondtrust_epm.event.service.type + ignore_empty_value: true + - set: + field: service.version + tag: set_service_version_from_event_service_version + copy_from: beyondtrust_epm.event.service.version + ignore_empty_value: true + # Seed @timestamp from the event receipt time (ReceivedAt). override:false keeps + # any value already present on the document. The metadata-observability pipeline + # later sets @timestamp from the event occurrence time with override enabled, so + # occurrence time takes precedence over receipt time when both are present. + - set: + field: '@timestamp' + tag: set_timestamp_from_event_ReceivedAt + copy_from: beyondtrust_epm.event.event.ReceivedAt + ignore_empty_value: true + override: false + - set: + field: event.original + tag: set_event_original_from_event_event_original + copy_from: beyondtrust_epm.event.event.original + ignore_empty_value: true + override: false + - foreach: + field: beyondtrust_epm.event.event.category + tag: foreach_event_event_category + if: ctx.beyondtrust_epm?.event?.event?.category instanceof List + processor: + append: + field: event.category + tag: append_event_event_category_into_event_category + value: '{{{_ingest._value}}}' + allow_duplicates: false + - append: + field: event.category + tag: append_event_event_category_into_event_category + if: ctx.beyondtrust_epm?.event?.event?.category instanceof String + value: '{{{beyondtrust_epm.event.event.category}}}' + allow_duplicates: false + - remove: + field: + - beyondtrust_epm.event.EPMWinMac.Configuration.Message.UserReason + - beyondtrust_epm.event.EPMWinMac.Event.Action + - beyondtrust_epm.event.EPMWinMac.Event.Type + - beyondtrust_epm.event.EPMWinMac.ServiceControl.Service.DisplayName + - beyondtrust_epm.event.error.code + - beyondtrust_epm.event.error.id + - beyondtrust_epm.event.error.stack_trace + - beyondtrust_epm.event.error.type + - beyondtrust_epm.event.event.action + - beyondtrust_epm.event.event.agent_id_status + - beyondtrust_epm.event.event.code + - beyondtrust_epm.event.event.created + - beyondtrust_epm.event.event.duration + - beyondtrust_epm.event.event.end + - beyondtrust_epm.event.event.hash + - beyondtrust_epm.event.event.id + - beyondtrust_epm.event.event.outcome + - beyondtrust_epm.event.event.provider + - beyondtrust_epm.event.event.reason + - beyondtrust_epm.event.event.reference + - beyondtrust_epm.event.event.risk_score + - beyondtrust_epm.event.event.risk_score_norm + - beyondtrust_epm.event.event.sequence + - beyondtrust_epm.event.event.severity + - beyondtrust_epm.event.event.start + - beyondtrust_epm.event.event.timezone + - beyondtrust_epm.event.event.url + - beyondtrust_epm.event.log.file.path + - beyondtrust_epm.event.log.level + - beyondtrust_epm.event.log.logger + - beyondtrust_epm.event.log.origin.file.line + - beyondtrust_epm.event.log.origin.file.name + - beyondtrust_epm.event.log.origin.function + - beyondtrust_epm.event.service.address + - beyondtrust_epm.event.service.environment + - beyondtrust_epm.event.service.ephemeral_id + - beyondtrust_epm.event.service.id + - beyondtrust_epm.event.service.name + - beyondtrust_epm.event.service.node.name + - beyondtrust_epm.event.service.node.role + - beyondtrust_epm.event.service.origin.address + - beyondtrust_epm.event.service.origin.environment + - beyondtrust_epm.event.service.origin.ephemeral_id + - beyondtrust_epm.event.service.origin.id + - beyondtrust_epm.event.service.origin.name + - beyondtrust_epm.event.service.origin.node.name + - beyondtrust_epm.event.service.origin.node.role + - beyondtrust_epm.event.service.origin.state + - beyondtrust_epm.event.service.origin.type + - beyondtrust_epm.event.service.origin.version + - beyondtrust_epm.event.service.state + - beyondtrust_epm.event.service.target.address + - beyondtrust_epm.event.service.target.environment + - beyondtrust_epm.event.service.target.ephemeral_id + - beyondtrust_epm.event.service.target.id + - beyondtrust_epm.event.service.target.name + - beyondtrust_epm.event.service.target.node.name + - beyondtrust_epm.event.service.target.node.role + - beyondtrust_epm.event.service.target.state + - beyondtrust_epm.event.service.target.type + - beyondtrust_epm.event.service.target.version + - beyondtrust_epm.event.service.type + - beyondtrust_epm.event.service.version + tag: remove_fields_mapped_with_ecs + ignore_missing: true diff --git a/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-threat-security.yml b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-threat-security.yml new file mode 100644 index 00000000000..2724063dfc5 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/elasticsearch/ingest_pipeline/pipeline-threat-security.yml @@ -0,0 +1,2275 @@ +--- +description: Pipeline for processing threat and security intelligence fields (threat, vulnerability, rule). +processors: + - rename: + field: beyondtrust_epm.event.threat.indicator.file.owner + tag: rename_threat_indicator_file_owner + target_field: beyondtrust_epm.event.threat.indicator.file.owner_keyword + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.owner instanceof String + - set: + field: threat.indicator.file.owner + tag: set_beyondtrust_epm_event_threat_indicator_file_owner + value: '{{{beyondtrust_epm.event.threat.indicator.file.owner_keyword}}}' + ignore_empty_value: true + - set: + field: rule.description + tag: set_rule_description_from_event_EPMWinMac_Configuration_Workstyle_Description + copy_from: beyondtrust_epm.event.EPMWinMac.Configuration.Workstyle.Description + ignore_empty_value: true + - set: + field: rule.id + tag: set_rule_id_from_event_EPMWinMac_Configuration_Workstyle_Identifier + copy_from: beyondtrust_epm.event.EPMWinMac.Configuration.Workstyle.Identifier + ignore_empty_value: true + - set: + field: rule.name + tag: set_rule_name_from_event_EPMWinMac_Configuration_Workstyle_Name + copy_from: beyondtrust_epm.event.EPMWinMac.Configuration.Workstyle.Name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.rule.author + tag: foreach_rule_author + if: ctx.beyondtrust_epm?.event?.rule?.author instanceof List + processor: + append: + field: rule.author + tag: append_rule_author_into_rule_author + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: rule.category + tag: set_rule_category_from_event_rule_category + copy_from: beyondtrust_epm.event.rule.category + ignore_empty_value: true + - append: + field: rule.description + tag: append_beyondtrust_epm_event_rule_description_into_rule_description + if: ctx.beyondtrust_epm?.event?.rule?.description != null + value: '{{{beyondtrust_epm.event.rule.description}}}' + allow_duplicates: false + - append: + field: rule.id + tag: append_beyondtrust_epm_event_rule_id_into_rule_id + if: ctx.beyondtrust_epm?.event?.rule?.id != null + value: '{{{beyondtrust_epm.event.rule.id}}}' + allow_duplicates: false + - set: + field: rule.license + tag: set_rule_license_from_event_rule_license + copy_from: beyondtrust_epm.event.rule.license + ignore_empty_value: true + - append: + field: rule.name + tag: append_beyondtrust_epm_event_rule_name_into_rule_name + if: ctx.beyondtrust_epm?.event?.rule?.name != null + value: '{{{beyondtrust_epm.event.rule.name}}}' + allow_duplicates: false + - set: + field: rule.reference + tag: set_rule_reference_from_event_rule_reference + copy_from: beyondtrust_epm.event.rule.reference + ignore_empty_value: true + - set: + field: rule.ruleset + tag: set_rule_ruleset_from_event_rule_ruleset + copy_from: beyondtrust_epm.event.rule.ruleset + ignore_empty_value: true + - set: + field: rule.uuid + tag: set_rule_uuid_from_event_rule_uuid + copy_from: beyondtrust_epm.event.rule.uuid + ignore_empty_value: true + - set: + field: rule.version + tag: set_rule_version_from_event_rule_version + copy_from: beyondtrust_epm.event.rule.version + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.enrichments + tag: foreach_threat_enrichments_matched_atomic + if: ctx.beyondtrust_epm?.event?.threat?.enrichments instanceof List + processor: + append: + field: threat.enrichments.matched.atomic + tag: append_threat_enrichments_matched_atomic_into_threat_enrichments_matched_atomic + value: '{{{_ingest._value.matched.atomic}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.enrichments + tag: foreach_threat_enrichments_matched_field + if: ctx.beyondtrust_epm?.event?.threat?.enrichments instanceof List + processor: + append: + field: threat.enrichments.matched.field + tag: append_threat_enrichments_matched_field_into_threat_enrichments_matched_field + value: '{{{_ingest._value.matched.field}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.enrichments + tag: foreach_threat_enrichments_matched_id + if: ctx.beyondtrust_epm?.event?.threat?.enrichments instanceof List + processor: + append: + field: threat.enrichments.matched.id + tag: append_threat_enrichments_matched_id_into_threat_enrichments_matched_id + value: '{{{_ingest._value.matched.id}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.enrichments + tag: foreach_threat_enrichments_matched_index + if: ctx.beyondtrust_epm?.event?.threat?.enrichments instanceof List + processor: + append: + field: threat.enrichments.matched.index + tag: append_threat_enrichments_matched_index_into_threat_enrichments_matched_index + value: '{{{_ingest._value.matched.index}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.enrichments + tag: foreach_threat_enrichments_matched_occurred + if: ctx.beyondtrust_epm?.event?.threat?.enrichments instanceof List + processor: + date: + field: _ingest._value.matched.occurred + tag: date_threat_enrichments_matched_occurred + target_field: _ingest._value.matched.occurred + formats: + - ISO8601 + on_failure: + - remove: + field: + - _ingest._value.matched.occurred + ignore_missing: true + - foreach: + field: beyondtrust_epm.event.threat.enrichments + tag: foreach_threat_enrichments_matched_occurred + if: ctx.beyondtrust_epm?.event?.threat?.enrichments instanceof List + processor: + append: + field: threat.enrichments.matched.occurred + tag: append_threat_enrichments_matched_occurred_into_threat_enrichments_matched_occurred + value: '{{{_ingest._value.matched.occurred}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.enrichments + tag: foreach_threat_enrichments_matched_type + if: ctx.beyondtrust_epm?.event?.threat?.enrichments instanceof List + processor: + append: + field: threat.enrichments.matched.type + tag: append_threat_enrichments_matched_type_into_threat_enrichments_matched_type + value: '{{{_ingest._value.matched.type}}}' + allow_duplicates: false + - set: + field: threat.feed.dashboard_id + tag: set_threat_feed_dashboard_id_from_event_threat_feed_dashboard_id + copy_from: beyondtrust_epm.event.threat.feed.dashboard_id + ignore_empty_value: true + - set: + field: threat.feed.description + tag: set_threat_feed_description_from_event_threat_feed_description + copy_from: beyondtrust_epm.event.threat.feed.description + ignore_empty_value: true + - set: + field: threat.feed.name + tag: set_threat_feed_name_from_event_threat_feed_name + copy_from: beyondtrust_epm.event.threat.feed.name + ignore_empty_value: true + - set: + field: threat.feed.reference + tag: set_threat_feed_reference_from_event_threat_feed_reference + copy_from: beyondtrust_epm.event.threat.feed.reference + ignore_empty_value: true + - set: + field: threat.framework + tag: set_threat_framework_from_event_threat_framework + copy_from: beyondtrust_epm.event.threat.framework + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.group.alias + tag: foreach_threat_group_alias + if: ctx.beyondtrust_epm?.event?.threat?.group?.alias instanceof List + processor: + append: + field: threat.group.alias + tag: append_threat_group_alias_into_threat_group_alias + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.group.id + tag: set_threat_group_id_from_event_threat_group_id + copy_from: beyondtrust_epm.event.threat.group.id + ignore_empty_value: true + - set: + field: threat.group.name + tag: set_threat_group_name_from_event_threat_group_name + copy_from: beyondtrust_epm.event.threat.group.name + ignore_empty_value: true + - set: + field: threat.group.reference + tag: set_threat_group_reference_from_event_threat_group_reference + copy_from: beyondtrust_epm.event.threat.group.reference + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.as.number + tag: convert_threat_indicator_as_number_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.as.number + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.as.number + tag: set_threat_indicator_as_number_from_event_threat_indicator_as_number + copy_from: beyondtrust_epm.event.threat.indicator.as.number + ignore_empty_value: true + - set: + field: threat.indicator.as.organization.name + tag: set_threat_indicator_as_organization_name_from_event_threat_indicator_as_organization_name + copy_from: beyondtrust_epm.event.threat.indicator.as.organization.name + ignore_empty_value: true + - set: + field: threat.indicator.confidence + tag: set_threat_indicator_confidence_from_event_threat_indicator_confidence + copy_from: beyondtrust_epm.event.threat.indicator.confidence + ignore_empty_value: true + - set: + field: threat.indicator.description + tag: set_threat_indicator_description_from_event_threat_indicator_description + copy_from: beyondtrust_epm.event.threat.indicator.description + ignore_empty_value: true + - set: + field: threat.indicator.email.address + tag: set_threat_indicator_email_address_from_event_threat_indicator_email_address + copy_from: beyondtrust_epm.event.threat.indicator.email.address + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.file.accessed + tag: date_threat_indicator_file_accessed + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.accessed != null && ctx.beyondtrust_epm.event.threat.indicator.file.accessed != '' + target_field: beyondtrust_epm.event.threat.indicator.file.accessed + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.accessed + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.accessed + tag: set_threat_indicator_file_accessed_from_event_threat_indicator_file_accessed + copy_from: beyondtrust_epm.event.threat.indicator.file.accessed + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.attributes + tag: foreach_threat_indicator_file_attributes + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.attributes instanceof List + processor: + append: + field: threat.indicator.file.attributes + tag: append_threat_indicator_file_attributes_into_threat_indicator_file_attributes + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.code_signature.digest_algorithm + tag: set_threat_indicator_file_code_signature_digest_algorithm_from_event_threat_indicator_file_code_signature_digest_algorithm + copy_from: beyondtrust_epm.event.threat.indicator.file.code_signature.digest_algorithm + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.file.code_signature.exists + tag: convert_threat_indicator_file_code_signature_exists_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.code_signature.exists + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.code_signature.exists + tag: set_threat_indicator_file_code_signature_exists_from_event_threat_indicator_file_code_signature_exists + copy_from: beyondtrust_epm.event.threat.indicator.file.code_signature.exists + ignore_empty_value: true + - set: + field: threat.indicator.file.code_signature.signing_id + tag: set_threat_indicator_file_code_signature_signing_id_from_event_threat_indicator_file_code_signature_signing_id + copy_from: beyondtrust_epm.event.threat.indicator.file.code_signature.signing_id + ignore_empty_value: true + - set: + field: threat.indicator.file.code_signature.status + tag: set_threat_indicator_file_code_signature_status_from_event_threat_indicator_file_code_signature_status + copy_from: beyondtrust_epm.event.threat.indicator.file.code_signature.status + ignore_empty_value: true + - set: + field: threat.indicator.file.code_signature.subject_name + tag: set_threat_indicator_file_code_signature_subject_name_from_event_threat_indicator_file_code_signature_subject_name + copy_from: beyondtrust_epm.event.threat.indicator.file.code_signature.subject_name + ignore_empty_value: true + - set: + field: threat.indicator.file.code_signature.team_id + tag: set_threat_indicator_file_code_signature_team_id_from_event_threat_indicator_file_code_signature_team_id + copy_from: beyondtrust_epm.event.threat.indicator.file.code_signature.team_id + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.file.code_signature.timestamp + tag: date_threat_indicator_file_code_signature_timestamp + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.code_signature?.timestamp != null && ctx.beyondtrust_epm.event.threat.indicator.file.code_signature.timestamp != '' + target_field: beyondtrust_epm.event.threat.indicator.file.code_signature.timestamp + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.code_signature.timestamp + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.code_signature.timestamp + tag: set_threat_indicator_file_code_signature_timestamp_from_event_threat_indicator_file_code_signature_timestamp + copy_from: beyondtrust_epm.event.threat.indicator.file.code_signature.timestamp + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.file.code_signature.trusted + tag: convert_threat_indicator_file_code_signature_trusted_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.code_signature.trusted + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.code_signature.trusted + tag: set_threat_indicator_file_code_signature_trusted_from_event_threat_indicator_file_code_signature_trusted + copy_from: beyondtrust_epm.event.threat.indicator.file.code_signature.trusted + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.file.code_signature.valid + tag: convert_threat_indicator_file_code_signature_valid_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.code_signature.valid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.code_signature.valid + tag: set_threat_indicator_file_code_signature_valid_from_event_threat_indicator_file_code_signature_valid + copy_from: beyondtrust_epm.event.threat.indicator.file.code_signature.valid + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.file.created + tag: date_threat_indicator_file_created + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.created != null && ctx.beyondtrust_epm.event.threat.indicator.file.created != '' + target_field: beyondtrust_epm.event.threat.indicator.file.created + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.created + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.created + tag: set_threat_indicator_file_created_from_event_threat_indicator_file_created + copy_from: beyondtrust_epm.event.threat.indicator.file.created + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.file.ctime + tag: date_threat_indicator_file_ctime + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.ctime != null && ctx.beyondtrust_epm.event.threat.indicator.file.ctime != '' + target_field: beyondtrust_epm.event.threat.indicator.file.ctime + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.ctime + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.ctime + tag: set_threat_indicator_file_ctime_from_event_threat_indicator_file_ctime + copy_from: beyondtrust_epm.event.threat.indicator.file.ctime + ignore_empty_value: true + - set: + field: threat.indicator.file.device + tag: set_threat_indicator_file_device_from_event_threat_indicator_file_device + copy_from: beyondtrust_epm.event.threat.indicator.file.device + ignore_empty_value: true + - set: + field: threat.indicator.file.directory + tag: set_threat_indicator_file_directory_from_event_threat_indicator_file_directory + copy_from: beyondtrust_epm.event.threat.indicator.file.directory + ignore_empty_value: true + - set: + field: threat.indicator.file.drive_letter + tag: set_threat_indicator_file_drive_letter_from_event_threat_indicator_file_drive_letter + copy_from: beyondtrust_epm.event.threat.indicator.file.drive_letter + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.architecture + tag: set_threat_indicator_file_elf_architecture_from_event_threat_indicator_file_elf_architecture + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.architecture + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.byte_order + tag: set_threat_indicator_file_elf_byte_order_from_event_threat_indicator_file_elf_byte_order + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.byte_order + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.cpu_type + tag: set_threat_indicator_file_elf_cpu_type_from_event_threat_indicator_file_elf_cpu_type + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.cpu_type + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.file.elf.creation_date + tag: date_threat_indicator_file_elf_creation_date + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.creation_date != null && ctx.beyondtrust_epm.event.threat.indicator.file.elf.creation_date != '' + target_field: beyondtrust_epm.event.threat.indicator.file.elf.creation_date + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.elf.creation_date + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.elf.creation_date + tag: set_threat_indicator_file_elf_creation_date_from_event_threat_indicator_file_elf_creation_date + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.creation_date + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.header.abi_version + tag: set_threat_indicator_file_elf_header_abi_version_from_event_threat_indicator_file_elf_header_abi_version + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.header.abi_version + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.header.class + tag: set_threat_indicator_file_elf_header_class_from_event_threat_indicator_file_elf_header_class + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.header.class + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.header.data + tag: set_threat_indicator_file_elf_header_data_from_event_threat_indicator_file_elf_header_data + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.header.data + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.file.elf.header.entrypoint + tag: convert_threat_indicator_file_elf_header_entrypoint_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.elf.header.entrypoint + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.elf.header.entrypoint + tag: set_threat_indicator_file_elf_header_entrypoint_from_event_threat_indicator_file_elf_header_entrypoint + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.header.entrypoint + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.header.object_version + tag: set_threat_indicator_file_elf_header_object_version_from_event_threat_indicator_file_elf_header_object_version + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.header.object_version + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.header.os_abi + tag: set_threat_indicator_file_elf_header_os_abi_from_event_threat_indicator_file_elf_header_os_abi + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.header.os_abi + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.header.type + tag: set_threat_indicator_file_elf_header_type_from_event_threat_indicator_file_elf_header_type + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.header.type + ignore_empty_value: true + - set: + field: threat.indicator.file.elf.header.version + tag: set_threat_indicator_file_elf_header_version_from_event_threat_indicator_file_elf_header_version + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.header.version + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections_chi2 + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.chi2 + tag: convert_threat_indicator_file_elf_sections_chi2_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.chi2 + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections_entropy + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.entropy + tag: convert_threat_indicator_file_elf_sections_entropy_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.entropy + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections_flags + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + append: + field: threat.indicator.file.elf.sections.flags + tag: append_threat_indicator_file_elf_sections_flags_into_threat_indicator_file_elf_sections_flags + value: '{{{_ingest._value.flags}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections_name + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + append: + field: threat.indicator.file.elf.sections.name + tag: append_threat_indicator_file_elf_sections_name_into_threat_indicator_file_elf_sections_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections_physical_offset + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + append: + field: threat.indicator.file.elf.sections.physical_offset + tag: append_threat_indicator_file_elf_sections_physical_offset_into_threat_indicator_file_elf_sections_physical_offset + value: '{{{_ingest._value.physical_offset}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections_physical_size + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.physical_size + tag: convert_threat_indicator_file_elf_sections_physical_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.physical_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections_type + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + append: + field: threat.indicator.file.elf.sections.type + tag: append_threat_indicator_file_elf_sections_type_into_threat_indicator_file_elf_sections_type + value: '{{{_ingest._value.type}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections_virtual_address + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.virtual_address + tag: convert_threat_indicator_file_elf_sections_virtual_address_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.virtual_address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections_virtual_size + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + convert: + field: _ingest._value.virtual_size + tag: convert_threat_indicator_file_elf_sections_virtual_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: + - _ingest._value.virtual_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.elf.sections + tag: set_threat_indicator_file_elf_sections_from_event_threat_indicator_file_elf_sections + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.sections + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.segments + tag: foreach_threat_indicator_file_elf_segments_sections + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.segments instanceof List + processor: + append: + field: threat.indicator.file.elf.segments.sections + tag: append_threat_indicator_file_elf_segments_sections_into_threat_indicator_file_elf_segments_sections + value: '{{{_ingest._value.sections}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.segments + tag: foreach_threat_indicator_file_elf_segments_type + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.segments instanceof List + processor: + append: + field: threat.indicator.file.elf.segments.type + tag: append_threat_indicator_file_elf_segments_type_into_threat_indicator_file_elf_segments_type + value: '{{{_ingest._value.type}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.shared_libraries + tag: foreach_threat_indicator_file_elf_shared_libraries + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.shared_libraries instanceof List + processor: + append: + field: threat.indicator.file.elf.shared_libraries + tag: append_threat_indicator_file_elf_shared_libraries_into_threat_indicator_file_elf_shared_libraries + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.elf.telfhash + tag: set_threat_indicator_file_elf_telfhash_from_event_threat_indicator_file_elf_telfhash + copy_from: beyondtrust_epm.event.threat.indicator.file.elf.telfhash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_elf_telfhash_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.telfhash != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.elf.telfhash}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.extension + tag: set_threat_indicator_file_extension_from_event_threat_indicator_file_extension + copy_from: beyondtrust_epm.event.threat.indicator.file.extension + ignore_empty_value: true + - set: + field: threat.indicator.file.fork_name + tag: set_threat_indicator_file_fork_name_from_event_threat_indicator_file_fork_name + copy_from: beyondtrust_epm.event.threat.indicator.file.fork_name + ignore_empty_value: true + - set: + field: threat.indicator.file.gid + tag: set_threat_indicator_file_gid_from_event_threat_indicator_file_gid + copy_from: beyondtrust_epm.event.threat.indicator.file.gid + ignore_empty_value: true + - set: + field: threat.indicator.file.group + tag: set_threat_indicator_file_group_from_event_threat_indicator_file_group + copy_from: beyondtrust_epm.event.threat.indicator.file.group + ignore_empty_value: true + - set: + field: threat.indicator.file.hash.md5 + tag: set_threat_indicator_file_hash_md5_from_event_threat_indicator_file_hash_md5 + copy_from: beyondtrust_epm.event.threat.indicator.file.hash.md5 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_hash_md5_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.hash?.md5 != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.hash.md5}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.hash.sha1 + tag: set_threat_indicator_file_hash_sha1_from_event_threat_indicator_file_hash_sha1 + copy_from: beyondtrust_epm.event.threat.indicator.file.hash.sha1 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_hash_sha1_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.hash?.sha1 != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.hash.sha1}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.hash.sha256 + tag: set_threat_indicator_file_hash_sha256_from_event_threat_indicator_file_hash_sha256 + copy_from: beyondtrust_epm.event.threat.indicator.file.hash.sha256 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_hash_sha256_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.hash?.sha256 != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.hash.sha256}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.hash.sha384 + tag: set_threat_indicator_file_hash_sha384_from_event_threat_indicator_file_hash_sha384 + copy_from: beyondtrust_epm.event.threat.indicator.file.hash.sha384 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_hash_sha384_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.hash?.sha384 != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.hash.sha384}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.hash.sha512 + tag: set_threat_indicator_file_hash_sha512_from_event_threat_indicator_file_hash_sha512 + copy_from: beyondtrust_epm.event.threat.indicator.file.hash.sha512 + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_hash_sha512_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.hash?.sha512 != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.hash.sha512}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.hash.ssdeep + tag: set_threat_indicator_file_hash_ssdeep_from_event_threat_indicator_file_hash_ssdeep + copy_from: beyondtrust_epm.event.threat.indicator.file.hash.ssdeep + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_hash_ssdeep_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.hash?.ssdeep != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.hash.ssdeep}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.hash.tlsh + tag: set_threat_indicator_file_hash_tlsh_from_event_threat_indicator_file_hash_tlsh + copy_from: beyondtrust_epm.event.threat.indicator.file.hash.tlsh + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_hash_tlsh_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.hash?.tlsh != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.hash.tlsh}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.inode + tag: set_threat_indicator_file_inode_from_event_threat_indicator_file_inode + copy_from: beyondtrust_epm.event.threat.indicator.file.inode + ignore_empty_value: true + - set: + field: threat.indicator.file.mime_type + tag: set_threat_indicator_file_mime_type_from_event_threat_indicator_file_mime_type + copy_from: beyondtrust_epm.event.threat.indicator.file.mime_type + ignore_empty_value: true + - set: + field: threat.indicator.file.mode + tag: set_threat_indicator_file_mode_from_event_threat_indicator_file_mode + copy_from: beyondtrust_epm.event.threat.indicator.file.mode + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.file.mtime + tag: date_threat_indicator_file_mtime + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.mtime != null && ctx.beyondtrust_epm.event.threat.indicator.file.mtime != '' + target_field: beyondtrust_epm.event.threat.indicator.file.mtime + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.mtime + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.mtime + tag: set_threat_indicator_file_mtime_from_event_threat_indicator_file_mtime + copy_from: beyondtrust_epm.event.threat.indicator.file.mtime + ignore_empty_value: true + - set: + field: threat.indicator.file.name + tag: set_threat_indicator_file_name_from_event_threat_indicator_file_name + copy_from: beyondtrust_epm.event.threat.indicator.file.name + ignore_empty_value: true + - set: + field: threat.indicator.file.path + tag: set_threat_indicator_file_path_from_event_threat_indicator_file_path + copy_from: beyondtrust_epm.event.threat.indicator.file.path + ignore_empty_value: true + - set: + field: threat.indicator.file.pe.architecture + tag: set_threat_indicator_file_pe_architecture_from_event_threat_indicator_file_pe_architecture + copy_from: beyondtrust_epm.event.threat.indicator.file.pe.architecture + ignore_empty_value: true + - set: + field: threat.indicator.file.pe.company + tag: set_threat_indicator_file_pe_company_from_event_threat_indicator_file_pe_company + copy_from: beyondtrust_epm.event.threat.indicator.file.pe.company + ignore_empty_value: true + - set: + field: threat.indicator.file.pe.description + tag: set_threat_indicator_file_pe_description_from_event_threat_indicator_file_pe_description + copy_from: beyondtrust_epm.event.threat.indicator.file.pe.description + ignore_empty_value: true + - set: + field: threat.indicator.file.pe.file_version + tag: set_threat_indicator_file_pe_file_version_from_event_threat_indicator_file_pe_file_version + copy_from: beyondtrust_epm.event.threat.indicator.file.pe.file_version + ignore_empty_value: true + - set: + field: threat.indicator.file.pe.imphash + tag: set_threat_indicator_file_pe_imphash_from_event_threat_indicator_file_pe_imphash + copy_from: beyondtrust_epm.event.threat.indicator.file.pe.imphash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_pe_imphash_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.pe?.imphash != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.pe.imphash}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.pe.original_file_name + tag: set_threat_indicator_file_pe_original_file_name_from_event_threat_indicator_file_pe_original_file_name + copy_from: beyondtrust_epm.event.threat.indicator.file.pe.original_file_name + ignore_empty_value: true + - set: + field: threat.indicator.file.pe.pehash + tag: set_threat_indicator_file_pe_pehash_from_event_threat_indicator_file_pe_pehash + copy_from: beyondtrust_epm.event.threat.indicator.file.pe.pehash + ignore_empty_value: true + - append: + field: related.hash + tag: append_event_threat_indicator_file_pe_pehash_into_related_hash + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.pe?.pehash != null + value: '{{{beyondtrust_epm.event.threat.indicator.file.pe.pehash}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.pe.product + tag: set_threat_indicator_file_pe_product_from_event_threat_indicator_file_pe_product + copy_from: beyondtrust_epm.event.threat.indicator.file.pe.product + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.file.size + tag: convert_threat_indicator_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.size + tag: set_threat_indicator_file_size_from_event_threat_indicator_file_size + copy_from: beyondtrust_epm.event.threat.indicator.file.size + ignore_empty_value: true + - set: + field: threat.indicator.file.target_path + tag: set_threat_indicator_file_target_path_from_event_threat_indicator_file_target_path + copy_from: beyondtrust_epm.event.threat.indicator.file.target_path + ignore_empty_value: true + - set: + field: threat.indicator.file.type + tag: set_threat_indicator_file_type_from_event_threat_indicator_file_type + copy_from: beyondtrust_epm.event.threat.indicator.file.type + ignore_empty_value: true + - set: + field: threat.indicator.file.uid + tag: set_threat_indicator_file_uid_from_event_threat_indicator_file_uid + copy_from: beyondtrust_epm.event.threat.indicator.file.uid + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.alternative_names + tag: foreach_threat_indicator_file_x509_alternative_names + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.alternative_names instanceof List + processor: + append: + field: threat.indicator.file.x509.alternative_names + tag: append_threat_indicator_file_x509_alternative_names_into_threat_indicator_file_x509_alternative_names + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.issuer.common_name + tag: foreach_threat_indicator_file_x509_issuer_common_name + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.issuer?.common_name instanceof List + processor: + append: + field: threat.indicator.file.x509.issuer.common_name + tag: append_threat_indicator_file_x509_issuer_common_name_into_threat_indicator_file_x509_issuer_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.issuer.country + tag: foreach_threat_indicator_file_x509_issuer_country + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.issuer?.country instanceof List + processor: + append: + field: threat.indicator.file.x509.issuer.country + tag: append_threat_indicator_file_x509_issuer_country_into_threat_indicator_file_x509_issuer_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.x509.issuer.distinguished_name + tag: set_threat_indicator_file_x509_issuer_distinguished_name_from_event_threat_indicator_file_x509_issuer_distinguished_name + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.issuer.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.issuer.locality + tag: foreach_threat_indicator_file_x509_issuer_locality + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.issuer?.locality instanceof List + processor: + append: + field: threat.indicator.file.x509.issuer.locality + tag: append_threat_indicator_file_x509_issuer_locality_into_threat_indicator_file_x509_issuer_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.issuer.organization + tag: foreach_threat_indicator_file_x509_issuer_organization + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.issuer?.organization instanceof List + processor: + append: + field: threat.indicator.file.x509.issuer.organization + tag: append_threat_indicator_file_x509_issuer_organization_into_threat_indicator_file_x509_issuer_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.issuer.organizational_unit + tag: foreach_threat_indicator_file_x509_issuer_organizational_unit + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.issuer?.organizational_unit instanceof List + processor: + append: + field: threat.indicator.file.x509.issuer.organizational_unit + tag: append_threat_indicator_file_x509_issuer_organizational_unit_into_threat_indicator_file_x509_issuer_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.issuer.state_or_province + tag: foreach_threat_indicator_file_x509_issuer_state_or_province + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.issuer?.state_or_province instanceof List + processor: + append: + field: threat.indicator.file.x509.issuer.state_or_province + tag: append_threat_indicator_file_x509_issuer_state_or_province_into_threat_indicator_file_x509_issuer_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - date: + field: beyondtrust_epm.event.threat.indicator.file.x509.not_after + tag: date_threat_indicator_file_x509_not_after + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.not_after != null && ctx.beyondtrust_epm.event.threat.indicator.file.x509.not_after != '' + target_field: beyondtrust_epm.event.threat.indicator.file.x509.not_after + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.x509.not_after + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.x509.not_after + tag: set_threat_indicator_file_x509_not_after_from_event_threat_indicator_file_x509_not_after + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.not_after + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.file.x509.not_before + tag: date_threat_indicator_file_x509_not_before + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.not_before != null && ctx.beyondtrust_epm.event.threat.indicator.file.x509.not_before != '' + target_field: beyondtrust_epm.event.threat.indicator.file.x509.not_before + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.x509.not_before + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.x509.not_before + tag: set_threat_indicator_file_x509_not_before_from_event_threat_indicator_file_x509_not_before + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.not_before + ignore_empty_value: true + - set: + field: threat.indicator.file.x509.public_key_algorithm + tag: set_threat_indicator_file_x509_public_key_algorithm_from_event_threat_indicator_file_x509_public_key_algorithm + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.public_key_algorithm + ignore_empty_value: true + - set: + field: threat.indicator.file.x509.public_key_curve + tag: set_threat_indicator_file_x509_public_key_curve_from_event_threat_indicator_file_x509_public_key_curve + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.public_key_curve + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.file.x509.public_key_exponent + tag: convert_threat_indicator_file_x509_public_key_exponent_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.x509.public_key_exponent + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.x509.public_key_exponent + tag: set_threat_indicator_file_x509_public_key_exponent_from_event_threat_indicator_file_x509_public_key_exponent + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.public_key_exponent + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.file.x509.public_key_size + tag: convert_threat_indicator_file_x509_public_key_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.file.x509.public_key_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.file.x509.public_key_size + tag: set_threat_indicator_file_x509_public_key_size_from_event_threat_indicator_file_x509_public_key_size + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.public_key_size + ignore_empty_value: true + - set: + field: threat.indicator.file.x509.serial_number + tag: set_threat_indicator_file_x509_serial_number_from_event_threat_indicator_file_x509_serial_number + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.serial_number + ignore_empty_value: true + - set: + field: threat.indicator.file.x509.signature_algorithm + tag: set_threat_indicator_file_x509_signature_algorithm_from_event_threat_indicator_file_x509_signature_algorithm + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.signature_algorithm + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.subject.common_name + tag: foreach_threat_indicator_file_x509_subject_common_name + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.subject?.common_name instanceof List + processor: + append: + field: threat.indicator.file.x509.subject.common_name + tag: append_threat_indicator_file_x509_subject_common_name_into_threat_indicator_file_x509_subject_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.subject.country + tag: foreach_threat_indicator_file_x509_subject_country + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.subject?.country instanceof List + processor: + append: + field: threat.indicator.file.x509.subject.country + tag: append_threat_indicator_file_x509_subject_country_into_threat_indicator_file_x509_subject_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.x509.subject.distinguished_name + tag: set_threat_indicator_file_x509_subject_distinguished_name_from_event_threat_indicator_file_x509_subject_distinguished_name + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.subject.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.subject.locality + tag: foreach_threat_indicator_file_x509_subject_locality + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.subject?.locality instanceof List + processor: + append: + field: threat.indicator.file.x509.subject.locality + tag: append_threat_indicator_file_x509_subject_locality_into_threat_indicator_file_x509_subject_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.subject.organization + tag: foreach_threat_indicator_file_x509_subject_organization + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.subject?.organization instanceof List + processor: + append: + field: threat.indicator.file.x509.subject.organization + tag: append_threat_indicator_file_x509_subject_organization_into_threat_indicator_file_x509_subject_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.subject.organizational_unit + tag: foreach_threat_indicator_file_x509_subject_organizational_unit + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.subject?.organizational_unit instanceof List + processor: + append: + field: threat.indicator.file.x509.subject.organizational_unit + tag: append_threat_indicator_file_x509_subject_organizational_unit_into_threat_indicator_file_x509_subject_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.x509.subject.state_or_province + tag: foreach_threat_indicator_file_x509_subject_state_or_province + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.x509?.subject?.state_or_province instanceof List + processor: + append: + field: threat.indicator.file.x509.subject.state_or_province + tag: append_threat_indicator_file_x509_subject_state_or_province_into_threat_indicator_file_x509_subject_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.indicator.file.x509.version_number + tag: set_threat_indicator_file_x509_version_number_from_event_threat_indicator_file_x509_version_number + copy_from: beyondtrust_epm.event.threat.indicator.file.x509.version_number + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.first_seen + tag: date_threat_indicator_first_seen + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.first_seen != null && ctx.beyondtrust_epm.event.threat.indicator.first_seen != '' + target_field: beyondtrust_epm.event.threat.indicator.first_seen + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.first_seen + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.first_seen + tag: set_threat_indicator_first_seen_from_event_threat_indicator_first_seen + copy_from: beyondtrust_epm.event.threat.indicator.first_seen + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.geo.TimezoneOffset + tag: convert_threat_indicator_geo_TimezoneOffset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.geo.TimezoneOffset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.geo.city_name + tag: set_threat_indicator_geo_city_name_from_event_threat_indicator_geo_city_name + copy_from: beyondtrust_epm.event.threat.indicator.geo.city_name + ignore_empty_value: true + - set: + field: threat.indicator.geo.continent_code + tag: set_threat_indicator_geo_continent_code_from_event_threat_indicator_geo_continent_code + copy_from: beyondtrust_epm.event.threat.indicator.geo.continent_code + ignore_empty_value: true + - set: + field: threat.indicator.geo.continent_name + tag: set_threat_indicator_geo_continent_name_from_event_threat_indicator_geo_continent_name + copy_from: beyondtrust_epm.event.threat.indicator.geo.continent_name + ignore_empty_value: true + - set: + field: threat.indicator.geo.country_iso_code + tag: set_threat_indicator_geo_country_iso_code_from_event_threat_indicator_geo_country_iso_code + copy_from: beyondtrust_epm.event.threat.indicator.geo.country_iso_code + ignore_empty_value: true + - set: + field: threat.indicator.geo.country_name + tag: set_threat_indicator_geo_country_name_from_event_threat_indicator_geo_country_name + copy_from: beyondtrust_epm.event.threat.indicator.geo.country_name + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.geo.location.lat + tag: convert_threat_indicator_geo_location_lat_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.geo.location.lat + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: beyondtrust_epm.event.threat.indicator.geo.location.lon + tag: convert_threat_indicator_geo_location_lon_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.geo.location.lon + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + tag: set_threat_indicator_geo_location_from_lat_lon + lang: painless + description: Combine lat/lon into geo_point. + if: >- + ctx.beyondtrust_epm?.event?.threat?.indicator?.geo?.location?.lat != null + && ctx.beyondtrust_epm?.event?.threat?.indicator?.geo?.location?.lon != null + source: |- + def location = new HashMap(); + location.put('lat', ctx.beyondtrust_epm.event.threat.indicator.geo.location.lat); + location.put('lon', ctx.beyondtrust_epm.event.threat.indicator.geo.location.lon); + ctx.beyondtrust_epm.event.threat.indicator.geo.location = location; + - set: + field: threat.indicator.geo.location + tag: set_threat_indicator_geo_location_from_event + copy_from: beyondtrust_epm.event.threat.indicator.geo.location + ignore_empty_value: true + - set: + field: threat.indicator.geo.name + tag: set_threat_indicator_geo_name_from_event_threat_indicator_geo_name + copy_from: beyondtrust_epm.event.threat.indicator.geo.name + ignore_empty_value: true + - set: + field: threat.indicator.geo.postal_code + tag: set_threat_indicator_geo_postal_code_from_event_threat_indicator_geo_postal_code + copy_from: beyondtrust_epm.event.threat.indicator.geo.postal_code + ignore_empty_value: true + - set: + field: threat.indicator.geo.region_iso_code + tag: set_threat_indicator_geo_region_iso_code_from_event_threat_indicator_geo_region_iso_code + copy_from: beyondtrust_epm.event.threat.indicator.geo.region_iso_code + ignore_empty_value: true + - set: + field: threat.indicator.geo.region_name + tag: set_threat_indicator_geo_region_name_from_event_threat_indicator_geo_region_name + copy_from: beyondtrust_epm.event.threat.indicator.geo.region_name + ignore_empty_value: true + - set: + field: threat.indicator.geo.timezone + tag: set_threat_indicator_geo_timezone_from_event_threat_indicator_geo_timezone + copy_from: beyondtrust_epm.event.threat.indicator.geo.timezone + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.ip + tag: convert_threat_indicator_ip_to_ip + type: ip + ignore_missing: true + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.ip != null + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.ip + tag: set_threat_indicator_ip_from_event_threat_indicator_ip + copy_from: beyondtrust_epm.event.threat.indicator.ip + ignore_empty_value: true + - append: + field: related.ip + tag: append_event_threat_indicator_ip_into_related_ip + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.ip != null + value: '{{{beyondtrust_epm.event.threat.indicator.ip}}}' + allow_duplicates: false + - date: + field: beyondtrust_epm.event.threat.indicator.last_seen + tag: date_threat_indicator_last_seen + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.last_seen != null && ctx.beyondtrust_epm.event.threat.indicator.last_seen != '' + target_field: beyondtrust_epm.event.threat.indicator.last_seen + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.last_seen + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.last_seen + tag: set_threat_indicator_last_seen_from_event_threat_indicator_last_seen + copy_from: beyondtrust_epm.event.threat.indicator.last_seen + ignore_empty_value: true + - set: + field: threat.indicator.marking.tlp + tag: set_threat_indicator_marking_tlp_from_event_threat_indicator_marking_tlp + copy_from: beyondtrust_epm.event.threat.indicator.marking.tlp + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.modified_at + tag: date_threat_indicator_modified_at + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.modified_at != null && ctx.beyondtrust_epm.event.threat.indicator.modified_at != '' + target_field: beyondtrust_epm.event.threat.indicator.modified_at + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.modified_at + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.modified_at + tag: set_threat_indicator_modified_at_from_event_threat_indicator_modified_at + copy_from: beyondtrust_epm.event.threat.indicator.modified_at + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.port + tag: convert_threat_indicator_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.port + tag: set_threat_indicator_port_from_event_threat_indicator_port + copy_from: beyondtrust_epm.event.threat.indicator.port + ignore_empty_value: true + - set: + field: threat.indicator.provider + tag: set_threat_indicator_provider_from_event_threat_indicator_provider + copy_from: beyondtrust_epm.event.threat.indicator.provider + ignore_empty_value: true + - set: + field: threat.indicator.reference + tag: set_threat_indicator_reference_from_event_threat_indicator_reference + copy_from: beyondtrust_epm.event.threat.indicator.reference + ignore_empty_value: true + - set: + field: threat.indicator.registry.data.bytes + tag: set_threat_indicator_registry_data_bytes_from_event_threat_indicator_registry_data_bytes + copy_from: beyondtrust_epm.event.threat.indicator.registry.data.bytes + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.registry.data.strings + tag: foreach_threat_indicator_registry_data_strings + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.registry?.data?.strings instanceof List + processor: + append: + field: threat.indicator.registry.data.strings + tag: append_threat_indicator_registry_data_strings_into_threat_indicator_registry_data_strings + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.indicator.registry.data.type + tag: set_threat_indicator_registry_data_type_from_event_threat_indicator_registry_data_type + copy_from: beyondtrust_epm.event.threat.indicator.registry.data.type + ignore_empty_value: true + - set: + field: threat.indicator.registry.hive + tag: set_threat_indicator_registry_hive_from_event_threat_indicator_registry_hive + copy_from: beyondtrust_epm.event.threat.indicator.registry.hive + ignore_empty_value: true + - set: + field: threat.indicator.registry.key + tag: set_threat_indicator_registry_key_from_event_threat_indicator_registry_key + copy_from: beyondtrust_epm.event.threat.indicator.registry.key + ignore_empty_value: true + - set: + field: threat.indicator.registry.path + tag: set_threat_indicator_registry_path_from_event_threat_indicator_registry_path + copy_from: beyondtrust_epm.event.threat.indicator.registry.path + ignore_empty_value: true + - set: + field: threat.indicator.registry.value + tag: set_threat_indicator_registry_value_from_event_threat_indicator_registry_value + copy_from: beyondtrust_epm.event.threat.indicator.registry.value + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.scanner_stats + tag: convert_threat_indicator_scanner_stats_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.scanner_stats + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.scanner_stats + tag: set_threat_indicator_scanner_stats_from_event_threat_indicator_scanner_stats + copy_from: beyondtrust_epm.event.threat.indicator.scanner_stats + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.sightings + tag: convert_threat_indicator_sightings_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.sightings + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.sightings + tag: set_threat_indicator_sightings_from_event_threat_indicator_sightings + copy_from: beyondtrust_epm.event.threat.indicator.sightings + ignore_empty_value: true + - set: + field: threat.indicator.type + tag: set_threat_indicator_type_from_event_threat_indicator_type + copy_from: beyondtrust_epm.event.threat.indicator.type + ignore_empty_value: true + - set: + field: threat.indicator.url.domain + tag: set_threat_indicator_url_domain_from_event_threat_indicator_url_domain + copy_from: beyondtrust_epm.event.threat.indicator.url.domain + ignore_empty_value: true + - set: + field: threat.indicator.url.extension + tag: set_threat_indicator_url_extension_from_event_threat_indicator_url_extension + copy_from: beyondtrust_epm.event.threat.indicator.url.extension + ignore_empty_value: true + - set: + field: threat.indicator.url.fragment + tag: set_threat_indicator_url_fragment_from_event_threat_indicator_url_fragment + copy_from: beyondtrust_epm.event.threat.indicator.url.fragment + ignore_empty_value: true + - set: + field: threat.indicator.url.full + tag: set_threat_indicator_url_full_from_event_threat_indicator_url_full + copy_from: beyondtrust_epm.event.threat.indicator.url.full + ignore_empty_value: true + - set: + field: threat.indicator.url.original + tag: set_threat_indicator_url_original_from_event_threat_indicator_url_original + copy_from: beyondtrust_epm.event.threat.indicator.url.original + ignore_empty_value: true + - set: + field: threat.indicator.url.password + tag: set_threat_indicator_url_password_from_event_threat_indicator_url_password + copy_from: beyondtrust_epm.event.threat.indicator.url.password + ignore_empty_value: true + - set: + field: threat.indicator.url.path + tag: set_threat_indicator_url_path_from_event_threat_indicator_url_path + copy_from: beyondtrust_epm.event.threat.indicator.url.path + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.url.port + tag: convert_threat_indicator_url_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.url.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.url.port + tag: set_threat_indicator_url_port_from_event_threat_indicator_url_port + copy_from: beyondtrust_epm.event.threat.indicator.url.port + ignore_empty_value: true + - set: + field: threat.indicator.url.query + tag: set_threat_indicator_url_query_from_event_threat_indicator_url_query + copy_from: beyondtrust_epm.event.threat.indicator.url.query + ignore_empty_value: true + - set: + field: threat.indicator.url.registered_domain + tag: set_threat_indicator_url_registered_domain_from_event_threat_indicator_url_registered_domain + copy_from: beyondtrust_epm.event.threat.indicator.url.registered_domain + ignore_empty_value: true + - set: + field: threat.indicator.url.scheme + tag: set_threat_indicator_url_scheme_from_event_threat_indicator_url_scheme + copy_from: beyondtrust_epm.event.threat.indicator.url.scheme + ignore_empty_value: true + - set: + field: threat.indicator.url.subdomain + tag: set_threat_indicator_url_subdomain_from_event_threat_indicator_url_subdomain + copy_from: beyondtrust_epm.event.threat.indicator.url.subdomain + ignore_empty_value: true + - set: + field: threat.indicator.url.top_level_domain + tag: set_threat_indicator_url_top_level_domain_from_event_threat_indicator_url_top_level_domain + copy_from: beyondtrust_epm.event.threat.indicator.url.top_level_domain + ignore_empty_value: true + - set: + field: threat.indicator.url.username + tag: set_threat_indicator_url_username_from_event_threat_indicator_url_username + copy_from: beyondtrust_epm.event.threat.indicator.url.username + ignore_empty_value: true + - append: + field: related.user + tag: append_event_threat_indicator_url_username_into_related_user + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.url?.username != null + value: '{{{beyondtrust_epm.event.threat.indicator.url.username}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.alternative_names + tag: foreach_threat_indicator_x509_alternative_names + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.alternative_names instanceof List + processor: + append: + field: threat.indicator.x509.alternative_names + tag: append_threat_indicator_x509_alternative_names_into_threat_indicator_x509_alternative_names + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.issuer.common_name + tag: foreach_threat_indicator_x509_issuer_common_name + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.issuer?.common_name instanceof List + processor: + append: + field: threat.indicator.x509.issuer.common_name + tag: append_threat_indicator_x509_issuer_common_name_into_threat_indicator_x509_issuer_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.issuer.country + tag: foreach_threat_indicator_x509_issuer_country + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.issuer?.country instanceof List + processor: + append: + field: threat.indicator.x509.issuer.country + tag: append_threat_indicator_x509_issuer_country_into_threat_indicator_x509_issuer_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.indicator.x509.issuer.distinguished_name + tag: set_threat_indicator_x509_issuer_distinguished_name_from_event_threat_indicator_x509_issuer_distinguished_name + copy_from: beyondtrust_epm.event.threat.indicator.x509.issuer.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.issuer.locality + tag: foreach_threat_indicator_x509_issuer_locality + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.issuer?.locality instanceof List + processor: + append: + field: threat.indicator.x509.issuer.locality + tag: append_threat_indicator_x509_issuer_locality_into_threat_indicator_x509_issuer_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.issuer.organization + tag: foreach_threat_indicator_x509_issuer_organization + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.issuer?.organization instanceof List + processor: + append: + field: threat.indicator.x509.issuer.organization + tag: append_threat_indicator_x509_issuer_organization_into_threat_indicator_x509_issuer_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.issuer.organizational_unit + tag: foreach_threat_indicator_x509_issuer_organizational_unit + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.issuer?.organizational_unit instanceof List + processor: + append: + field: threat.indicator.x509.issuer.organizational_unit + tag: append_threat_indicator_x509_issuer_organizational_unit_into_threat_indicator_x509_issuer_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.issuer.state_or_province + tag: foreach_threat_indicator_x509_issuer_state_or_province + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.issuer?.state_or_province instanceof List + processor: + append: + field: threat.indicator.x509.issuer.state_or_province + tag: append_threat_indicator_x509_issuer_state_or_province_into_threat_indicator_x509_issuer_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - date: + field: beyondtrust_epm.event.threat.indicator.x509.not_after + tag: date_threat_indicator_x509_not_after + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.not_after != null && ctx.beyondtrust_epm.event.threat.indicator.x509.not_after != '' + target_field: beyondtrust_epm.event.threat.indicator.x509.not_after + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.x509.not_after + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.x509.not_after + tag: set_threat_indicator_x509_not_after_from_event_threat_indicator_x509_not_after + copy_from: beyondtrust_epm.event.threat.indicator.x509.not_after + ignore_empty_value: true + - date: + field: beyondtrust_epm.event.threat.indicator.x509.not_before + tag: date_threat_indicator_x509_not_before + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.not_before != null && ctx.beyondtrust_epm.event.threat.indicator.x509.not_before != '' + target_field: beyondtrust_epm.event.threat.indicator.x509.not_before + formats: + - ISO8601 + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.x509.not_before + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.x509.not_before + tag: set_threat_indicator_x509_not_before_from_event_threat_indicator_x509_not_before + copy_from: beyondtrust_epm.event.threat.indicator.x509.not_before + ignore_empty_value: true + - set: + field: threat.indicator.x509.public_key_algorithm + tag: set_threat_indicator_x509_public_key_algorithm_from_event_threat_indicator_x509_public_key_algorithm + copy_from: beyondtrust_epm.event.threat.indicator.x509.public_key_algorithm + ignore_empty_value: true + - set: + field: threat.indicator.x509.public_key_curve + tag: set_threat_indicator_x509_public_key_curve_from_event_threat_indicator_x509_public_key_curve + copy_from: beyondtrust_epm.event.threat.indicator.x509.public_key_curve + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.x509.public_key_exponent + tag: convert_threat_indicator_x509_public_key_exponent_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.x509.public_key_exponent + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.x509.public_key_exponent + tag: set_threat_indicator_x509_public_key_exponent_from_event_threat_indicator_x509_public_key_exponent + copy_from: beyondtrust_epm.event.threat.indicator.x509.public_key_exponent + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.threat.indicator.x509.public_key_size + tag: convert_threat_indicator_x509_public_key_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.threat.indicator.x509.public_key_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: threat.indicator.x509.public_key_size + tag: set_threat_indicator_x509_public_key_size_from_event_threat_indicator_x509_public_key_size + copy_from: beyondtrust_epm.event.threat.indicator.x509.public_key_size + ignore_empty_value: true + - set: + field: threat.indicator.x509.serial_number + tag: set_threat_indicator_x509_serial_number_from_event_threat_indicator_x509_serial_number + copy_from: beyondtrust_epm.event.threat.indicator.x509.serial_number + ignore_empty_value: true + - set: + field: threat.indicator.x509.signature_algorithm + tag: set_threat_indicator_x509_signature_algorithm_from_event_threat_indicator_x509_signature_algorithm + copy_from: beyondtrust_epm.event.threat.indicator.x509.signature_algorithm + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.subject.common_name + tag: foreach_threat_indicator_x509_subject_common_name + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.subject?.common_name instanceof List + processor: + append: + field: threat.indicator.x509.subject.common_name + tag: append_threat_indicator_x509_subject_common_name_into_threat_indicator_x509_subject_common_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.subject.country + tag: foreach_threat_indicator_x509_subject_country + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.subject?.country instanceof List + processor: + append: + field: threat.indicator.x509.subject.country + tag: append_threat_indicator_x509_subject_country_into_threat_indicator_x509_subject_country + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.indicator.x509.subject.distinguished_name + tag: set_threat_indicator_x509_subject_distinguished_name_from_event_threat_indicator_x509_subject_distinguished_name + copy_from: beyondtrust_epm.event.threat.indicator.x509.subject.distinguished_name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.subject.locality + tag: foreach_threat_indicator_x509_subject_locality + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.subject?.locality instanceof List + processor: + append: + field: threat.indicator.x509.subject.locality + tag: append_threat_indicator_x509_subject_locality_into_threat_indicator_x509_subject_locality + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.subject.organization + tag: foreach_threat_indicator_x509_subject_organization + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.subject?.organization instanceof List + processor: + append: + field: threat.indicator.x509.subject.organization + tag: append_threat_indicator_x509_subject_organization_into_threat_indicator_x509_subject_organization + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.subject.organizational_unit + tag: foreach_threat_indicator_x509_subject_organizational_unit + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.subject?.organizational_unit instanceof List + processor: + append: + field: threat.indicator.x509.subject.organizational_unit + tag: append_threat_indicator_x509_subject_organizational_unit_into_threat_indicator_x509_subject_organizational_unit + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.indicator.x509.subject.state_or_province + tag: foreach_threat_indicator_x509_subject_state_or_province + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.x509?.subject?.state_or_province instanceof List + processor: + append: + field: threat.indicator.x509.subject.state_or_province + tag: append_threat_indicator_x509_subject_state_or_province_into_threat_indicator_x509_subject_state_or_province + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.indicator.x509.version_number + tag: set_threat_indicator_x509_version_number_from_event_threat_indicator_x509_version_number + copy_from: beyondtrust_epm.event.threat.indicator.x509.version_number + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.software.alias + tag: foreach_threat_software_alias + if: ctx.beyondtrust_epm?.event?.threat?.software?.alias instanceof List + processor: + append: + field: threat.software.alias + tag: append_threat_software_alias_into_threat_software_alias + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.software.id + tag: set_threat_software_id_from_event_threat_software_id + copy_from: beyondtrust_epm.event.threat.software.id + ignore_empty_value: true + - set: + field: threat.software.name + tag: set_threat_software_name_from_event_threat_software_name + copy_from: beyondtrust_epm.event.threat.software.name + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.software.platforms + tag: foreach_threat_software_platforms + if: ctx.beyondtrust_epm?.event?.threat?.software?.platforms instanceof List + processor: + append: + field: threat.software.platforms + tag: append_threat_software_platforms_into_threat_software_platforms + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: threat.software.reference + tag: set_threat_software_reference_from_event_threat_software_reference + copy_from: beyondtrust_epm.event.threat.software.reference + ignore_empty_value: true + - set: + field: threat.software.type + tag: set_threat_software_type_from_event_threat_software_type + copy_from: beyondtrust_epm.event.threat.software.type + ignore_empty_value: true + - foreach: + field: beyondtrust_epm.event.threat.tactic.id + tag: foreach_threat_tactic_id + if: ctx.beyondtrust_epm?.event?.threat?.tactic?.id instanceof List + processor: + append: + field: threat.tactic.id + tag: append_threat_tactic_id_into_threat_tactic_id + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.tactic.name + tag: foreach_threat_tactic_name + if: ctx.beyondtrust_epm?.event?.threat?.tactic?.name instanceof List + processor: + append: + field: threat.tactic.name + tag: append_threat_tactic_name_into_threat_tactic_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.tactic.reference + tag: foreach_threat_tactic_reference + if: ctx.beyondtrust_epm?.event?.threat?.tactic?.reference instanceof List + processor: + append: + field: threat.tactic.reference + tag: append_threat_tactic_reference_into_threat_tactic_reference + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.technique.id + tag: foreach_threat_technique_id + if: ctx.beyondtrust_epm?.event?.threat?.technique?.id instanceof List + processor: + append: + field: threat.technique.id + tag: append_threat_technique_id_into_threat_technique_id + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.technique.name + tag: foreach_threat_technique_name + if: ctx.beyondtrust_epm?.event?.threat?.technique?.name instanceof List + processor: + append: + field: threat.technique.name + tag: append_threat_technique_name_into_threat_technique_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.technique.reference + tag: foreach_threat_technique_reference + if: ctx.beyondtrust_epm?.event?.threat?.technique?.reference instanceof List + processor: + append: + field: threat.technique.reference + tag: append_threat_technique_reference_into_threat_technique_reference + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.technique.subtechnique.id + tag: foreach_threat_technique_subtechnique_id + if: ctx.beyondtrust_epm?.event?.threat?.technique?.subtechnique?.id instanceof List + processor: + append: + field: threat.technique.subtechnique.id + tag: append_threat_technique_subtechnique_id_into_threat_technique_subtechnique_id + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.technique.subtechnique.name + tag: foreach_threat_technique_subtechnique_name + if: ctx.beyondtrust_epm?.event?.threat?.technique?.subtechnique?.name instanceof List + processor: + append: + field: threat.technique.subtechnique.name + tag: append_threat_technique_subtechnique_name_into_threat_technique_subtechnique_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.technique.subtechnique.reference + tag: foreach_threat_technique_subtechnique_reference + if: ctx.beyondtrust_epm?.event?.threat?.technique?.subtechnique?.reference instanceof List + processor: + append: + field: threat.technique.subtechnique.reference + tag: append_threat_technique_subtechnique_reference_into_threat_technique_subtechnique_reference + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.vulnerability.category + tag: foreach_vulnerability_category + if: ctx.beyondtrust_epm?.event?.vulnerability?.category instanceof List + processor: + append: + field: vulnerability.category + tag: append_vulnerability_category_into_vulnerability_category + value: '{{{_ingest._value}}}' + allow_duplicates: false + - set: + field: vulnerability.classification + tag: set_vulnerability_classification_from_event_vulnerability_classification + copy_from: beyondtrust_epm.event.vulnerability.classification + ignore_empty_value: true + - set: + field: vulnerability.description + tag: set_vulnerability_description_from_event_vulnerability_description + copy_from: beyondtrust_epm.event.vulnerability.description + ignore_empty_value: true + - set: + field: vulnerability.enumeration + tag: set_vulnerability_enumeration_from_event_vulnerability_enumeration + copy_from: beyondtrust_epm.event.vulnerability.enumeration + ignore_empty_value: true + - set: + field: vulnerability.id + tag: set_vulnerability_id_from_event_vulnerability_id + copy_from: beyondtrust_epm.event.vulnerability.id + ignore_empty_value: true + - set: + field: vulnerability.reference + tag: set_vulnerability_reference_from_event_vulnerability_reference + copy_from: beyondtrust_epm.event.vulnerability.reference + ignore_empty_value: true + - set: + field: vulnerability.report_id + tag: set_vulnerability_report_id_from_event_vulnerability_report_id + copy_from: beyondtrust_epm.event.vulnerability.report_id + ignore_empty_value: true + - set: + field: vulnerability.scanner.vendor + tag: set_vulnerability_scanner_vendor_from_event_vulnerability_scanner_vendor + copy_from: beyondtrust_epm.event.vulnerability.scanner.vendor + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.vulnerability.score.base + tag: convert_vulnerability_score_base_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.vulnerability.score.base + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: vulnerability.score.base + tag: set_vulnerability_score_base_from_event_vulnerability_score_base + copy_from: beyondtrust_epm.event.vulnerability.score.base + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.vulnerability.score.environmental + tag: convert_vulnerability_score_environmental_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.vulnerability.score.environmental + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: vulnerability.score.environmental + tag: set_vulnerability_score_environmental_from_event_vulnerability_score_environmental + copy_from: beyondtrust_epm.event.vulnerability.score.environmental + ignore_empty_value: true + - convert: + field: beyondtrust_epm.event.vulnerability.score.temporal + tag: convert_vulnerability_score_temporal_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: beyondtrust_epm.event.vulnerability.score.temporal + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: vulnerability.score.temporal + tag: set_vulnerability_score_temporal_from_event_vulnerability_score_temporal + copy_from: beyondtrust_epm.event.vulnerability.score.temporal + ignore_empty_value: true + - set: + field: vulnerability.score.version + tag: set_vulnerability_score_version_from_event_vulnerability_score_version + copy_from: beyondtrust_epm.event.vulnerability.score.version + ignore_empty_value: true + - set: + field: vulnerability.severity + tag: set_vulnerability_severity_from_event_vulnerability_severity + copy_from: beyondtrust_epm.event.vulnerability.severity + ignore_empty_value: true + - append: + field: event.category + tag: append_event_category_threat + if: >- + ctx.threat != null + && (ctx.event?.category == null || !ctx.event.category.contains('threat')) + value: threat + allow_duplicates: false + - append: + field: event.category + tag: append_event_category_vulnerability + if: >- + ctx.vulnerability != null + && (ctx.event?.category == null || !ctx.event.category.contains('vulnerability')) + value: vulnerability + allow_duplicates: false + - foreach: + field: beyondtrust_epm.event.threat.enrichments + tag: foreach_threat_enrichments + if: ctx.beyondtrust_epm?.event?.threat?.enrichments instanceof List + processor: + remove: + field: + - _ingest._value.matched.atomic + - _ingest._value.matched.field + - _ingest._value.matched.id + - _ingest._value.matched.index + - _ingest._value.matched.occurred + - _ingest._value.matched.type + tag: remove_fields_mapped_with_ecs_from_threat_enrichments + ignore_missing: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.sections + tag: foreach_threat_indicator_file_elf_sections + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.sections instanceof List + processor: + remove: + field: + - _ingest._value.chi2 + - _ingest._value.entropy + - _ingest._value.flags + - _ingest._value.name + - _ingest._value.physical_offset + - _ingest._value.physical_size + - _ingest._value.type + - _ingest._value.virtual_address + - _ingest._value.virtual_size + tag: remove_fields_mapped_with_ecs_from_threat_indicator_file_elf_sections + ignore_missing: true + - foreach: + field: beyondtrust_epm.event.threat.indicator.file.elf.segments + tag: foreach_threat_indicator_file_elf_segments + if: ctx.beyondtrust_epm?.event?.threat?.indicator?.file?.elf?.segments instanceof List + processor: + remove: + field: + - _ingest._value.sections + - _ingest._value.type + tag: remove_fields_mapped_with_ecs_from_threat_indicator_file_elf_segments + ignore_missing: true + - remove: + field: + - beyondtrust_epm.event.EPMWinMac.Configuration.Workstyle.Description + - beyondtrust_epm.event.EPMWinMac.Configuration.Workstyle.Identifier + - beyondtrust_epm.event.EPMWinMac.Configuration.Workstyle.Name + - beyondtrust_epm.event.rule.author + - beyondtrust_epm.event.rule.category + - beyondtrust_epm.event.rule.description + - beyondtrust_epm.event.rule.id + - beyondtrust_epm.event.rule.license + - beyondtrust_epm.event.rule.name + - beyondtrust_epm.event.rule.reference + - beyondtrust_epm.event.rule.ruleset + - beyondtrust_epm.event.rule.uuid + - beyondtrust_epm.event.rule.version + - beyondtrust_epm.event.threat.feed.dashboard_id + - beyondtrust_epm.event.threat.feed.description + - beyondtrust_epm.event.threat.feed.name + - beyondtrust_epm.event.threat.feed.reference + - beyondtrust_epm.event.threat.framework + - beyondtrust_epm.event.threat.group.alias + - beyondtrust_epm.event.threat.group.id + - beyondtrust_epm.event.threat.group.name + - beyondtrust_epm.event.threat.group.reference + - beyondtrust_epm.event.threat.indicator.as.number + - beyondtrust_epm.event.threat.indicator.as.organization.name + - beyondtrust_epm.event.threat.indicator.confidence + - beyondtrust_epm.event.threat.indicator.description + - beyondtrust_epm.event.threat.indicator.email.address + - beyondtrust_epm.event.threat.indicator.file.accessed + - beyondtrust_epm.event.threat.indicator.file.attributes + - beyondtrust_epm.event.threat.indicator.file.code_signature.digest_algorithm + - beyondtrust_epm.event.threat.indicator.file.code_signature.exists + - beyondtrust_epm.event.threat.indicator.file.code_signature.signing_id + - beyondtrust_epm.event.threat.indicator.file.code_signature.status + - beyondtrust_epm.event.threat.indicator.file.code_signature.subject_name + - beyondtrust_epm.event.threat.indicator.file.code_signature.team_id + - beyondtrust_epm.event.threat.indicator.file.code_signature.timestamp + - beyondtrust_epm.event.threat.indicator.file.code_signature.trusted + - beyondtrust_epm.event.threat.indicator.file.code_signature.valid + - beyondtrust_epm.event.threat.indicator.file.created + - beyondtrust_epm.event.threat.indicator.file.ctime + - beyondtrust_epm.event.threat.indicator.file.device + - beyondtrust_epm.event.threat.indicator.file.directory + - beyondtrust_epm.event.threat.indicator.file.drive_letter + - beyondtrust_epm.event.threat.indicator.file.elf.architecture + - beyondtrust_epm.event.threat.indicator.file.elf.byte_order + - beyondtrust_epm.event.threat.indicator.file.elf.cpu_type + - beyondtrust_epm.event.threat.indicator.file.elf.creation_date + - beyondtrust_epm.event.threat.indicator.file.elf.header.abi_version + - beyondtrust_epm.event.threat.indicator.file.elf.header.class + - beyondtrust_epm.event.threat.indicator.file.elf.header.data + - beyondtrust_epm.event.threat.indicator.file.elf.header.entrypoint + - beyondtrust_epm.event.threat.indicator.file.elf.header.object_version + - beyondtrust_epm.event.threat.indicator.file.elf.header.os_abi + - beyondtrust_epm.event.threat.indicator.file.elf.header.type + - beyondtrust_epm.event.threat.indicator.file.elf.header.version + - beyondtrust_epm.event.threat.indicator.file.elf.shared_libraries + - beyondtrust_epm.event.threat.indicator.file.elf.telfhash + - beyondtrust_epm.event.threat.indicator.file.extension + - beyondtrust_epm.event.threat.indicator.file.fork_name + - beyondtrust_epm.event.threat.indicator.file.gid + - beyondtrust_epm.event.threat.indicator.file.group + - beyondtrust_epm.event.threat.indicator.file.hash.md5 + - beyondtrust_epm.event.threat.indicator.file.hash.sha1 + - beyondtrust_epm.event.threat.indicator.file.hash.sha256 + - beyondtrust_epm.event.threat.indicator.file.hash.sha384 + - beyondtrust_epm.event.threat.indicator.file.hash.sha512 + - beyondtrust_epm.event.threat.indicator.file.hash.ssdeep + - beyondtrust_epm.event.threat.indicator.file.hash.tlsh + - beyondtrust_epm.event.threat.indicator.file.inode + - beyondtrust_epm.event.threat.indicator.file.mime_type + - beyondtrust_epm.event.threat.indicator.file.mode + - beyondtrust_epm.event.threat.indicator.file.mtime + - beyondtrust_epm.event.threat.indicator.file.name + - beyondtrust_epm.event.threat.indicator.file.owner_keyword + - beyondtrust_epm.event.threat.indicator.file.path + - beyondtrust_epm.event.threat.indicator.file.pe.architecture + - beyondtrust_epm.event.threat.indicator.file.pe.company + - beyondtrust_epm.event.threat.indicator.file.pe.description + - beyondtrust_epm.event.threat.indicator.file.pe.file_version + - beyondtrust_epm.event.threat.indicator.file.pe.imphash + - beyondtrust_epm.event.threat.indicator.file.pe.original_file_name + - beyondtrust_epm.event.threat.indicator.file.pe.pehash + - beyondtrust_epm.event.threat.indicator.file.pe.product + - beyondtrust_epm.event.threat.indicator.file.size + - beyondtrust_epm.event.threat.indicator.file.target_path + - beyondtrust_epm.event.threat.indicator.file.type + - beyondtrust_epm.event.threat.indicator.file.uid + - beyondtrust_epm.event.threat.indicator.file.x509.alternative_names + - beyondtrust_epm.event.threat.indicator.file.x509.issuer.common_name + - beyondtrust_epm.event.threat.indicator.file.x509.issuer.country + - beyondtrust_epm.event.threat.indicator.file.x509.issuer.distinguished_name + - beyondtrust_epm.event.threat.indicator.file.x509.issuer.locality + - beyondtrust_epm.event.threat.indicator.file.x509.issuer.organization + - beyondtrust_epm.event.threat.indicator.file.x509.issuer.organizational_unit + - beyondtrust_epm.event.threat.indicator.file.x509.issuer.state_or_province + - beyondtrust_epm.event.threat.indicator.file.x509.not_after + - beyondtrust_epm.event.threat.indicator.file.x509.not_before + - beyondtrust_epm.event.threat.indicator.file.x509.public_key_algorithm + - beyondtrust_epm.event.threat.indicator.file.x509.public_key_curve + - beyondtrust_epm.event.threat.indicator.file.x509.public_key_exponent + - beyondtrust_epm.event.threat.indicator.file.x509.public_key_size + - beyondtrust_epm.event.threat.indicator.file.x509.serial_number + - beyondtrust_epm.event.threat.indicator.file.x509.signature_algorithm + - beyondtrust_epm.event.threat.indicator.file.x509.subject.common_name + - beyondtrust_epm.event.threat.indicator.file.x509.subject.country + - beyondtrust_epm.event.threat.indicator.file.x509.subject.distinguished_name + - beyondtrust_epm.event.threat.indicator.file.x509.subject.locality + - beyondtrust_epm.event.threat.indicator.file.x509.subject.organization + - beyondtrust_epm.event.threat.indicator.file.x509.subject.organizational_unit + - beyondtrust_epm.event.threat.indicator.file.x509.subject.state_or_province + - beyondtrust_epm.event.threat.indicator.file.x509.version_number + - beyondtrust_epm.event.threat.indicator.first_seen + - beyondtrust_epm.event.threat.indicator.geo.city_name + - beyondtrust_epm.event.threat.indicator.geo.continent_code + - beyondtrust_epm.event.threat.indicator.geo.continent_name + - beyondtrust_epm.event.threat.indicator.geo.country_iso_code + - beyondtrust_epm.event.threat.indicator.geo.country_name + - beyondtrust_epm.event.threat.indicator.geo.name + - beyondtrust_epm.event.threat.indicator.geo.postal_code + - beyondtrust_epm.event.threat.indicator.geo.region_iso_code + - beyondtrust_epm.event.threat.indicator.geo.region_name + - beyondtrust_epm.event.threat.indicator.geo.timezone + - beyondtrust_epm.event.threat.indicator.ip + - beyondtrust_epm.event.threat.indicator.last_seen + - beyondtrust_epm.event.threat.indicator.marking.tlp + - beyondtrust_epm.event.threat.indicator.modified_at + - beyondtrust_epm.event.threat.indicator.port + - beyondtrust_epm.event.threat.indicator.provider + - beyondtrust_epm.event.threat.indicator.reference + - beyondtrust_epm.event.threat.indicator.registry.data.bytes + - beyondtrust_epm.event.threat.indicator.registry.data.strings + - beyondtrust_epm.event.threat.indicator.registry.data.type + - beyondtrust_epm.event.threat.indicator.registry.hive + - beyondtrust_epm.event.threat.indicator.registry.key + - beyondtrust_epm.event.threat.indicator.registry.path + - beyondtrust_epm.event.threat.indicator.registry.value + - beyondtrust_epm.event.threat.indicator.scanner_stats + - beyondtrust_epm.event.threat.indicator.sightings + - beyondtrust_epm.event.threat.indicator.type + - beyondtrust_epm.event.threat.indicator.url.domain + - beyondtrust_epm.event.threat.indicator.url.extension + - beyondtrust_epm.event.threat.indicator.url.fragment + - beyondtrust_epm.event.threat.indicator.url.full + - beyondtrust_epm.event.threat.indicator.url.original + - beyondtrust_epm.event.threat.indicator.url.password + - beyondtrust_epm.event.threat.indicator.url.path + - beyondtrust_epm.event.threat.indicator.url.port + - beyondtrust_epm.event.threat.indicator.url.query + - beyondtrust_epm.event.threat.indicator.url.registered_domain + - beyondtrust_epm.event.threat.indicator.url.scheme + - beyondtrust_epm.event.threat.indicator.url.subdomain + - beyondtrust_epm.event.threat.indicator.url.top_level_domain + - beyondtrust_epm.event.threat.indicator.url.username + - beyondtrust_epm.event.threat.indicator.x509.alternative_names + - beyondtrust_epm.event.threat.indicator.x509.issuer.common_name + - beyondtrust_epm.event.threat.indicator.x509.issuer.country + - beyondtrust_epm.event.threat.indicator.x509.issuer.distinguished_name + - beyondtrust_epm.event.threat.indicator.x509.issuer.locality + - beyondtrust_epm.event.threat.indicator.x509.issuer.organization + - beyondtrust_epm.event.threat.indicator.x509.issuer.organizational_unit + - beyondtrust_epm.event.threat.indicator.x509.issuer.state_or_province + - beyondtrust_epm.event.threat.indicator.x509.not_after + - beyondtrust_epm.event.threat.indicator.x509.not_before + - beyondtrust_epm.event.threat.indicator.x509.public_key_algorithm + - beyondtrust_epm.event.threat.indicator.x509.public_key_curve + - beyondtrust_epm.event.threat.indicator.x509.public_key_exponent + - beyondtrust_epm.event.threat.indicator.x509.public_key_size + - beyondtrust_epm.event.threat.indicator.x509.serial_number + - beyondtrust_epm.event.threat.indicator.x509.signature_algorithm + - beyondtrust_epm.event.threat.indicator.x509.subject.common_name + - beyondtrust_epm.event.threat.indicator.x509.subject.country + - beyondtrust_epm.event.threat.indicator.x509.subject.distinguished_name + - beyondtrust_epm.event.threat.indicator.x509.subject.locality + - beyondtrust_epm.event.threat.indicator.x509.subject.organization + - beyondtrust_epm.event.threat.indicator.x509.subject.organizational_unit + - beyondtrust_epm.event.threat.indicator.x509.subject.state_or_province + - beyondtrust_epm.event.threat.indicator.x509.version_number + - beyondtrust_epm.event.threat.software.alias + - beyondtrust_epm.event.threat.software.id + - beyondtrust_epm.event.threat.software.name + - beyondtrust_epm.event.threat.software.platforms + - beyondtrust_epm.event.threat.software.reference + - beyondtrust_epm.event.threat.software.type + - beyondtrust_epm.event.threat.tactic.id + - beyondtrust_epm.event.threat.tactic.name + - beyondtrust_epm.event.threat.tactic.reference + - beyondtrust_epm.event.threat.technique.id + - beyondtrust_epm.event.threat.technique.name + - beyondtrust_epm.event.threat.technique.reference + - beyondtrust_epm.event.threat.technique.subtechnique.id + - beyondtrust_epm.event.threat.technique.subtechnique.name + - beyondtrust_epm.event.threat.technique.subtechnique.reference + - beyondtrust_epm.event.vulnerability.category + - beyondtrust_epm.event.vulnerability.classification + - beyondtrust_epm.event.vulnerability.description + - beyondtrust_epm.event.vulnerability.enumeration + - beyondtrust_epm.event.vulnerability.id + - beyondtrust_epm.event.vulnerability.reference + - beyondtrust_epm.event.vulnerability.report_id + - beyondtrust_epm.event.vulnerability.scanner.vendor + - beyondtrust_epm.event.vulnerability.score.base + - beyondtrust_epm.event.vulnerability.score.environmental + - beyondtrust_epm.event.vulnerability.score.temporal + - beyondtrust_epm.event.vulnerability.score.version + - beyondtrust_epm.event.vulnerability.severity + tag: remove_fields_mapped_with_ecs + ignore_missing: true diff --git a/packages/beyondtrust_epm/data_stream/event/fields/base-fields.yml b/packages/beyondtrust_epm/data_stream/event/fields/base-fields.yml new file mode 100644 index 00000000000..3253cc887e9 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/fields/base-fields.yml @@ -0,0 +1,16 @@ +- name: data_stream.dataset + external: ecs +- name: data_stream.namespace + external: ecs +- name: data_stream.type + external: ecs +- name: event.dataset + type: constant_keyword + external: ecs + value: beyondtrust_epm.event +- name: event.module + type: constant_keyword + external: ecs + value: beyondtrust_epm +- name: '@timestamp' + external: ecs diff --git a/packages/beyondtrust_epm/data_stream/event/fields/beats.yml b/packages/beyondtrust_epm/data_stream/event/fields/beats.yml new file mode 100644 index 00000000000..3f0fa78e05a --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/fields/beats.yml @@ -0,0 +1,21 @@ +- name: input.type + type: keyword + description: Type of filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: aws.s3 + type: group + fields: + - name: bucket + type: group + fields: + - name: arn + type: keyword + - name: name + type: keyword + - name: object + type: group + fields: + - name: key + type: keyword diff --git a/packages/beyondtrust_epm/data_stream/event/fields/ecs.yml b/packages/beyondtrust_epm/data_stream/event/fields/ecs.yml new file mode 100644 index 00000000000..54bc65e57c7 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/fields/ecs.yml @@ -0,0 +1,2 @@ +- external: ecs + name: user_agent.original diff --git a/packages/beyondtrust_epm/data_stream/event/fields/fields.yml b/packages/beyondtrust_epm/data_stream/event/fields/fields.yml new file mode 100644 index 00000000000..5f67f6a0e74 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/fields/fields.yml @@ -0,0 +1,4320 @@ +- name: beyondtrust_epm + type: group + fields: + - name: event + type: group + fields: + - name: '@timestamp' + type: date + - name: agent + type: group + fields: + - name: build + type: group + fields: + - name: original + type: keyword + - name: ephemeral_id + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: client + type: group + fields: + - name: address + type: keyword + - name: as + type: group + fields: + - name: number + type: long + - name: organization + type: group + fields: + - name: name + type: keyword + - name: bytes + type: long + - name: domain + type: keyword + - name: geo + type: group + fields: + - name: city_name + type: keyword + - name: continent_code + type: keyword + - name: continent_name + type: keyword + - name: country_iso_code + type: keyword + - name: country_name + type: keyword + - name: location + type: geo_point + - name: name + type: keyword + - name: postal_code + type: keyword + - name: region_iso_code + type: keyword + - name: region_name + type: keyword + - name: timezone + type: keyword + - name: timezone_offset + type: long + - name: ip + type: ip + - name: mac + type: keyword + - name: name + type: keyword + - name: nat + type: group + fields: + - name: ip + type: ip + - name: port + type: long + - name: packets + type: long + - name: port + type: long + - name: registered_domain + type: keyword + - name: subdomain + type: keyword + - name: top_level_domain + type: keyword + - name: user + type: group + fields: + - name: changes + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: effective + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: target + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: cloud + type: group + fields: + - name: account + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: availability_zone + type: keyword + - name: instance + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: machine + type: group + fields: + - name: type + type: keyword + - name: origin + type: group + fields: + - name: account + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: availability_zone + type: keyword + - name: instance + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: machine + type: group + fields: + - name: type + type: keyword + - name: project + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: provider + type: keyword + - name: region + type: keyword + - name: service + type: group + fields: + - name: name + type: keyword + - name: project + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: provider + type: keyword + - name: region + type: keyword + - name: service + type: group + fields: + - name: name + type: keyword + - name: target + type: group + fields: + - name: account + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: availability_zone + type: keyword + - name: instance + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: machine + type: group + fields: + - name: type + type: keyword + - name: project + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: provider + type: keyword + - name: region + type: keyword + - name: service + type: group + fields: + - name: name + type: keyword + - name: container + type: group + fields: + - name: cpu + type: group + fields: + - name: usage + type: scaled_float + - name: disk + type: group + fields: + - name: read + type: group + fields: + - name: bytes + type: long + - name: write + type: group + fields: + - name: bytes + type: long + - name: id + type: keyword + - name: image + type: group + fields: + - name: hash + type: group + fields: + - name: all + type: keyword + - name: name + type: keyword + - name: tag + type: keyword + - name: labels + type: keyword + - name: memory + type: group + fields: + - name: usage + type: scaled_float + - name: name + type: keyword + - name: network + type: group + fields: + - name: egress + type: group + fields: + - name: bytes + type: long + - name: ingress + type: group + fields: + - name: bytes + type: long + - name: runtime + type: keyword + - name: data_stream + type: group + fields: + - name: dataset + type: constant_keyword + - name: namespace + type: constant_keyword + - name: type + type: constant_keyword + - name: destination + type: group + fields: + - name: address + type: keyword + - name: as + type: group + fields: + - name: number + type: long + - name: organization + type: group + fields: + - name: name + type: keyword + - name: bytes + type: long + - name: domain + type: keyword + - name: geo + type: group + fields: + - name: city_name + type: keyword + - name: continent_code + type: keyword + - name: continent_name + type: keyword + - name: country_iso_code + type: keyword + - name: country_name + type: keyword + - name: location + type: geo_point + - name: name + type: keyword + - name: postal_code + type: keyword + - name: region_iso_code + type: keyword + - name: region_name + type: keyword + - name: timezone + type: keyword + - name: timezone_offset + type: long + - name: ip + type: ip + - name: mac + type: keyword + - name: nat + type: group + fields: + - name: ip + type: ip + - name: port + type: long + - name: packets + type: long + - name: port + type: long + - name: registered_domain + type: keyword + - name: subdomain + type: keyword + - name: top_level_domain + type: keyword + - name: user + type: group + fields: + - name: changes + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: effective + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: target + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: dll + type: group + fields: + - name: code_signature + type: group + fields: + - name: digest_algorithm + type: keyword + - name: exists + type: boolean + - name: signing_id + type: keyword + - name: status + type: keyword + - name: subject_name + type: keyword + - name: team_id + type: keyword + - name: timestamp + type: date + - name: trusted + type: boolean + - name: valid + type: boolean + - name: hash + type: group + fields: + - name: md5 + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: sha384 + type: keyword + - name: sha512 + type: keyword + - name: ssdeep + type: keyword + - name: tlsh + type: keyword + - name: name + type: keyword + - name: path + type: keyword + - name: pe + type: group + fields: + - name: architecture + type: keyword + - name: company + type: keyword + - name: description + type: keyword + - name: file_version + type: keyword + - name: imphash + type: keyword + - name: original_file_name + type: keyword + - name: pehash + type: keyword + - name: product + type: keyword + - name: dns + type: group + fields: + - name: answers + type: keyword + - name: header_flags + type: keyword + - name: id + type: keyword + - name: op_code + type: keyword + - name: question + type: group + fields: + - name: class + type: keyword + - name: name + type: keyword + - name: registered_domain + type: keyword + - name: subdomain + type: keyword + - name: top_level_domain + type: keyword + - name: type + type: keyword + - name: resolved_ip + type: ip + - name: response_code + type: keyword + - name: type + type: keyword + - name: ecs + type: group + fields: + - name: version + type: keyword + - name: email + type: group + fields: + - name: attachments + type: group + fields: + - name: file + type: group + fields: + - name: extension + type: keyword + - name: hash + type: group + fields: + - name: md5 + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: sha384 + type: keyword + - name: sha512 + type: keyword + - name: ssdeep + type: keyword + - name: tlsh + type: keyword + - name: mime_type + type: keyword + - name: name + type: keyword + - name: size + type: long + - name: bcc + type: group + fields: + - name: address + type: keyword + - name: cc + type: group + fields: + - name: address + type: keyword + - name: content_type + type: keyword + - name: delivery_timestamp + type: date + - name: direction + type: keyword + - name: from + type: group + fields: + - name: address + type: keyword + - name: local_id + type: keyword + - name: message_id + type: keyword + - name: origination_timestamp + type: date + - name: reply_to + type: group + fields: + - name: address + type: keyword + - name: sender + type: group + fields: + - name: address + type: keyword + - name: subject + type: keyword + - name: to + type: group + fields: + - name: address + type: keyword + - name: x_mailer + type: keyword + - name: epm_win_mac + type: group + fields: + - name: active_x + type: group + fields: + - name: clsid + type: keyword + - name: codebase + type: keyword + - name: version + type: keyword + - name: adapter_version + type: keyword + - name: authorization_request + type: group + fields: + - name: auth_request_uri + type: keyword + - name: control_authorization + type: boolean + - name: authorizing_user + type: group + fields: + - name: credential_source + type: keyword + - name: domain_identifier + type: keyword + - name: domain_name + type: keyword + - name: domain_net_biosname + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: com + type: group + fields: + - name: app_id + type: keyword + - name: clsid + type: keyword + - name: display_name + type: keyword + - name: configuration + type: group + fields: + - name: application + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: type + type: keyword + - name: application_group + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: content + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: type + type: keyword + - name: content_group + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: gpo + type: group + fields: + - name: active_directory_path + type: keyword + - name: display_name + type: keyword + - name: link_information + type: keyword + - name: version + type: keyword + - name: identifier + type: keyword + - name: load_audit_mode + type: keyword + - name: message + type: group + fields: + - name: auth_methods + type: keyword + - name: authentication + type: group + fields: + - name: user + type: keyword + - name: authorization + type: group + fields: + - name: challenge_code + type: keyword + - name: response_status + type: keyword + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: type + type: keyword + - name: user_reason + type: keyword + - name: user_request_management_id + type: keyword + - name: name + type: keyword + - name: path + type: keyword + - name: revision_number + type: keyword + - name: rule + type: group + fields: + - name: action + type: keyword + - name: identifier + type: keyword + - name: matched_child + type: boolean + - name: on_demand + type: boolean + - name: rule_script + type: group + fields: + - name: file_name + type: keyword + - name: outcome + type: group + fields: + - name: name + type: keyword + - name: output + type: match_only_text + - name: result + type: keyword + - name: rule_affected + type: boolean + - name: version + type: keyword + - name: publisher + type: keyword + - name: signing_enforcement + type: keyword + - name: source + type: keyword + - name: token + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: workstyle + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: event + type: group + fields: + - name: action + type: keyword + - name: type + type: keyword + - name: group_id + type: keyword + - name: installer + type: group + fields: + - name: action + type: keyword + - name: product_code + type: keyword + - name: upgrade_code + type: keyword + - name: license + type: group + fields: + - name: invalid_reason + type: keyword + - name: privileged_group + type: group + fields: + - name: access + type: keyword + - name: name + type: keyword + - name: rid + type: keyword + - name: remote_power_shell + type: group + fields: + - name: command + type: wildcard + - name: schema_version + type: keyword + - name: service_control + type: group + fields: + - name: service + type: group + fields: + - name: action + type: keyword + - name: display_name + type: keyword + - name: name + type: keyword + - name: session + type: group + fields: + - name: administrator + type: boolean + - name: identifier + type: keyword + - name: jit_admin + type: group + fields: + - name: configuration + type: group + fields: + - name: application + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: type + type: keyword + - name: application_group + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: content + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: type + type: keyword + - name: content_group + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: gpo + type: group + fields: + - name: active_directory_path + type: keyword + - name: display_name + type: keyword + - name: link_information + type: keyword + - name: version + type: keyword + - name: identifier + type: keyword + - name: load_audit_mode + type: keyword + - name: message + type: group + fields: + - name: auth_methods + type: keyword + - name: authentication + type: group + fields: + - name: user + type: keyword + - name: authorization + type: group + fields: + - name: challenge_code + type: keyword + - name: response_status + type: keyword + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: type + type: keyword + - name: user_reason + type: keyword + - name: user_request_management_id + type: keyword + - name: name + type: keyword + - name: path + type: keyword + - name: revision_number + type: keyword + - name: rule + type: group + fields: + - name: action + type: keyword + - name: identifier + type: keyword + - name: matched_child + type: boolean + - name: on_demand + type: boolean + - name: rule_script + type: group + fields: + - name: file_name + type: keyword + - name: outcome + type: group + fields: + - name: name + type: keyword + - name: output + type: keyword + - name: result + type: keyword + - name: rule_affected + type: boolean + - name: version + type: keyword + - name: publisher + type: keyword + - name: signing_enforcement + type: keyword + - name: source + type: keyword + - name: token + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: workstyle + type: group + fields: + - name: description + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: request_identifier + type: keyword + - name: ticket_identifier + type: keyword + - name: locale + type: keyword + - name: power_user + type: boolean + - name: ui_language + type: keyword + - name: windows_session_id + type: keyword + - name: store_app + type: group + fields: + - name: name + type: keyword + - name: publisher + type: keyword + - name: version + type: keyword + - name: tenant_id + type: keyword + - name: trusted_application + type: group + fields: + - name: name + type: keyword + - name: version + type: keyword + - name: error + type: group + fields: + - name: code + type: keyword + - name: id + type: keyword + - name: message + type: match_only_text + - name: stack_trace + type: wildcard + - name: type + type: keyword + - name: event + type: group + fields: + - name: action + type: keyword + - name: agent_id_status + type: keyword + - name: category + type: keyword + - name: code + type: keyword + - name: created + type: date + - name: dataset + type: keyword + - name: duration + type: long + - name: end + type: date + - name: hash + type: keyword + - name: id + type: keyword + - name: ingested + type: date + - name: kind + type: keyword + - name: module + type: keyword + - name: original + type: keyword + - name: outcome + type: keyword + - name: provider + type: keyword + - name: reason + type: keyword + - name: received_at + type: date + - name: reference + type: keyword + - name: risk_score + type: float + - name: risk_score_norm + type: float + - name: sequence + type: long + - name: severity + type: long + - name: start + type: date + - name: timezone + type: keyword + - name: type + type: keyword + - name: url + type: keyword + - name: faas + type: group + fields: + - name: coldstart + type: boolean + - name: execution + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: trigger + type: group + fields: + - name: request_id + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: file + type: group + fields: + - name: accessed + type: date + - name: attributes + type: keyword + - name: bundle + type: group + fields: + - name: creator + type: keyword + - name: download_source + type: keyword + - name: info_description + type: keyword + - name: name + type: keyword + - name: type + type: keyword + - name: uri + type: keyword + - name: version + type: keyword + - name: code_signature + type: group + fields: + - name: digest_algorithm + type: keyword + - name: exists + type: boolean + - name: signing_id + type: keyword + - name: status + type: keyword + - name: subject_name + type: keyword + - name: team_id + type: keyword + - name: timestamp + type: date + - name: trusted + type: boolean + - name: valid + type: boolean + - name: created + type: date + - name: ctime + type: date + - name: description + type: keyword + - name: device + type: keyword + - name: directory + type: keyword + - name: drive_letter + type: keyword + - name: drive_type + type: keyword + - name: elf + type: group + fields: + - name: architecture + type: keyword + - name: byte_order + type: keyword + - name: cpu_type + type: keyword + - name: creation_date + type: date + - name: exports + type: group + fields: + - name: additional_prop + type: keyword + - name: header + type: group + fields: + - name: abi_version + type: keyword + - name: class + type: keyword + - name: data + type: keyword + - name: entrypoint + type: long + - name: object_version + type: keyword + - name: os_abi + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: imports + type: group + fields: + - name: additional_prop + type: keyword + - name: sections + type: group + fields: + - name: chi2 + type: long + - name: entropy + type: long + - name: flags + type: keyword + - name: name + type: keyword + - name: physical_offset + type: keyword + - name: physical_size + type: long + - name: type + type: keyword + - name: virtual_address + type: long + - name: virtual_size + type: long + - name: segments + type: group + fields: + - name: sections + type: keyword + - name: type + type: keyword + - name: shared_libraries + type: keyword + - name: telfhash + type: keyword + - name: extension + type: keyword + - name: fork_name + type: keyword + - name: gid + type: keyword + - name: group + type: keyword + - name: hash + type: group + fields: + - name: md5 + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: sha384 + type: keyword + - name: sha512 + type: keyword + - name: ssdeep + type: keyword + - name: tlsh + type: keyword + - name: inode + type: keyword + - name: mime_type + type: keyword + - name: mode + type: keyword + - name: mtime + type: date + - name: name + type: keyword + - name: owner + type: group + fields: + - name: domain_identifier + type: keyword + - name: domain_name + type: keyword + - name: domain_net_biosname + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: owner_keyword + type: keyword + - name: path + type: keyword + - name: pe + type: group + fields: + - name: architecture + type: keyword + - name: company + type: keyword + - name: description + type: keyword + - name: file_version + type: keyword + - name: imphash + type: keyword + - name: original_file_name + type: keyword + - name: pehash + type: keyword + - name: product + type: keyword + - name: product_version + type: keyword + - name: size + type: long + - name: source_url + type: keyword + - name: target_path + type: keyword + - name: type + type: keyword + - name: uid + type: keyword + - name: version + type: keyword + - name: x509 + type: group + fields: + - name: alternative_names + type: keyword + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: public_key_algorithm + type: keyword + - name: public_key_curve + type: keyword + - name: public_key_exponent + type: long + - name: public_key_size + type: long + - name: serial_number + type: keyword + - name: signature_algorithm + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: version_number + type: keyword + - name: zone_tag + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: host + type: group + fields: + - name: architecture + type: keyword + - name: boot + type: group + fields: + - name: id + type: keyword + - name: chassis_type + type: keyword + - name: cpu + type: group + fields: + - name: usage + type: scaled_float + - name: default_locale + type: keyword + - name: default_ui_language + type: keyword + - name: disk + type: group + fields: + - name: read + type: group + fields: + - name: bytes + type: long + - name: write + type: group + fields: + - name: bytes + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: geo + type: group + fields: + - name: city_name + type: keyword + - name: continent_code + type: keyword + - name: continent_name + type: keyword + - name: country_iso_code + type: keyword + - name: country_name + type: keyword + - name: location + type: geo_point + - name: name + type: keyword + - name: postal_code + type: keyword + - name: region_iso_code + type: keyword + - name: region_name + type: keyword + - name: timezone + type: keyword + - name: timezone_offset + type: long + - name: hostname + type: keyword + - name: id + type: keyword + - name: ip + type: ip + - name: mac + type: keyword + - name: name + type: keyword + - name: net_bios_name + type: keyword + - name: net_biosname + type: keyword + - name: network + type: group + fields: + - name: egress + type: group + fields: + - name: bytes + type: long + - name: packets + type: long + - name: ingress + type: group + fields: + - name: bytes + type: long + - name: packets + type: long + - name: os + type: group + fields: + - name: family + type: keyword + - name: full + type: keyword + - name: kernel + type: keyword + - name: name + type: keyword + - name: platform + type: keyword + - name: product_type + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: pid_ns_ino + type: keyword + - name: type + type: keyword + - name: uptime + type: long + - name: http + type: group + fields: + - name: request + type: group + fields: + - name: body + type: group + fields: + - name: bytes + type: long + - name: content + type: wildcard + - name: bytes + type: long + - name: id + type: keyword + - name: method + type: keyword + - name: mime_type + type: keyword + - name: referrer + type: keyword + - name: response + type: group + fields: + - name: body + type: group + fields: + - name: bytes + type: long + - name: content + type: wildcard + - name: bytes + type: long + - name: mime_type + type: keyword + - name: status_code + type: long + - name: version + type: keyword + - name: labels + type: keyword + - name: log + type: group + fields: + - name: file + type: group + fields: + - name: path + type: keyword + - name: level + type: keyword + - name: logger + type: keyword + - name: origin + type: group + fields: + - name: file + type: group + fields: + - name: line + type: long + - name: name + type: keyword + - name: function + type: keyword + - name: syslog + type: keyword + - name: message + type: match_only_text + - name: network + type: group + fields: + - name: application + type: keyword + - name: bytes + type: long + - name: community_id + type: keyword + - name: direction + type: keyword + - name: forwarded_ip + type: ip + - name: iana_number + type: keyword + - name: inner + type: keyword + - name: name + type: keyword + - name: packets + type: long + - name: protocol + type: keyword + - name: transport + type: keyword + - name: type + type: keyword + - name: vlan + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: observer + type: group + fields: + - name: egress + type: keyword + - name: geo + type: group + fields: + - name: city_name + type: keyword + - name: continent_code + type: keyword + - name: continent_name + type: keyword + - name: country_iso_code + type: keyword + - name: country_name + type: keyword + - name: location + type: geo_point + - name: name + type: keyword + - name: postal_code + type: keyword + - name: region_iso_code + type: keyword + - name: region_name + type: keyword + - name: timezone + type: keyword + - name: timezone_offset + type: long + - name: hostname + type: keyword + - name: ingress + type: keyword + - name: ip + type: ip + - name: mac + type: keyword + - name: name + type: keyword + - name: os + type: group + fields: + - name: family + type: keyword + - name: full + type: keyword + - name: kernel + type: keyword + - name: name + type: keyword + - name: platform + type: keyword + - name: product_type + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: product + type: keyword + - name: serial_number + type: keyword + - name: type + type: keyword + - name: vendor + type: keyword + - name: version + type: keyword + - name: orchestrator + type: group + fields: + - name: api_version + type: keyword + - name: cluster + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: url + type: keyword + - name: version + type: keyword + - name: namespace + type: keyword + - name: organization + type: keyword + - name: resource + type: group + fields: + - name: id + type: keyword + - name: ip + type: ip + - name: name + type: keyword + - name: parent + type: group + fields: + - name: type + type: keyword + - name: type + type: keyword + - name: type + type: keyword + - name: organization + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: package + type: group + fields: + - name: architecture + type: keyword + - name: build_version + type: keyword + - name: checksum + type: keyword + - name: description + type: keyword + - name: install_scope + type: keyword + - name: installed + type: date + - name: license + type: keyword + - name: name + type: keyword + - name: path + type: keyword + - name: reference + type: keyword + - name: size + type: long + - name: type + type: keyword + - name: version + type: keyword + - name: process + type: group + fields: + - name: args + type: keyword + - name: args_count + type: long + - name: code_signature + type: group + fields: + - name: digest_algorithm + type: keyword + - name: exists + type: boolean + - name: signing_id + type: keyword + - name: status + type: keyword + - name: subject_name + type: keyword + - name: team_id + type: keyword + - name: timestamp + type: date + - name: trusted + type: boolean + - name: valid + type: boolean + - name: command_line + type: wildcard + - name: elevation_required + type: boolean + - name: elf + type: group + fields: + - name: architecture + type: keyword + - name: byte_order + type: keyword + - name: cpu_type + type: keyword + - name: creation_date + type: date + - name: exports + type: group + fields: + - name: additional_prop + type: keyword + - name: header + type: group + fields: + - name: abi_version + type: keyword + - name: class + type: keyword + - name: data + type: keyword + - name: entrypoint + type: long + - name: object_version + type: keyword + - name: os_abi + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: imports + type: group + fields: + - name: additional_prop + type: keyword + - name: sections + type: group + fields: + - name: chi2 + type: long + - name: entropy + type: long + - name: flags + type: keyword + - name: name + type: keyword + - name: physical_offset + type: keyword + - name: physical_size + type: long + - name: type + type: keyword + - name: virtual_address + type: long + - name: virtual_size + type: long + - name: segments + type: group + fields: + - name: sections + type: keyword + - name: type + type: keyword + - name: shared_libraries + type: keyword + - name: telfhash + type: keyword + - name: end + type: date + - name: entity_id + type: keyword + - name: entry_leader + type: flattened + - name: entry_meta + type: group + fields: + - name: source + type: group + fields: + - name: address + type: keyword + - name: as + type: group + fields: + - name: number + type: long + - name: organization + type: group + fields: + - name: name + type: keyword + - name: bytes + type: long + - name: domain + type: keyword + - name: geo + type: group + fields: + - name: city_name + type: keyword + - name: continent_code + type: keyword + - name: continent_name + type: keyword + - name: country_iso_code + type: keyword + - name: country_name + type: keyword + - name: location + type: geo_point + - name: name + type: keyword + - name: postal_code + type: keyword + - name: region_iso_code + type: keyword + - name: region_name + type: keyword + - name: timezone + type: keyword + - name: timezone_offset + type: long + - name: ip + type: ip + - name: mac + type: keyword + - name: nat + type: group + fields: + - name: ip + type: ip + - name: port + type: long + - name: packets + type: long + - name: port + type: long + - name: registered_domain + type: keyword + - name: subdomain + type: keyword + - name: top_level_domain + type: keyword + - name: user + type: group + fields: + - name: changes + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: effective + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: target + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: type + type: keyword + - name: env_vars + type: keyword + - name: executable + type: keyword + - name: exit_code + type: long + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: group_leader + type: flattened + - name: hash + type: group + fields: + - name: md5 + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: sha384 + type: keyword + - name: sha512 + type: keyword + - name: ssdeep + type: keyword + - name: tlsh + type: keyword + - name: hosted_file + type: group + fields: + - name: accessed + type: date + - name: attributes + type: keyword + - name: bundle + type: group + fields: + - name: creator + type: keyword + - name: download_source + type: keyword + - name: info_description + type: keyword + - name: name + type: keyword + - name: type + type: keyword + - name: uri + type: keyword + - name: version + type: keyword + - name: code_signature + type: group + fields: + - name: digest_algorithm + type: keyword + - name: exists + type: boolean + - name: signing_id + type: keyword + - name: status + type: keyword + - name: subject_name + type: keyword + - name: team_id + type: keyword + - name: timestamp + type: date + - name: trusted + type: boolean + - name: valid + type: boolean + - name: created + type: date + - name: ctime + type: date + - name: description + type: keyword + - name: device + type: keyword + - name: directory + type: keyword + - name: drive_letter + type: keyword + - name: drive_type + type: keyword + - name: elf + type: group + fields: + - name: architecture + type: keyword + - name: byte_order + type: keyword + - name: cpu_type + type: keyword + - name: creation_date + type: date + - name: exports + type: group + fields: + - name: additional_prop + type: keyword + - name: header + type: group + fields: + - name: abi_version + type: keyword + - name: class + type: keyword + - name: data + type: keyword + - name: entrypoint + type: long + - name: object_version + type: keyword + - name: os_abi + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: imports + type: group + fields: + - name: additional_prop + type: keyword + - name: sections + type: group + fields: + - name: chi2 + type: long + - name: entropy + type: long + - name: flags + type: keyword + - name: name + type: keyword + - name: physical_offset + type: keyword + - name: physical_size + type: long + - name: type + type: keyword + - name: virtual_address + type: long + - name: virtual_size + type: long + - name: segments + type: group + fields: + - name: sections + type: keyword + - name: type + type: keyword + - name: shared_libraries + type: keyword + - name: telfhash + type: keyword + - name: extension + type: keyword + - name: fork_name + type: keyword + - name: gid + type: keyword + - name: group + type: keyword + - name: hash + type: group + fields: + - name: md5 + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: sha384 + type: keyword + - name: sha512 + type: keyword + - name: ssdeep + type: keyword + - name: tlsh + type: keyword + - name: inode + type: keyword + - name: mime_type + type: keyword + - name: mode + type: keyword + - name: mtime + type: date + - name: name + type: keyword + - name: owner + type: group + fields: + - name: domain_identifier + type: keyword + - name: domain_name + type: keyword + - name: domain_net_biosname + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: owner_keyword + type: keyword + - name: path + type: keyword + - name: pe + type: group + fields: + - name: architecture + type: keyword + - name: company + type: keyword + - name: description + type: keyword + - name: file_version + type: keyword + - name: imphash + type: keyword + - name: original_file_name + type: keyword + - name: pehash + type: keyword + - name: product + type: keyword + - name: product_version + type: keyword + - name: size + type: long + - name: source_url + type: keyword + - name: target_path + type: keyword + - name: type + type: keyword + - name: uid + type: keyword + - name: version + type: keyword + - name: x509 + type: group + fields: + - name: alternative_names + type: keyword + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: public_key_algorithm + type: keyword + - name: public_key_curve + type: keyword + - name: public_key_exponent + type: long + - name: public_key_size + type: long + - name: serial_number + type: keyword + - name: signature_algorithm + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: version_number + type: keyword + - name: zone_tag + type: keyword + - name: interactive + type: boolean + - name: name + type: keyword + - name: parent + type: flattened + - name: pe + type: group + fields: + - name: architecture + type: keyword + - name: company + type: keyword + - name: description + type: keyword + - name: file_version + type: keyword + - name: imphash + type: keyword + - name: original_file_name + type: keyword + - name: pehash + type: keyword + - name: product + type: keyword + - name: pgid + type: long + - name: pid + type: long + - name: previous + type: flattened + - name: real_group + type: flattened + - name: real_user + type: flattened + - name: same_as_process + type: boolean + - name: saved_group + type: flattened + - name: saved_user + type: flattened + - name: session_leader + type: flattened + - name: start + type: date + - name: supplemental_groups + type: flattened + - name: thread + type: group + fields: + - name: id + type: long + - name: name + type: keyword + - name: title + type: keyword + - name: tty + type: keyword + - name: uptime + type: long + - name: user + type: group + fields: + - name: changes + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: effective + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: target + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: working_directory + type: keyword + - name: registry + type: group + fields: + - name: data + type: group + fields: + - name: bytes + type: keyword + - name: strings + type: wildcard + - name: type + type: keyword + - name: hive + type: keyword + - name: key + type: keyword + - name: path + type: keyword + - name: value + type: keyword + - name: related + type: group + fields: + - name: hash + type: keyword + - name: hosts + type: keyword + - name: ip + type: ip + - name: user + type: keyword + - name: rule + type: group + fields: + - name: author + type: keyword + - name: category + type: keyword + - name: description + type: keyword + - name: id + type: keyword + - name: license + type: keyword + - name: name + type: keyword + - name: reference + type: keyword + - name: ruleset + type: keyword + - name: uuid + type: keyword + - name: version + type: keyword + - name: server + type: group + fields: + - name: address + type: keyword + - name: as + type: group + fields: + - name: number + type: long + - name: organization + type: group + fields: + - name: name + type: keyword + - name: bytes + type: long + - name: domain + type: keyword + - name: geo + type: group + fields: + - name: city_name + type: keyword + - name: continent_code + type: keyword + - name: continent_name + type: keyword + - name: country_iso_code + type: keyword + - name: country_name + type: keyword + - name: location + type: geo_point + - name: name + type: keyword + - name: postal_code + type: keyword + - name: region_iso_code + type: keyword + - name: region_name + type: keyword + - name: timezone + type: keyword + - name: timezone_offset + type: long + - name: ip + type: ip + - name: mac + type: keyword + - name: nat + type: group + fields: + - name: ip + type: ip + - name: port + type: long + - name: packets + type: long + - name: port + type: long + - name: registered_domain + type: keyword + - name: subdomain + type: keyword + - name: top_level_domain + type: keyword + - name: user + type: group + fields: + - name: changes + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: effective + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: target + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: service + type: group + fields: + - name: address + type: keyword + - name: environment + type: keyword + - name: ephemeral_id + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: node + type: group + fields: + - name: name + type: keyword + - name: role + type: keyword + - name: origin + type: group + fields: + - name: address + type: keyword + - name: environment + type: keyword + - name: ephemeral_id + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: node + type: group + fields: + - name: name + type: keyword + - name: role + type: keyword + - name: state + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: state + type: keyword + - name: target + type: group + fields: + - name: address + type: keyword + - name: environment + type: keyword + - name: ephemeral_id + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: node + type: group + fields: + - name: name + type: keyword + - name: role + type: keyword + - name: state + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: source + type: group + fields: + - name: address + type: keyword + - name: as + type: group + fields: + - name: number + type: long + - name: organization + type: group + fields: + - name: name + type: keyword + - name: bytes + type: long + - name: domain + type: keyword + - name: geo + type: group + fields: + - name: city_name + type: keyword + - name: continent_code + type: keyword + - name: continent_name + type: keyword + - name: country_iso_code + type: keyword + - name: country_name + type: keyword + - name: location + type: geo_point + - name: name + type: keyword + - name: postal_code + type: keyword + - name: region_iso_code + type: keyword + - name: region_name + type: keyword + - name: timezone + type: keyword + - name: timezone_offset + type: long + - name: ip + type: ip + - name: mac + type: keyword + - name: nat + type: group + fields: + - name: ip + type: ip + - name: port + type: long + - name: packets + type: long + - name: port + type: long + - name: registered_domain + type: keyword + - name: subdomain + type: keyword + - name: top_level_domain + type: keyword + - name: user + type: group + fields: + - name: changes + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: effective + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: target + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: span + type: group + fields: + - name: id + type: keyword + - name: tags + type: keyword + - name: threat + type: group + fields: + - name: enrichments + type: group + fields: + - name: indicator + type: keyword + - name: matched + type: group + fields: + - name: atomic + type: keyword + - name: field + type: keyword + - name: id + type: keyword + - name: index + type: keyword + - name: occurred + type: date + - name: type + type: keyword + - name: feed + type: group + fields: + - name: dashboard_id + type: keyword + - name: description + type: keyword + - name: name + type: keyword + - name: reference + type: keyword + - name: framework + type: keyword + - name: group + type: group + fields: + - name: alias + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: reference + type: keyword + - name: indicator + type: group + fields: + - name: as + type: group + fields: + - name: number + type: long + - name: organization + type: group + fields: + - name: name + type: keyword + - name: confidence + type: keyword + - name: description + type: keyword + - name: email + type: group + fields: + - name: address + type: keyword + - name: file + type: group + fields: + - name: accessed + type: date + - name: attributes + type: keyword + - name: bundle + type: group + fields: + - name: creator + type: keyword + - name: download_source + type: keyword + - name: info_description + type: keyword + - name: name + type: keyword + - name: type + type: keyword + - name: uri + type: keyword + - name: version + type: keyword + - name: code_signature + type: group + fields: + - name: digest_algorithm + type: keyword + - name: exists + type: boolean + - name: signing_id + type: keyword + - name: status + type: keyword + - name: subject_name + type: keyword + - name: team_id + type: keyword + - name: timestamp + type: date + - name: trusted + type: boolean + - name: valid + type: boolean + - name: created + type: date + - name: ctime + type: date + - name: description + type: keyword + - name: device + type: keyword + - name: directory + type: keyword + - name: drive_letter + type: keyword + - name: drive_type + type: keyword + - name: elf + type: group + fields: + - name: architecture + type: keyword + - name: byte_order + type: keyword + - name: cpu_type + type: keyword + - name: creation_date + type: date + - name: exports + type: group + fields: + - name: additional_prop + type: keyword + - name: header + type: group + fields: + - name: abi_version + type: keyword + - name: class + type: keyword + - name: data + type: keyword + - name: entrypoint + type: long + - name: object_version + type: keyword + - name: os_abi + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: imports + type: group + fields: + - name: additional_prop + type: keyword + - name: sections + type: group + fields: + - name: chi2 + type: long + - name: entropy + type: long + - name: flags + type: keyword + - name: name + type: keyword + - name: physical_offset + type: keyword + - name: physical_size + type: long + - name: type + type: keyword + - name: virtual_address + type: long + - name: virtual_size + type: long + - name: segments + type: group + fields: + - name: sections + type: keyword + - name: type + type: keyword + - name: shared_libraries + type: keyword + - name: telfhash + type: keyword + - name: extension + type: keyword + - name: fork_name + type: keyword + - name: gid + type: keyword + - name: group + type: keyword + - name: hash + type: group + fields: + - name: md5 + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: sha384 + type: keyword + - name: sha512 + type: keyword + - name: ssdeep + type: keyword + - name: tlsh + type: keyword + - name: inode + type: keyword + - name: mime_type + type: keyword + - name: mode + type: keyword + - name: mtime + type: date + - name: name + type: keyword + - name: owner + type: group + fields: + - name: domain_identifier + type: keyword + - name: domain_name + type: keyword + - name: domain_net_biosname + type: keyword + - name: identifier + type: keyword + - name: name + type: keyword + - name: owner_keyword + type: keyword + - name: path + type: keyword + - name: pe + type: group + fields: + - name: architecture + type: keyword + - name: company + type: keyword + - name: description + type: keyword + - name: file_version + type: keyword + - name: imphash + type: keyword + - name: original_file_name + type: keyword + - name: pehash + type: keyword + - name: product + type: keyword + - name: product_version + type: keyword + - name: size + type: long + - name: source_url + type: keyword + - name: target_path + type: keyword + - name: type + type: keyword + - name: uid + type: keyword + - name: version + type: keyword + - name: x509 + type: group + fields: + - name: alternative_names + type: keyword + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: public_key_algorithm + type: keyword + - name: public_key_curve + type: keyword + - name: public_key_exponent + type: long + - name: public_key_size + type: long + - name: serial_number + type: keyword + - name: signature_algorithm + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: version_number + type: keyword + - name: zone_tag + type: keyword + - name: first_seen + type: date + - name: geo + type: group + fields: + - name: city_name + type: keyword + - name: continent_code + type: keyword + - name: continent_name + type: keyword + - name: country_iso_code + type: keyword + - name: country_name + type: keyword + - name: location + type: geo_point + - name: name + type: keyword + - name: postal_code + type: keyword + - name: region_iso_code + type: keyword + - name: region_name + type: keyword + - name: timezone + type: keyword + - name: timezone_offset + type: long + - name: ip + type: ip + - name: last_seen + type: date + - name: marking + type: group + fields: + - name: tlp + type: keyword + - name: modified_at + type: date + - name: port + type: long + - name: provider + type: keyword + - name: reference + type: keyword + - name: registry + type: group + fields: + - name: data + type: group + fields: + - name: bytes + type: keyword + - name: strings + type: wildcard + - name: type + type: keyword + - name: hive + type: keyword + - name: key + type: keyword + - name: path + type: keyword + - name: value + type: keyword + - name: scanner_stats + type: long + - name: sightings + type: long + - name: type + type: keyword + - name: url + type: group + fields: + - name: domain + type: keyword + - name: extension + type: keyword + - name: fragment + type: keyword + - name: full + type: wildcard + - name: original + type: wildcard + - name: password + type: keyword + - name: path + type: wildcard + - name: port + type: long + - name: query + type: keyword + - name: registered_domain + type: keyword + - name: scheme + type: keyword + - name: subdomain + type: keyword + - name: top_level_domain + type: keyword + - name: username + type: keyword + - name: x509 + type: group + fields: + - name: alternative_names + type: keyword + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: public_key_algorithm + type: keyword + - name: public_key_curve + type: keyword + - name: public_key_exponent + type: long + - name: public_key_size + type: long + - name: serial_number + type: keyword + - name: signature_algorithm + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: version_number + type: keyword + - name: software + type: group + fields: + - name: alias + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: platforms + type: keyword + - name: reference + type: keyword + - name: type + type: keyword + - name: tactic + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: reference + type: keyword + - name: technique + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: reference + type: keyword + - name: subtechnique + type: group + fields: + - name: id + type: keyword + - name: name + type: keyword + - name: reference + type: keyword + - name: timestamp + type: date + - name: tls + type: group + fields: + - name: cipher + type: keyword + - name: client + type: group + fields: + - name: certificate + type: keyword + - name: certificate_chain + type: keyword + - name: hash + type: group + fields: + - name: md5 + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: issuer + type: keyword + - name: ja3 + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: server_name + type: keyword + - name: subject + type: keyword + - name: supported_ciphers + type: keyword + - name: x509 + type: group + fields: + - name: alternative_names + type: keyword + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: public_key_algorithm + type: keyword + - name: public_key_curve + type: keyword + - name: public_key_exponent + type: long + - name: public_key_size + type: long + - name: serial_number + type: keyword + - name: signature_algorithm + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: version_number + type: keyword + - name: curve + type: keyword + - name: established + type: boolean + - name: next_protocol + type: keyword + - name: resumed + type: boolean + - name: server + type: group + fields: + - name: certificate + type: keyword + - name: certificate_chain + type: keyword + - name: hash + type: group + fields: + - name: md5 + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: issuer + type: keyword + - name: ja3s + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: subject + type: keyword + - name: x509 + type: group + fields: + - name: alternative_names + type: keyword + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: public_key_algorithm + type: keyword + - name: public_key_curve + type: keyword + - name: public_key_exponent + type: long + - name: public_key_size + type: long + - name: serial_number + type: keyword + - name: signature_algorithm + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: state_or_province + type: keyword + - name: version_number + type: keyword + - name: version + type: keyword + - name: version_protocol + type: keyword + - name: trace + type: group + fields: + - name: id + type: keyword + - name: transaction + type: group + fields: + - name: id + type: keyword + - name: url + type: group + fields: + - name: domain + type: keyword + - name: extension + type: keyword + - name: fragment + type: keyword + - name: full + type: wildcard + - name: original + type: wildcard + - name: password + type: keyword + - name: path + type: wildcard + - name: port + type: long + - name: query + type: keyword + - name: registered_domain + type: keyword + - name: scheme + type: keyword + - name: subdomain + type: keyword + - name: top_level_domain + type: keyword + - name: username + type: keyword + - name: user + type: group + fields: + - name: changes + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: effective + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: target + type: group + fields: + - name: default_timezone_offset + type: long + - name: domain + type: keyword + - name: domain_identifier + type: keyword + - name: domain_net_biosname + type: keyword + - name: email + type: keyword + - name: full_name + type: keyword + - name: group + type: group + fields: + - name: domain + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: hash + type: keyword + - name: id + type: keyword + - name: local_identifier + type: long + - name: name + type: keyword + - name: roles + type: keyword + - name: user_agent + type: group + fields: + - name: device + type: group + fields: + - name: name + type: keyword + - name: name + type: keyword + - name: original + type: keyword + - name: os + type: group + fields: + - name: family + type: keyword + - name: full + type: keyword + - name: kernel + type: keyword + - name: name + type: keyword + - name: platform + type: keyword + - name: product_type + type: keyword + - name: type + type: keyword + - name: version + type: keyword + - name: version + type: keyword + - name: vulnerability + type: group + fields: + - name: category + type: keyword + - name: classification + type: keyword + - name: description + type: keyword + - name: enumeration + type: keyword + - name: id + type: keyword + - name: reference + type: keyword + - name: report_id + type: keyword + - name: scanner + type: group + fields: + - name: vendor + type: keyword + - name: score + type: group + fields: + - name: base + type: float + - name: environmental + type: float + - name: temporal + type: float + - name: version + type: keyword + - name: severity + type: keyword diff --git a/packages/beyondtrust_epm/data_stream/event/manifest.yml b/packages/beyondtrust_epm/data_stream/event/manifest.yml new file mode 100644 index 00000000000..bc64bb4820c --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/manifest.yml @@ -0,0 +1,218 @@ +title: Collect Event logs from BeyondTrust EPM +type: logs +streams: + - input: cel + title: BeyondTrust EPM Event Logs + enabled: true + description: Collect event logs from BeyondTrust EPM via the Events search API. + template_path: cel.yml.hbs + vars: + - name: initial_interval + type: text + title: Initial Interval + description: How far back to pull the event data from BeyondTrust EPM on first run. Supported units for this parameter are h/m/s. + multi: false + required: true + show_user: true + default: 24h + - name: interval + type: text + title: Interval + description: Duration between requests to the BeyondTrust EPM API. Supported units for this parameter are h/m/s. + default: 5m + multi: false + required: true + show_user: true + - name: operating_system + type: text + title: Operating System + description: Operating system name for which events to be collected. + multi: false + required: true + show_user: true + - name: max_executions + type: integer + title: Maximum Pages Per Interval + description: Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval. It must be greater than zero. + default: 1000 + multi: false + required: false + show_user: false + - name: page_size + type: integer + title: Page Size + description: The number of records to request per page from the BeyondTrust EPM API. The maximum supported page size is 200. + default: 200 + multi: false + required: true + show_user: false + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: true + show_user: false + default: 30s + - name: enable_request_tracer + type: bool + title: Enable request tracing + default: false + multi: false + required: false + show_user: false + description: >- + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details. + - name: tags + type: text + title: Tags + description: Tags for the data-stream. + multi: true + required: true + show_user: false + default: + - forwarded + - beyondtrust_epm-event + - name: preserve_original_event + required: false + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: aws-s3 + template_path: aws-s3.yml.hbs + title: BeyondTrust EPM Event logs via AWS S3 or SQS + description: Collecting BeyondTrust EPM Event logs via AWS S3 or SQS input. + enabled: false + vars: + - name: bucket_arn + type: text + title: '[S3] Bucket ARN' + multi: false + required: false + show_user: true + description: ARN of the AWS S3 bucket that will be polled for list operation. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence. + - name: access_point_arn + type: text + title: '[S3] Access Point ARN' + multi: false + required: false + show_user: true + description: ARN of the AWS S3 Access Point that will be polled for list operation. Mandatory if the "Collect logs via S3 Bucket" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN. + - name: bucket_list_prefix + type: text + title: '[S3] Bucket Prefix' + multi: false + required: false + show_user: true + description: Prefix to apply for the list request to the S3 bucket. + - name: interval + type: text + title: '[S3] Interval' + multi: false + required: false + show_user: true + default: 120s + description: Listing of the S3 bucket will be polled according to the time interval defined by bucket_list_interval config. Default value is 120 secs. Supported units for this parameter are h/m/s. + - name: number_of_workers + type: integer + title: '[S3] Number of Workers' + multi: false + required: false + show_user: true + default: 5 + description: Number of workers that will process the S3 objects listed. + - name: start_timestamp + type: text + title: '[S3] Start Timestamp' + multi: false + required: false + show_user: false + description: If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, '2020-10-10T10:30:00Z' (UTC) or '2020-10-10T10:30:00Z+02:30' (with zone offset). + - name: ignore_older + type: text + title: '[S3] Ignore Older Timespan' + multi: false + required: false + show_user: false + description: If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`. + - name: queue_url + type: text + title: '[SQS] Queue URL' + multi: false + required: false + show_user: true + description: URL of the AWS SQS queue that messages will be received from. It is a required parameter for collecting logs via the AWS SQS. + - name: visibility_timeout + type: text + title: '[SQS] Visibility Timeout' + multi: false + required: false + show_user: true + default: 300s + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s. + - name: api_timeout + type: text + title: '[SQS] API Timeout' + multi: false + required: false + show_user: true + default: 120s + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s. + - name: max_number_of_messages + type: integer + title: '[SQS] Maximum Concurrent SQS Messages' + required: false + show_user: true + default: 5 + description: Deprecated in agent version 8.16.0, this parameter is ignored if present, use number_of_workers instead. The maximum number of SQS messages that can be inflight at any time. + - name: file_selectors + type: yaml + title: '[SQS] File Selectors' + multi: false + required: false + show_user: false + description: >- + If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global content_type and expand_event_list_from_field values are ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that do not match one of the regexes will not be processed. + - name: external_id + type: text + title: External ID + multi: false + required: false + show_user: false + description: External ID to use when assuming a role in another account. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - beyondtrust_epm-event + - name: preserve_original_event + required: false + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/beyondtrust_epm/data_stream/event/sample_event.json b/packages/beyondtrust_epm/data_stream/event/sample_event.json new file mode 100644 index 00000000000..a80659bd642 --- /dev/null +++ b/packages/beyondtrust_epm/data_stream/event/sample_event.json @@ -0,0 +1,1781 @@ +{ + "@timestamp": "2026-04-15T06:49:55.541Z", + "agent": { + "ephemeral_id": "1757ff63-03b9-404b-bc13-e0df69fced52", + "id": "333771f1-9b69-4bc8-b046-30559a95a881", + "name": "elastic-agent-98811", + "type": "filebeat", + "version": "8.18.0" + }, + "aws": { + "s3": { + "bucket": { + "arn": "arn:aws:s3:::elastic-package-beyondtrust-epm-bucket-11822", + "name": "elastic-package-beyondtrust-epm-bucket-11822" + }, + "object": { + "key": "event.log" + } + } + }, + "beyondtrust_epm": { + "event": { + "@timestamp": "2026-04-15T06:49:55.541Z", + "agent": { + "build": { + "original": "metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]" + }, + "ephemeral_id": "8a4f500f", + "id": "8a4f500d", + "name": "foo", + "type": "filebeat", + "version": "6.0.0-rc2" + }, + "client": { + "geo": { + "location": { + "lat": 37, + "lon": -122 + }, + "timezone_offset": -480 + }, + "name": "DESKTOP-ACME-01", + "user": { + "changes": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-1013", + "local_identifier": 10001, + "name": "DESKTOP-ACME-01", + "roles": [ + "admin" + ] + }, + "default_timezone_offset": -480, + "domain_identifier": "alice", + "domain_net_biosname": "alice", + "effective": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-1013", + "local_identifier": 10001, + "name": "DESKTOP-ACME-01", + "roles": [ + "admin" + ] + }, + "local_identifier": 10001, + "target": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-1013", + "local_identifier": 10001, + "name": "DESKTOP-ACME-01", + "roles": [ + "admin" + ] + } + } + }, + "container": { + "labels": "sample-environment" + }, + "data_stream": { + "dataset": "beyondtrust_epm.event", + "namespace": "production", + "type": "logs" + }, + "destination": { + "geo": { + "location": { + "lat": 37, + "lon": -122 + }, + "timezone_offset": -480 + }, + "user": { + "changes": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-1013", + "local_identifier": 10001, + "name": "DESKTOP-ACME-01", + "roles": [ + "admin" + ] + }, + "default_timezone_offset": -480, + "domain_identifier": "alice", + "domain_net_biosname": "alice", + "effective": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-1013", + "local_identifier": 10001, + "name": "DESKTOP-ACME-01", + "roles": [ + "admin" + ] + }, + "local_identifier": 10001, + "target": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-1013", + "local_identifier": 10001, + "name": "DESKTOP-ACME-01", + "roles": [ + "admin" + ] + } + } + }, + "dns": { + "answers": "sample-answers" + }, + "ecs": { + "version": "1.0.0" + }, + "event": { + "category": [ + "authentication" + ], + "dataset": "beyondtrust_epm.event", + "ingested": "2026-04-15T06:49:55.541Z", + "kind": "alert", + "module": "beyondtrust_epm", + "original": "Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232", + "received_at": "2026-04-15T06:49:55.541Z", + "type": [ + "item-0" + ] + }, + "file": { + "bundle": { + "creator": "sample-reator", + "download_source": "sample-ownload-ource", + "info_description": "sample-info-escription", + "name": "sample.bin", + "type": "EXEC", + "uri": "sample-ri", + "version": "sample-version" + }, + "description": "sample-escription", + "drive_type": "sample-rive-ype", + "elf": { + "exports": { + "additional_prop": "sample-additional-rop" + }, + "imports": { + "additional_prop": "sample-additional-rop" + } + }, + "owner": { + "domain_identifier": "corp.example.com", + "domain_name": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "identifier": "801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01", + "name": "alice" + }, + "owner_keyword": "alice", + "product_version": "sample-roduct-ersion", + "source_url": "sample-ource-rl", + "version": "sample-version", + "zone_tag": "sample-one-ag" + }, + "host": { + "chassis_type": "sample-hassis-ype", + "default_locale": "sample-efault-ocale", + "default_ui_language": "example-default-ui-language", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "geo": { + "location": { + "lat": 37, + "lon": -122 + }, + "timezone_offset": -480 + }, + "net_biosname": "sample-net-bios", + "os": { + "product_type": "sample-roduct-ype" + } + }, + "labels": "application", + "log": { + "syslog": "sample-syslog" + }, + "network": { + "inner": "sample-inner" + }, + "observer": { + "egress": "sample-egress", + "geo": { + "location": { + "lat": 37, + "lon": -122 + }, + "timezone_offset": -480 + }, + "ingress": "sample-ingress", + "os": { + "product_type": "sample-roduct-ype" + } + }, + "process": { + "group_leader": { + "args": [ + "item-0" + ], + "args_count": 3, + "code_signature": { + "digest_algorithm": "sha256", + "exists": true, + "signing_id": "com.apple.xpc.proxy", + "status": "ERROR_UNTRUSTED_ROOT", + "subject_name": "Microsoft Corporation", + "team_id": "EQHXZ8M8AV", + "timestamp": "2026-04-15T06:49:55.541Z", + "trusted": true, + "valid": true + }, + "command_line": "sample-command-line", + "elevation_required": true, + "elf": { + "architecture": "x86-64", + "byte_order": "Little Endian", + "cpu_type": "Intel", + "creation_date": "2026-04-15T06:49:55.541Z", + "exports": { + "additional_prop": "sample-additional-rop" + }, + "header": { + "abi_version": "sample-abi-version", + "class": "sample-class", + "data": "sample-data", + "entrypoint": 42, + "object_version": "sample-object-version", + "os_abi": "sample-os-abi", + "type": "EXEC", + "version": "sample-version" + }, + "imports": { + "additional_prop": "sample-additional-rop" + }, + "sections": [ + { + "chi2": 1000, + "entropy": 4, + "flags": "sample-flags", + "name": "sample-resource", + "physical_offset": "sample-physical-offset", + "physical_size": 8192, + "type": "EXEC", + "virtual_address": 4096, + "virtual_size": 8192 + } + ], + "segments": [ + { + "sections": "sample-sections", + "type": "EXEC" + } + ], + "shared_libraries": [ + "item-0" + ], + "telfhash": "b1946ac92492d2347c6235b4d2611184" + }, + "end": "2026-04-15T06:49:55.541Z", + "entity_id": "sample-entity-id", + "entry_meta": { + "source": { + "address": "198.51.100.100", + "as": { + "number": 15169, + "organization": { + "name": "DESKTOP-ACME-01" + } + }, + "bytes": 1024, + "domain": "corp.example.com", + "geo": { + "city_name": "San Francisco", + "continent_code": "US", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", + "location": { + "lat": 37, + "lon": -122 + }, + "name": "us-west-2", + "postal_code": "US", + "region_iso_code": "US", + "region_name": "California", + "timezone": "America/Los_Angeles", + "timezone_offset": -480 + }, + "ip": "81.2.69.144", + "mac": "00:1a:2b:3c:4d:5e", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "packets": 1024, + "port": 443, + "registered_domain": "example.com", + "subdomain": "corp.example.com", + "top_level_domain": "corp.example.com", + "user": { + "changes": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "DESKTOP-ACME-01", + "roles": [ + "admin" + ] + }, + "default_timezone_offset": -480, + "domain": "alice", + "domain_identifier": "alice", + "domain_net_biosname": "alice", + "effective": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "DESKTOP-ACME-01", + "roles": [ + "admin" + ] + }, + "email": "alice", + "full_name": "alice", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "alice", + "id": "alice", + "local_identifier": 10001, + "name": "alice", + "roles": [ + "admin" + ], + "target": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "DESKTOP-ACME-01", + "roles": [ + "admin" + ] + } + } + }, + "type": "terminal" + }, + "env_vars": "sample-env-vars", + "executable": "sample-executable", + "exit_code": 137, + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "sample-resource" + }, + "hash": { + "md5": "d41d8cd98f00b204e9800998ecf8427e", + "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "sha384": "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b", + "sha512": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e", + "ssdeep": "3::", + "tlsh": "T100000000000000000000000000000000000000000000000000000000000000000000" + }, + "hosted_file": { + "accessed": "2026-04-15T06:49:55.541Z", + "attributes": [ + "item-0" + ], + "bundle": { + "creator": "sample-reator", + "download_source": "sample-ownload-ource", + "info_description": "sample-nfo-escription", + "name": "sample.bin", + "type": "EXEC", + "uri": "sample-ri", + "version": "sample-version" + }, + "code_signature": { + "digest_algorithm": "sample-digest-algorithm", + "exists": true, + "signing_id": "sample-signing-id", + "status": "sample-status", + "subject_name": "sample-subject-name", + "team_id": "sample-team-id", + "timestamp": "2026-04-15T06:49:55.541Z", + "trusted": true, + "valid": true + }, + "created": "2026-04-15T06:49:55.541Z", + "ctime": "2026-04-15T06:49:55.541Z", + "description": "sample-escription", + "device": "sample-device", + "directory": "sample-directory", + "drive_letter": "sample-drive-letter", + "drive_type": "sample-rive-ype", + "elf": { + "architecture": "sample-architecture", + "byte_order": "sample-byte-order", + "cpu_type": "sample-cpu-type", + "creation_date": "2026-04-15T06:49:55.541Z", + "exports": { + "additional_prop": "sample-additional-rop" + }, + "header": { + "abi_version": "sample-abi-version", + "class": "sample-class", + "data": "sample-data", + "entrypoint": 42, + "object_version": "sample-object-version", + "os_abi": "sample-os-abi", + "type": "EXEC", + "version": "sample-version" + }, + "imports": { + "additional_prop": "sample-additional-rop" + }, + "sections": [ + { + "chi2": 1000, + "entropy": 4, + "flags": "sample-flags", + "name": "sample.bin", + "physical_offset": "sample-physical-offset", + "physical_size": 8192, + "type": "EXEC", + "virtual_address": 4096, + "virtual_size": 8192 + } + ], + "segments": [ + { + "sections": "sample-sections", + "type": "EXEC" + } + ], + "shared_libraries": [ + "item-0" + ], + "telfhash": "b1946ac92492d2347c6235b4d2611184" + }, + "extension": "sample-extension", + "fork_name": "sample-fork-name", + "gid": "sample-gid", + "group": "sample-group", + "hash": { + "md5": "d41d8cd98f00b204e9800998ecf8427e", + "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "sha384": "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b", + "sha512": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e", + "ssdeep": "3::", + "tlsh": "T100000000000000000000000000000000000000000000000000000000000000000000" + }, + "inode": "sample-inode", + "mime_type": "sample-mime-type", + "mode": "sample-mode", + "mtime": "2026-04-15T06:49:55.541Z", + "name": "sample.bin", + "owner": "sample-owner", + "path": "sample-path", + "pe": { + "architecture": "sample-architecture", + "company": "sample-company", + "description": "sample-description", + "file_version": "sample-file-version", + "imphash": "sample-imphash", + "original_file_name": "sample-original-file-name", + "pehash": "b1946ac92492d2347c6235b4d2611184", + "product": "sample-product" + }, + "product_version": "sample-roduct-ersion", + "size": 1024, + "source_url": "sample-ource-rl", + "target_path": "sample-target-path", + "type": "EXEC", + "uid": "sample-uid", + "version": "sample-version", + "x509": { + "alternative_names": [ + "item-0" + ], + "issuer": { + "common_name": [ + "item-0" + ], + "country": [ + "item-0" + ], + "distinguished_name": "sample-distinguished-name", + "locality": [ + "item-0" + ], + "organization": [ + "item-0" + ], + "organizational_unit": [ + "item-0" + ], + "state_or_province": [ + "item-0" + ] + }, + "not_after": "2026-04-15T06:49:55.541Z", + "not_before": "2026-04-15T06:49:55.541Z", + "public_key_algorithm": "sample-public-key-algorithm", + "public_key_curve": "sample-public-key-curve", + "public_key_exponent": 42, + "public_key_size": 42, + "serial_number": "sample-serial-number", + "signature_algorithm": "sample-signature-algorithm", + "subject": { + "common_name": [ + "item-0" + ], + "country": [ + "item-0" + ], + "distinguished_name": "sample-distinguished-name", + "locality": [ + "item-0" + ], + "organization": [ + "item-0" + ], + "organizational_unit": [ + "item-0" + ], + "state_or_province": [ + "item-0" + ] + }, + "version_number": "sample-version-number" + }, + "zone_tag": "sample-one-ag" + }, + "interactive": true, + "name": "sample-resource", + "pe": { + "architecture": "x64", + "company": "Microsoft Corporation", + "description": "Paint", + "file_version": "6.3.9600.17415", + "imphash": "0c6803c4e922103c4dca5963aad36ddf", + "original_file_name": "MSPAINT.EXE", + "pehash": "73ff189b63cd6be375a7ff25179a38d347651975", + "product": "Microsoft® Windows® Operating System" + }, + "pgid": 4242, + "pid": 4242, + "real_group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "sample-resource" + }, + "real_user": { + "changes": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "alice", + "roles": [ + "admin" + ] + }, + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "effective": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "alice", + "roles": [ + "admin" + ] + }, + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "alice", + "roles": [ + "admin" + ], + "target": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "alice", + "roles": [ + "admin" + ] + } + }, + "same_as_process": true, + "saved_group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "sample-resource" + }, + "saved_user": { + "changes": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "alice", + "roles": [ + "admin" + ] + }, + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "effective": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "alice", + "roles": [ + "admin" + ] + }, + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "alice", + "roles": [ + "admin" + ], + "target": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Alice Williams", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "local_identifier": 10001, + "name": "alice", + "roles": [ + "admin" + ] + } + }, + "start": "2026-04-15T06:49:55.541Z", + "supplemental_groups": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "sample-resource" + }, + "thread": { + "id": "4242", + "name": "sample-resource" + }, + "title": "sample-title", + "tty": "sample-tty", + "uptime": 3600, + "user": { + "changes": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Albert Einstein", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-202424912787-2692429404-2351956786-1000", + "local_identifier": 10001, + "name": "a.einstein", + "roles": [ + "kibana_admin", + "reporting_user" + ] + }, + "default_timezone_offset": -480, + "domain": "alice", + "domain_identifier": "alice", + "domain_net_biosname": "alice", + "effective": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Albert Einstein", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-202424912787-2692429404-2351956786-1000", + "local_identifier": 10001, + "name": "a.einstein", + "roles": [ + "kibana_admin", + "reporting_user" + ] + }, + "email": "alice", + "full_name": "Albert Einstein", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "alice", + "id": "S-1-5-21-202424912787-2692429404-2351956786-1000", + "local_identifier": 10001, + "name": "a.einstein", + "roles": [ + "kibana_admin", + "reporting_user" + ], + "target": { + "default_timezone_offset": -480, + "domain": "corp.example.com", + "domain_identifier": "corp.example.com", + "domain_net_biosname": "corp.example.com", + "email": "alice.williams@example.com", + "full_name": "Albert Einstein", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "alice" + }, + "hash": "b1946ac92492d2347c6235b4d2611184", + "id": "S-1-5-21-202424912787-2692429404-2351956786-1000", + "local_identifier": 10001, + "name": "a.einstein", + "roles": [ + "kibana_admin", + "reporting_user" + ] + } + }, + "working_directory": "sample-working-directory" + } + } + } + }, + "client": { + "address": "198.51.100.100", + "as": { + "number": 15169, + "organization": { + "name": "Google LLC" + } + }, + "bytes": 184, + "domain": "foo.example.com", + "geo": { + "city_name": "Montreal", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "CA", + "country_name": "Canada", + "location": { + "lat": 37, + "lon": -122 + }, + "name": "boston-dc", + "postal_code": "94040", + "region_iso_code": "CA-QC", + "region_name": "Quebec", + "timezone": "America/Argentina/Buenos_Aires" + }, + "ip": "81.2.69.144", + "mac": "00-00-5E-00-53-23", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "packets": 12, + "port": 443, + "registered_domain": "example.com", + "subdomain": "east", + "top_level_domain": "co.uk", + "user": { + "domain": "alice", + "email": "alice", + "full_name": "Albert Einstein", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "alice", + "id": "S-1-5-21-202424912787-2692429404-2351956786-1000", + "name": "a.einstein", + "roles": [ + "kibana_admin", + "reporting_user" + ] + } + }, + "cloud": { + "account": { + "id": [ + "666777888999" + ], + "name": "elastic-dev" + }, + "availability_zone": "us-east-1c", + "instance": { + "id": "i-1234567890abcdef0", + "name": "sample-resource" + }, + "machine": { + "type": "t2.medium" + }, + "origin": { + "account": { + "id": "666777888999", + "name": "elastic-dev" + }, + "availability_zone": "us-east-1c", + "instance": { + "id": "i-1234567890abcdef0", + "name": "sample-resource" + }, + "machine": { + "type": "t2.medium" + }, + "project": { + "id": "my-project", + "name": "my project" + }, + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "lambda" + } + }, + "project": { + "id": "my-project", + "name": "my project" + }, + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "lambda" + }, + "target": { + "account": { + "id": "666777888999", + "name": "elastic-dev" + }, + "availability_zone": "us-east-1c", + "instance": { + "id": "i-1234567890abcdef0", + "name": "sample-resource" + }, + "machine": { + "type": "t2.medium" + }, + "project": { + "id": "my-project", + "name": "my project" + }, + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "lambda" + } + } + }, + "container": { + "cpu": { + "usage": 1 + }, + "disk": { + "read": { + "bytes": 42 + }, + "write": { + "bytes": 42 + } + }, + "id": "sample-id", + "image": { + "hash": { + "all": [ + "[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]" + ] + }, + "name": "sample-resource", + "tag": [ + "item-0" + ] + }, + "memory": { + "usage": 1 + }, + "name": "sample-resource", + "network": { + "egress": { + "bytes": 42 + }, + "ingress": { + "bytes": 42 + } + }, + "runtime": "docker" + }, + "data_stream": { + "dataset": "beyondtrust_epm.event", + "namespace": "64713", + "type": "logs" + }, + "destination": { + "address": "198.51.100.100", + "as": { + "number": 15169, + "organization": { + "name": "Google LLC" + } + }, + "bytes": 184, + "domain": "foo.example.com", + "geo": { + "city_name": "Montreal", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "CA", + "country_name": "Canada", + "location": { + "lat": 37, + "lon": -122 + }, + "name": "boston-dc", + "postal_code": "94040", + "region_iso_code": "CA-QC", + "region_name": "Quebec", + "timezone": "America/Argentina/Buenos_Aires" + }, + "ip": "81.2.69.144", + "mac": "00-00-5E-00-53-23", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "packets": 12, + "port": 443, + "registered_domain": "example.com", + "subdomain": "east", + "top_level_domain": "co.uk", + "user": { + "domain": "alice", + "email": "alice", + "full_name": "Albert Einstein", + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": "DESKTOP-ACME-01" + }, + "hash": "alice", + "id": "S-1-5-21-202424912787-2692429404-2351956786-1000", + "name": "a.einstein", + "roles": [ + "kibana_admin", + "reporting_user" + ] + } + }, + "dll": { + "code_signature": { + "digest_algorithm": "sha256", + "exists": true, + "signing_id": "com.apple.xpc.proxy", + "status": "ERROR_UNTRUSTED_ROOT", + "subject_name": "Microsoft Corporation", + "team_id": "EQHXZ8M8AV", + "timestamp": "2026-04-15T06:49:55.541Z", + "trusted": true, + "valid": true + }, + "hash": { + "md5": "d41d8cd98f00b204e9800998ecf8427e", + "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "sha384": "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b", + "sha512": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e", + "ssdeep": "3::", + "tlsh": "T100000000000000000000000000000000000000000000000000000000000000000000" + }, + "name": "kernel32.dll", + "path": "C:\\Windows\\System32\\kernel32.dll", + "pe": { + "architecture": "x64", + "company": "Microsoft Corporation", + "description": "Paint", + "file_version": "6.3.9600.17415", + "imphash": "0c6803c4e922103c4dca5963aad36ddf", + "original_file_name": "MSPAINT.EXE", + "pehash": "73ff189b63cd6be375a7ff25179a38d347651975", + "product": "Microsoft® Windows® Operating System" + } + }, + "dns": { + "header_flags": [ + "RD", + "RA" + ], + "id": "62111", + "op_code": "QUERY", + "question": { + "class": "IN", + "name": "www.example.com", + "registered_domain": "example.com", + "subdomain": "www", + "top_level_domain": "co.uk", + "type": "AAAA" + }, + "resolved_ip": [ + "10.10.10.10", + "10.10.10.11" + ], + "response_code": "NOERROR", + "type": "answer" + }, + "ecs": { + "version": "9.3.0" + }, + "elastic_agent": { + "id": "333771f1-9b69-4bc8-b046-30559a95a881", + "snapshot": false, + "version": "8.18.0" + }, + "email": { + "attachments": { + "file": { + "extension": [ + "sample-extension" + ], + "hash": { + "md5": [ + "d41d8cd98f00b204e9800998ecf8427e" + ], + "sha1": [ + "da39a3ee5e6b4b0d3255bfef95601890afd80709" + ], + "sha256": [ + "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + ], + "sha384": [ + "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b" + ], + "sha512": [ + "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e" + ], + "ssdeep": [ + "3::" + ], + "tlsh": [ + "T100000000000000000000000000000000000000000000000000000000000000000000" + ] + }, + "mime_type": [ + "sample-mime-type" + ], + "name": [ + "sample.bin" + ] + } + }, + "bcc": { + "address": [ + "bcc.user1@example.com" + ] + }, + "cc": { + "address": [ + "cc.user1@example.com" + ] + }, + "content_type": "text/plain", + "delivery_timestamp": "2026-04-15T06:49:55.541Z", + "direction": "inbound", + "from": { + "address": [ + "sender@example.com" + ] + }, + "local_id": "c26dbea0-80d5-463b-b93c-4e8b708219ce", + "message_id": "81ce15$8r2j59@mail01.example.com", + "origination_timestamp": "2026-04-15T06:49:55.541Z", + "reply_to": { + "address": [ + "reply.here@example.com" + ] + }, + "sender": { + "address": "198.51.100.100" + }, + "subject": "Please see this important message.", + "to": { + "address": [ + "user1@example.com" + ] + }, + "x_mailer": "Spambot v2.5" + }, + "error": { + "code": "sample-code", + "id": "sample-id", + "stack_trace": "sample-stack-trace", + "type": "java.lang.NullPointerException" + }, + "event": { + "action": [ + "user-password-change" + ], + "agent_id_status": "verified", + "category": [ + "file", + "host", + "email", + "authentication" + ], + "code": [ + "4648" + ], + "created": "2026-04-15T06:49:55.541Z", + "dataset": "beyondtrust_epm.event", + "duration": 42, + "end": "2026-04-15T06:49:55.541Z", + "hash": "123456789012345678901234567890ABCD", + "id": "8a4f500d", + "ingested": "2026-07-06T08:11:18Z", + "kind": "event", + "original": "{\"agent\":{\"version\":\"6.0.0-rc2\",\"build\":{\"original\":\"metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]\"},\"name\":\"foo\",\"type\":\"filebeat\",\"id\":\"8a4f500d\",\"ephemeral_id\":\"8a4f500f\"},\"@timestamp\":\"2026-04-15T06:49:55.541Z\",\"tags\":[\"production\",\"env2\"],\"labels\":\"application\",\"message\":\"Hello World\",\"client\":{\"address\":\"198.51.100.100\",\"ip\":\"81.2.69.144\",\"port\":443,\"mac\":\"00:00:5E:00:53:23\",\"domain\":\"foo.example.com\",\"registered_domain\":\"example.com\",\"top_level_domain\":\"co.uk\",\"subdomain\":\"east\",\"bytes\":184,\"packets\":12,\"nat\":{\"ip\":\"81.2.69.144\",\"port\":443},\"Name\":\"DESKTOP-ACME-01\",\"as\":{\"number\":15169,\"organization\":{\"name\":\"Google LLC\"}},\"geo\":{\"location\":{\"lon\":-122,\"lat\":37},\"continent_code\":\"NA\",\"continent_name\":\"North America\",\"country_name\":\"Canada\",\"region_name\":\"Quebec\",\"city_name\":\"Montreal\",\"country_iso_code\":\"CA\",\"postal_code\":\"94040\",\"region_iso_code\":\"CA-QC\",\"timezone\":\"America/Argentina/Buenos_Aires\",\"name\":\"boston-dc\",\"TimezoneOffset\":-480},\"user\":{\"id\":\"S-1-5-21-202424912787-2692429404-2351956786-1000\",\"name\":\"a.einstein\",\"full_name\":\"Albert Einstein\",\"email\":\"alice\",\"hash\":\"alice\",\"domain\":\"alice\",\"roles\":[\"kibana_admin\",\"reporting_user\"],\"DomainIdentifier\":\"alice\",\"DomainNetBIOSName\":\"alice\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"},\"target\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"name\":\"DESKTOP-ACME-01\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"}},\"effective\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"name\":\"DESKTOP-ACME-01\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"}},\"changes\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"name\":\"DESKTOP-ACME-01\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"}}}},\"cloud\":{\"provider\":\"aws\",\"availability_zone\":\"us-east-1c\",\"region\":\"us-east-1\",\"instance\":{\"id\":\"i-1234567890abcdef0\",\"name\":\"sample-resource\"},\"machine\":{\"type\":\"t2.medium\"},\"account\":{\"id\":\"666777888999\",\"name\":\"elastic-dev\"},\"service\":{\"name\":\"lambda\"},\"project\":{\"id\":\"my-project\",\"name\":\"my project\"},\"origin\":{\"provider\":\"aws\",\"availability_zone\":\"us-east-1c\",\"region\":\"us-east-1\",\"instance\":{\"id\":\"i-1234567890abcdef0\",\"name\":\"sample-resource\"},\"machine\":{\"type\":\"t2.medium\"},\"account\":{\"id\":\"666777888999\",\"name\":\"elastic-dev\"},\"service\":{\"name\":\"lambda\"},\"project\":{\"id\":\"my-project\",\"name\":\"my project\"}},\"target\":{\"provider\":\"aws\",\"availability_zone\":\"us-east-1c\",\"region\":\"us-east-1\",\"instance\":{\"id\":\"i-1234567890abcdef0\",\"name\":\"sample-resource\"},\"machine\":{\"type\":\"t2.medium\"},\"account\":{\"id\":\"666777888999\",\"name\":\"elastic-dev\"},\"service\":{\"name\":\"lambda\"},\"project\":{\"id\":\"my-project\",\"name\":\"my project\"}}},\"container\":{\"cpu\":{\"usage\":1},\"disk\":{\"read\":{\"bytes\":42},\"write\":{\"bytes\":42}},\"id\":\"sample-id\",\"image\":{\"name\":\"sample-resource\",\"tag\":[\"item-0\"],\"hash\":{\"all\":[\"[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]\"]}},\"labels\":\"sample-environment\",\"memory\":{\"usage\":1},\"name\":\"sample-resource\",\"network\":{\"ingress\":{\"bytes\":42},\"egress\":{\"bytes\":42}},\"runtime\":\"docker\"},\"data_stream\":{\"type\":\"logs\",\"dataset\":\"beyondtrust_epm.event\",\"namespace\":\"production\"},\"destination\":{\"address\":\"198.51.100.100\",\"ip\":\"81.2.69.144\",\"port\":443,\"mac\":\"00-00-5E-00-53-23\",\"domain\":\"foo.example.com\",\"registered_domain\":\"example.com\",\"top_level_domain\":\"co.uk\",\"subdomain\":\"east\",\"bytes\":184,\"packets\":12,\"nat\":{\"ip\":\"81.2.69.144\",\"port\":443},\"as\":{\"number\":15169,\"organization\":{\"name\":\"Google LLC\"}},\"geo\":{\"location\":{\"lon\":-122,\"lat\":37},\"continent_code\":\"NA\",\"continent_name\":\"North America\",\"country_name\":\"Canada\",\"region_name\":\"Quebec\",\"city_name\":\"Montreal\",\"country_iso_code\":\"CA\",\"postal_code\":\"94040\",\"region_iso_code\":\"CA-QC\",\"timezone\":\"America/Argentina/Buenos_Aires\",\"name\":\"boston-dc\",\"TimezoneOffset\":-480},\"user\":{\"id\":\"S-1-5-21-202424912787-2692429404-2351956786-1000\",\"name\":\"a.einstein\",\"full_name\":\"Albert Einstein\",\"email\":\"alice\",\"hash\":\"alice\",\"domain\":\"alice\",\"roles\":[\"kibana_admin\",\"reporting_user\"],\"DomainIdentifier\":\"alice\",\"DomainNetBIOSName\":\"alice\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"},\"target\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"name\":\"DESKTOP-ACME-01\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"}},\"effective\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"name\":\"DESKTOP-ACME-01\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"}},\"changes\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"name\":\"DESKTOP-ACME-01\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"}}}},\"dll\":{\"name\":\"kernel32.dll\",\"path\":\"C:\\\\Windows\\\\System32\\\\kernel32.dll\",\"hash\":{\"md5\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sha1\":\"da39a3ee5e6b4b0d3255bfef95601890afd80709\",\"sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"sha384\":\"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b\",\"sha512\":\"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e\",\"ssdeep\":\"3::\",\"tlsh\":\"T100000000000000000000000000000000000000000000000000000000000000000000\"},\"pe\":{\"original_file_name\":\"MSPAINT.EXE\",\"file_version\":\"6.3.9600.17415\",\"description\":\"Paint\",\"product\":\"Microsoft® Windows® Operating System\",\"company\":\"Microsoft Corporation\",\"imphash\":\"0c6803c4e922103c4dca5963aad36ddf\",\"architecture\":\"x64\",\"pehash\":\"73ff189b63cd6be375a7ff25179a38d347651975\"},\"code_signature\":{\"exists\":true,\"subject_name\":\"Microsoft Corporation\",\"valid\":true,\"trusted\":true,\"status\":\"ERROR_UNTRUSTED_ROOT\",\"team_id\":\"EQHXZ8M8AV\",\"signing_id\":\"com.apple.xpc.proxy\",\"digest_algorithm\":\"sha256\",\"timestamp\":\"2026-04-15T06:49:55.541Z\"}},\"dns\":{\"type\":\"answer\",\"id\":\"62111\",\"op_code\":\"QUERY\",\"header_flags\":[\"RD\",\"RA\"],\"response_code\":\"NOERROR\",\"question\":{\"name\":\"www.example.com\",\"type\":\"AAAA\",\"class\":\"IN\",\"registered_domain\":\"example.com\",\"top_level_domain\":\"co.uk\",\"subdomain\":\"www\"},\"answers\":\"sample-answers\",\"resolved_ip\":[\"10.10.10.10\",\"10.10.10.11\"]},\"ecs\":{\"version\":\"1.0.0\"},\"email\":{\"attachments\":[{\"file\":{\"extension\":\"sample-extension\",\"mime_type\":\"sample-mime-type\",\"name\":\"sample.bin\",\"hash\":{\"md5\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sha1\":\"da39a3ee5e6b4b0d3255bfef95601890afd80709\",\"sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"sha384\":\"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b\",\"sha512\":\"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e\",\"ssdeep\":\"3::\",\"tlsh\":\"T100000000000000000000000000000000000000000000000000000000000000000000\"}}}],\"bcc\":{\"address\":[\"bcc.user1@example.com\"]},\"cc\":{\"address\":[\"cc.user1@example.com\"]},\"content_type\":\"text/plain\",\"delivery_timestamp\":\"2026-04-15T06:49:55.541Z\",\"direction\":\"inbound\",\"from\":{\"address\":[\"sender@example.com\"]},\"local_id\":\"c26dbea0-80d5-463b-b93c-4e8b708219ce\",\"message_id\":\"81ce15$8r2j59@mail01.example.com\",\"origination_timestamp\":\"2026-04-15T06:49:55.541Z\",\"reply_to\":{\"address\":[\"reply.here@example.com\"]},\"sender\":{\"address\":\"198.51.100.100\"},\"subject\":\"Please see this important message.\",\"to\":{\"address\":[\"user1@example.com\"]},\"x_mailer\":\"Spambot v2.5\"},\"error\":{\"id\":\"sample-id\",\"code\":\"sample-code\",\"type\":\"java.lang.NullPointerException\",\"stack_trace\":\"sample-stack-trace\"},\"event\":{\"id\":\"8a4f500d\",\"code\":\"4648\",\"kind\":\"alert\",\"category\":[\"authentication\"],\"action\":\"user-password-change\",\"outcome\":\"success\",\"type\":[\"item-0\"],\"module\":\"beyondtrust_epm\",\"dataset\":\"beyondtrust_epm.event\",\"provider\":\"kernel\",\"severity\":7,\"original\":\"Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232\",\"hash\":\"123456789012345678901234567890ABCD\",\"duration\":42,\"sequence\":42,\"timezone\":\"America/Los_Angeles\",\"created\":\"2026-04-15T06:49:55.541Z\",\"start\":\"2026-04-15T06:49:55.541Z\",\"end\":\"2026-04-15T06:49:55.541Z\",\"risk_score\":1,\"risk_score_norm\":1,\"ingested\":\"2026-04-15T06:49:55.541Z\",\"reference\":\"https://system.example.com/event/#0001234\",\"url\":\"https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe\",\"reason\":\"Terminated an unexpected process\",\"agent_id_status\":\"verified\",\"ReceivedAt\":\"2026-04-15T06:49:55.541Z\"},\"faas\":{\"name\":\"my-function\",\"id\":\"arn:aws:lambda:us-west-2:123456789012:function:my-function\",\"version\":\"123\",\"coldstart\":true,\"execution\":\"af9d5aa4-a685-4c5f-a22b-444f80b3cc28\",\"trigger\":{\"type\":\"http\",\"request_id\":\"123456789\"}},\"file\":{\"name\":\"example.png\",\"attributes\":[\"readonly\",\"system\"],\"directory\":\"/home/alice\",\"drive_letter\":\"C\",\"path\":\"/home/alice/example.png\",\"target_path\":\"sample-target-path\",\"extension\":\"png\",\"type\":\"file\",\"device\":\"sda\",\"inode\":\"256383\",\"uid\":\"1001\",\"gid\":\"1001\",\"group\":\"alice\",\"owner\":\"alice\",\"mode\":\"0640\",\"size\":16384,\"mtime\":\"2026-04-15T06:49:55.541Z\",\"ctime\":\"2026-04-15T06:49:55.541Z\",\"created\":\"2026-04-15T06:49:55.541Z\",\"accessed\":\"2026-04-15T06:49:55.541Z\",\"mime_type\":\"sample-mime-type\",\"fork_name\":\"Zone.Identifier\",\"DriveType\":\"sample-rive-ype\",\"SourceUrl\":\"sample-ource-rl\",\"ZoneTag\":\"sample-one-ag\",\"ProductVersion\":\"sample-roduct-ersion\",\"Description\":\"sample-escription\",\"Version\":\"sample-version\",\"hash\":{\"md5\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sha1\":\"da39a3ee5e6b4b0d3255bfef95601890afd80709\",\"sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"sha384\":\"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b\",\"sha512\":\"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e\",\"ssdeep\":\"3::\",\"tlsh\":\"T100000000000000000000000000000000000000000000000000000000000000000000\"},\"pe\":{\"original_file_name\":\"MSPAINT.EXE\",\"file_version\":\"6.3.9600.17415\",\"description\":\"Paint\",\"product\":\"Microsoft® Windows® Operating System\",\"company\":\"Microsoft Corporation\",\"imphash\":\"0c6803c4e922103c4dca5963aad36ddf\",\"architecture\":\"x64\",\"pehash\":\"73ff189b63cd6be375a7ff25179a38d347651975\"},\"x509\":{\"version_number\":\"3\",\"serial_number\":\"55FBB9C7DEBF09809D12CCAA\",\"issuer\":{\"distinguished_name\":\"C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA\",\"common_name\":[\"Example SHA2 High Assurance Server CA\"],\"organizational_unit\":[\"www.example.com\"],\"organization\":[\"Example Inc\"],\"locality\":[\"Mountain View\"],\"state_or_province\":[\"California\"],\"country\":[\"US\"]},\"signature_algorithm\":\"SHA256-RSA\",\"not_before\":\"2026-04-15T06:49:55.541Z\",\"not_after\":\"2026-04-15T06:49:55.541Z\",\"subject\":{\"distinguished_name\":\"C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net\",\"common_name\":[\"shared.global.example.net\"],\"organizational_unit\":[\"item-0\"],\"organization\":[\"Example, Inc.\"],\"locality\":[\"San Francisco\"],\"state_or_province\":[\"California\"],\"country\":[\"US\"]},\"public_key_algorithm\":\"RSA\",\"public_key_size\":2048,\"public_key_exponent\":65537,\"public_key_curve\":\"nistp521\",\"alternative_names\":[\"*.elastic.co\"]},\"Bundle\":{\"Name\":\"sample.bin\",\"Type\":\"EXEC\",\"Creator\":\"sample-reator\",\"InfoDescription\":\"sample-info-escription\",\"Version\":\"sample-version\",\"DownloadSource\":\"sample-ownload-ource\",\"Uri\":\"sample-ri\"},\"Owner\":{\"Identifier\":\"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01\",\"Name\":\"alice\",\"DomainIdentifier\":\"corp.example.com\",\"DomainName\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\"},\"code_signature\":{\"exists\":true,\"subject_name\":\"Microsoft Corporation\",\"valid\":true,\"trusted\":true,\"status\":\"ERROR_UNTRUSTED_ROOT\",\"team_id\":\"EQHXZ8M8AV\",\"signing_id\":\"com.apple.xpc.proxy\",\"digest_algorithm\":\"sha256\",\"timestamp\":\"2026-04-15T06:49:55.541Z\"},\"elf\":{\"creation_date\":\"2026-04-15T06:49:55.541Z\",\"architecture\":\"x86-64\",\"byte_order\":\"Little Endian\",\"cpu_type\":\"Intel\",\"header\":{\"class\":\"sample-class\",\"data\":\"sample-data\",\"os_abi\":\"sample-os-abi\",\"type\":\"EXEC\",\"version\":\"sample-version\",\"abi_version\":\"sample-abi-version\",\"entrypoint\":42,\"object_version\":\"sample-object-version\"},\"exports\":{\"additionalProp\":\"sample-additional-rop\"},\"imports\":{\"additionalProp\":\"sample-additional-rop\"},\"shared_libraries\":[\"item-0\"],\"telfhash\":\"b1946ac92492d2347c6235b4d2611184\",\"segments\":[{\"type\":\"EXEC\",\"sections\":\"sample-sections\"}]}},\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"sample-resource\",\"domain\":\"corp.example.com\"},\"host\":{\"DefaultUILanguage\":\"example-default-ui-language\",\"NetBIOSName\":\"sample-net-bios\",\"hostname\":\"sample-hostname\",\"name\":\"sample-resource\",\"id\":\"sample-id\",\"ip\":[\"81.2.69.144\"],\"mac\":[\"00-00-5E-00-53-23\",\"00-00-5E-00-53-24\"],\"type\":\"EXEC\",\"uptime\":1325,\"architecture\":\"x86_64\",\"domain\":\"CONTOSO\",\"cpu\":{\"usage\":1},\"disk\":{\"read\":{\"bytes\":42},\"write\":{\"bytes\":42}},\"network\":{\"ingress\":{\"bytes\":42,\"packets\":42},\"egress\":{\"bytes\":42,\"packets\":42}},\"boot\":{\"id\":\"88a1f0ed-5ae5-41ee-af6b-41921c311872\"},\"pid_ns_ino\":\"256383\",\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"ChassisType\":\"sample-hassis-ype\",\"DefaultLocale\":\"sample-efault-ocale\",\"geo\":{\"location\":{\"lon\":-122,\"lat\":37},\"continent_code\":\"NA\",\"continent_name\":\"North America\",\"country_name\":\"Canada\",\"region_name\":\"Quebec\",\"city_name\":\"Montreal\",\"country_iso_code\":\"CA\",\"postal_code\":\"94040\",\"region_iso_code\":\"CA-QC\",\"timezone\":\"America/Argentina/Buenos_Aires\",\"name\":\"boston-dc\",\"TimezoneOffset\":-480},\"os\":{\"type\":\"macos\",\"platform\":\"darwin\",\"name\":\"Mac OS X\",\"full\":\"Mac OS Mojave\",\"family\":\"debian\",\"version\":\"10.14.1\",\"kernel\":\"4.4.0-112-generic\",\"ProductType\":\"sample-roduct-ype\"}},\"http\":{\"request\":{\"id\":\"123e4567-e89b-12d3-a456-426614174000\",\"method\":\"POST\",\"mime_type\":\"image/gif\",\"body\":{\"content\":\"Hello world\",\"bytes\":887},\"referrer\":\"https://blog.example.com/\",\"bytes\":1437},\"response\":{\"status_code\":404,\"mime_type\":\"image/gif\",\"body\":{\"content\":\"Hello world\",\"bytes\":887},\"bytes\":1437},\"version\":\"1.1\"},\"log\":{\"level\":\"error\",\"file\":{\"path\":\"/var/log/fun-times.log\"},\"logger\":\"org.elasticsearch.bootstrap.Bootstrap\",\"origin\":{\"file\":{\"name\":\"Bootstrap.java\",\"line\":42},\"function\":\"init\"},\"syslog\":\"sample-syslog\"},\"network\":{\"name\":\"Guest Wifi\",\"type\":\"ipv4\",\"iana_number\":\"6\",\"transport\":\"tcp\",\"application\":\"aim\",\"protocol\":\"http\",\"direction\":\"inbound\",\"forwarded_ip\":\"67.43.156.1\",\"community_id\":\"1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=\",\"bytes\":368,\"packets\":24,\"inner\":\"sample-inner\",\"vlan\":{\"id\":\"10\",\"name\":\"outside\"}},\"observer\":{\"mac\":[\"00-00-5E-00-53-23\",\"00-00-5E-00-53-24\"],\"ip\":[\"81.2.69.144\"],\"hostname\":\"sample-hostname\",\"name\":\"1_proxySG\",\"product\":\"s200\",\"vendor\":\"Symantec\",\"version\":\"sample-version\",\"serial_number\":\"sample-serial-number\",\"type\":\"firewall\",\"ingress\":\"sample-ingress\",\"egress\":\"sample-egress\",\"geo\":{\"location\":{\"lon\":-122,\"lat\":37},\"continent_code\":\"NA\",\"continent_name\":\"North America\",\"country_name\":\"Canada\",\"region_name\":\"Quebec\",\"city_name\":\"Montreal\",\"country_iso_code\":\"CA\",\"postal_code\":\"94040\",\"region_iso_code\":\"CA-QC\",\"timezone\":\"America/Argentina/Buenos_Aires\",\"name\":\"boston-dc\",\"TimezoneOffset\":-480},\"os\":{\"type\":\"macos\",\"platform\":\"darwin\",\"name\":\"Mac OS X\",\"full\":\"Mac OS Mojave\",\"family\":\"debian\",\"version\":\"10.14.1\",\"kernel\":\"4.4.0-112-generic\",\"ProductType\":\"sample-roduct-ype\"}},\"orchestrator\":{\"cluster\":{\"name\":\"sample-resource\",\"id\":\"sample-id\",\"url\":\"sample-url\",\"version\":\"sample-version\"},\"type\":\"kubernetes\",\"organization\":\"elastic\",\"namespace\":\"kube-system\",\"resource\":{\"name\":\"test-pod-cdcws\",\"type\":\"service\",\"parent\":{\"type\":\"DaemonSet\"},\"ip\":[\"81.2.69.144\"],\"id\":\"sample-id\"},\"api_version\":\"v1beta1\"},\"organization\":{\"name\":\"sample-resource\",\"id\":\"sample-id\"},\"package\":{\"name\":\"go\",\"version\":\"1.12.9\",\"build_version\":\"36f4f7e89dd61b0988b12ee000b98966867710cd\",\"description\":\"Open source programming language to build simple/reliable/efficient software.\",\"size\":62231,\"installed\":\"2026-04-15T06:49:55.541Z\",\"path\":\"/usr/local/Cellar/go/1.12.9/\",\"architecture\":\"x86_64\",\"checksum\":\"68b329da9893e34099c7d8ad5cb9c940\",\"install_scope\":\"global\",\"license\":\"Apache License 2.0\",\"reference\":\"https://golang.org\",\"type\":\"rpm\"},\"process\":{\"group_leader\":{\"pid\":4242,\"entity_id\":\"sample-entity-id\",\"name\":\"sample-resource\",\"pgid\":4242,\"command_line\":\"sample-command-line\",\"args\":[\"item-0\"],\"args_count\":3,\"executable\":\"sample-executable\",\"title\":\"sample-title\",\"thread\":{\"id\":\"4242\",\"name\":\"sample-resource\"},\"start\":\"2026-04-15T06:49:55.541Z\",\"uptime\":3600,\"working_directory\":\"sample-working-directory\",\"exit_code\":137,\"end\":\"2026-04-15T06:49:55.541Z\",\"interactive\":true,\"same_as_process\":true,\"env_vars\":\"sample-env-vars\",\"entry_meta\":{\"type\":\"terminal\",\"source\":{\"address\":\"198.51.100.100\",\"ip\":\"81.2.69.144\",\"port\":443,\"mac\":\"00:1a:2b:3c:4d:5e\",\"domain\":\"corp.example.com\",\"registered_domain\":\"example.com\",\"top_level_domain\":\"corp.example.com\",\"subdomain\":\"corp.example.com\",\"bytes\":1024,\"packets\":1024,\"nat\":{\"ip\":\"81.2.69.144\",\"port\":443},\"as\":{\"number\":15169,\"organization\":{\"name\":\"DESKTOP-ACME-01\"}},\"geo\":{\"location\":{\"lon\":-122,\"lat\":37},\"continent_code\":\"US\",\"continent_name\":\"North America\",\"country_name\":\"United States\",\"region_name\":\"California\",\"city_name\":\"San Francisco\",\"country_iso_code\":\"US\",\"postal_code\":\"US\",\"region_iso_code\":\"US\",\"timezone\":\"America/Los_Angeles\",\"name\":\"us-west-2\",\"TimezoneOffset\":-480},\"user\":{\"id\":\"alice\",\"name\":\"alice\",\"full_name\":\"alice\",\"email\":\"alice\",\"hash\":\"alice\",\"domain\":\"alice\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"alice\",\"DomainNetBIOSName\":\"alice\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"},\"target\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"}},\"effective\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"}},\"changes\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"DESKTOP-ACME-01\",\"domain\":\"corp.example.com\"}}}}},\"tty\":\"sample-tty\",\"ElevationRequired\":true,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"sample-resource\",\"domain\":\"corp.example.com\"},\"real_group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"sample-resource\",\"domain\":\"corp.example.com\"},\"saved_group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"sample-resource\",\"domain\":\"corp.example.com\"},\"supplemental_groups\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"sample-resource\",\"domain\":\"corp.example.com\"},\"hash\":{\"md5\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sha1\":\"da39a3ee5e6b4b0d3255bfef95601890afd80709\",\"sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"sha384\":\"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b\",\"sha512\":\"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e\",\"ssdeep\":\"3::\",\"tlsh\":\"T100000000000000000000000000000000000000000000000000000000000000000000\"},\"pe\":{\"original_file_name\":\"MSPAINT.EXE\",\"file_version\":\"6.3.9600.17415\",\"description\":\"Paint\",\"product\":\"Microsoft® Windows® Operating System\",\"company\":\"Microsoft Corporation\",\"imphash\":\"0c6803c4e922103c4dca5963aad36ddf\",\"architecture\":\"x64\",\"pehash\":\"73ff189b63cd6be375a7ff25179a38d347651975\"},\"code_signature\":{\"exists\":true,\"subject_name\":\"Microsoft Corporation\",\"valid\":true,\"trusted\":true,\"status\":\"ERROR_UNTRUSTED_ROOT\",\"team_id\":\"EQHXZ8M8AV\",\"signing_id\":\"com.apple.xpc.proxy\",\"digest_algorithm\":\"sha256\",\"timestamp\":\"2026-04-15T06:49:55.541Z\"},\"elf\":{\"creation_date\":\"2026-04-15T06:49:55.541Z\",\"architecture\":\"x86-64\",\"byte_order\":\"Little Endian\",\"cpu_type\":\"Intel\",\"header\":{\"class\":\"sample-class\",\"data\":\"sample-data\",\"os_abi\":\"sample-os-abi\",\"type\":\"EXEC\",\"version\":\"sample-version\",\"abi_version\":\"sample-abi-version\",\"entrypoint\":42,\"object_version\":\"sample-object-version\"},\"sections\":[{\"flags\":\"sample-flags\",\"name\":\"sample-resource\",\"physical_offset\":\"sample-physical-offset\",\"type\":\"EXEC\",\"physical_size\":8192,\"virtual_address\":4096,\"virtual_size\":8192,\"entropy\":4,\"chi2\":1000}],\"exports\":{\"additionalProp\":\"sample-additional-rop\"},\"imports\":{\"additionalProp\":\"sample-additional-rop\"},\"shared_libraries\":[\"item-0\"],\"telfhash\":\"b1946ac92492d2347c6235b4d2611184\",\"segments\":[{\"type\":\"EXEC\",\"sections\":\"sample-sections\"}]},\"HostedFile\":{\"name\":\"sample.bin\",\"attributes\":[\"item-0\"],\"directory\":\"sample-directory\",\"drive_letter\":\"sample-drive-letter\",\"path\":\"sample-path\",\"target_path\":\"sample-target-path\",\"extension\":\"sample-extension\",\"type\":\"EXEC\",\"device\":\"sample-device\",\"inode\":\"sample-inode\",\"uid\":\"sample-uid\",\"owner\":\"sample-owner\",\"gid\":\"sample-gid\",\"group\":\"sample-group\",\"mode\":\"sample-mode\",\"size\":1024,\"mtime\":\"2026-04-15T06:49:55.541Z\",\"ctime\":\"2026-04-15T06:49:55.541Z\",\"created\":\"2026-04-15T06:49:55.541Z\",\"accessed\":\"2026-04-15T06:49:55.541Z\",\"mime_type\":\"sample-mime-type\",\"fork_name\":\"sample-fork-name\",\"DriveType\":\"sample-rive-ype\",\"SourceUrl\":\"sample-ource-rl\",\"ZoneTag\":\"sample-one-ag\",\"ProductVersion\":\"sample-roduct-ersion\",\"Description\":\"sample-escription\",\"Version\":\"sample-version\",\"hash\":{\"md5\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sha1\":\"da39a3ee5e6b4b0d3255bfef95601890afd80709\",\"sha256\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"sha384\":\"38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b\",\"sha512\":\"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e\",\"ssdeep\":\"3::\",\"tlsh\":\"T100000000000000000000000000000000000000000000000000000000000000000000\"},\"pe\":{\"original_file_name\":\"sample-original-file-name\",\"file_version\":\"sample-file-version\",\"description\":\"sample-description\",\"product\":\"sample-product\",\"company\":\"sample-company\",\"imphash\":\"sample-imphash\",\"architecture\":\"sample-architecture\",\"pehash\":\"b1946ac92492d2347c6235b4d2611184\"},\"x509\":{\"version_number\":\"sample-version-number\",\"serial_number\":\"sample-serial-number\",\"issuer\":{\"distinguished_name\":\"sample-distinguished-name\",\"common_name\":[\"item-0\"],\"organizational_unit\":[\"item-0\"],\"organization\":[\"item-0\"],\"locality\":[\"item-0\"],\"state_or_province\":[\"item-0\"],\"country\":[\"item-0\"]},\"signature_algorithm\":\"sample-signature-algorithm\",\"not_before\":\"2026-04-15T06:49:55.541Z\",\"not_after\":\"2026-04-15T06:49:55.541Z\",\"subject\":{\"distinguished_name\":\"sample-distinguished-name\",\"common_name\":[\"item-0\"],\"organizational_unit\":[\"item-0\"],\"organization\":[\"item-0\"],\"locality\":[\"item-0\"],\"state_or_province\":[\"item-0\"],\"country\":[\"item-0\"]},\"public_key_algorithm\":\"sample-public-key-algorithm\",\"public_key_size\":42,\"public_key_exponent\":42,\"public_key_curve\":\"sample-public-key-curve\",\"alternative_names\":[\"item-0\"]},\"Bundle\":{\"Name\":\"sample.bin\",\"Type\":\"EXEC\",\"Creator\":\"sample-reator\",\"InfoDescription\":\"sample-nfo-escription\",\"Version\":\"sample-version\",\"DownloadSource\":\"sample-ownload-ource\",\"Uri\":\"sample-ri\"},\"Owner\":{\"Identifier\":\"801e9de5-5a58-4f93-a1dc-5c2c3e7c9e01\",\"Name\":\"alice\",\"DomainIdentifier\":\"corp.example.com\",\"DomainName\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\"},\"code_signature\":{\"exists\":true,\"subject_name\":\"sample-subject-name\",\"valid\":true,\"trusted\":true,\"status\":\"sample-status\",\"team_id\":\"sample-team-id\",\"signing_id\":\"sample-signing-id\",\"digest_algorithm\":\"sample-digest-algorithm\",\"timestamp\":\"2026-04-15T06:49:55.541Z\"},\"elf\":{\"creation_date\":\"2026-04-15T06:49:55.541Z\",\"architecture\":\"sample-architecture\",\"byte_order\":\"sample-byte-order\",\"cpu_type\":\"sample-cpu-type\",\"header\":{\"class\":\"sample-class\",\"data\":\"sample-data\",\"os_abi\":\"sample-os-abi\",\"type\":\"EXEC\",\"version\":\"sample-version\",\"abi_version\":\"sample-abi-version\",\"entrypoint\":42,\"object_version\":\"sample-object-version\"},\"sections\":[{\"flags\":\"sample-flags\",\"name\":\"sample.bin\",\"physical_offset\":\"sample-physical-offset\",\"type\":\"EXEC\",\"physical_size\":8192,\"virtual_address\":4096,\"virtual_size\":8192,\"entropy\":4,\"chi2\":1000}],\"exports\":{\"additionalProp\":\"sample-additional-rop\"},\"imports\":{\"additionalProp\":\"sample-additional-rop\"},\"shared_libraries\":[\"item-0\"],\"telfhash\":\"b1946ac92492d2347c6235b4d2611184\",\"segments\":[{\"type\":\"EXEC\",\"sections\":\"sample-sections\"}]}},\"user\":{\"id\":\"S-1-5-21-202424912787-2692429404-2351956786-1000\",\"name\":\"a.einstein\",\"full_name\":\"Albert Einstein\",\"email\":\"alice\",\"hash\":\"alice\",\"domain\":\"alice\",\"roles\":[\"kibana_admin\",\"reporting_user\"],\"DomainIdentifier\":\"alice\",\"DomainNetBIOSName\":\"alice\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"},\"target\":{\"id\":\"S-1-5-21-202424912787-2692429404-2351956786-1000\",\"name\":\"a.einstein\",\"full_name\":\"Albert Einstein\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"kibana_admin\",\"reporting_user\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"}},\"effective\":{\"id\":\"S-1-5-21-202424912787-2692429404-2351956786-1000\",\"name\":\"a.einstein\",\"full_name\":\"Albert Einstein\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"kibana_admin\",\"reporting_user\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"}},\"changes\":{\"id\":\"S-1-5-21-202424912787-2692429404-2351956786-1000\",\"name\":\"a.einstein\",\"full_name\":\"Albert Einstein\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"kibana_admin\",\"reporting_user\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"}}},\"saved_user\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"},\"target\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"}},\"effective\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"}},\"changes\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"}}},\"real_user\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"},\"target\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"}},\"effective\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"}},\"changes\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"full_name\":\"Alice Williams\",\"email\":\"alice.williams@example.com\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"domain\":\"corp.example.com\",\"roles\":[\"admin\"],\"DomainIdentifier\":\"corp.example.com\",\"DomainNetBIOSName\":\"corp.example.com\",\"DefaultTimezoneOffset\":-480,\"LocalIdentifier\":10001,\"group\":{\"id\":\"S-1-5-21-3623811015-3361044348-30300820-513\",\"name\":\"alice\",\"domain\":\"corp.example.com\"}}}}}}", + "outcome": "success", + "provider": "kernel", + "reason": [ + "Terminated an unexpected process" + ], + "reference": "https://system.example.com/event/#0001234", + "risk_score": 1, + "risk_score_norm": 1, + "sequence": 42, + "severity": 7, + "start": "2026-04-15T06:49:55.541Z", + "timezone": "America/Los_Angeles", + "type": [ + "info" + ], + "url": "https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe" + }, + "faas": { + "coldstart": true, + "execution": "af9d5aa4-a685-4c5f-a22b-444f80b3cc28", + "id": "arn:aws:lambda:us-west-2:123456789012:function:my-function", + "name": "my-function", + "trigger": { + "request_id": "123456789", + "type": "http" + }, + "version": "123" + }, + "file": { + "accessed": "2026-04-15T06:49:55.541Z", + "attributes": [ + "readonly", + "system" + ], + "code_signature": { + "digest_algorithm": "sha256", + "exists": true, + "signing_id": "com.apple.xpc.proxy", + "status": "ERROR_UNTRUSTED_ROOT", + "subject_name": "Microsoft Corporation", + "team_id": "EQHXZ8M8AV", + "timestamp": "2026-04-15T06:49:55.541Z", + "trusted": true, + "valid": true + }, + "created": "2026-04-15T06:49:55.541Z", + "ctime": "2026-04-15T06:49:55.541Z", + "device": "sda", + "directory": "/home/alice", + "drive_letter": "C", + "elf": { + "architecture": "x86-64", + "byte_order": "Little Endian", + "cpu_type": "Intel", + "creation_date": "2026-04-15T06:49:55.541Z", + "header": { + "abi_version": "sample-abi-version", + "class": "sample-class", + "data": "sample-data", + "entrypoint": 42, + "object_version": "sample-object-version", + "os_abi": "sample-os-abi", + "type": "EXEC", + "version": "sample-version" + }, + "segments": { + "sections": [ + "sample-sections" + ], + "type": [ + "EXEC" + ] + }, + "shared_libraries": [ + "item-0" + ], + "telfhash": "b1946ac92492d2347c6235b4d2611184" + }, + "extension": "png", + "fork_name": "Zone.Identifier", + "gid": "1001", + "group": "alice", + "hash": { + "md5": "d41d8cd98f00b204e9800998ecf8427e", + "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "sha384": "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b", + "sha512": "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e", + "ssdeep": "3::", + "tlsh": "T100000000000000000000000000000000000000000000000000000000000000000000" + }, + "inode": "256383", + "mime_type": "sample-mime-type", + "mode": "0640", + "mtime": "2026-04-15T06:49:55.541Z", + "name": "example.png", + "origin_url": "sample-ource-rl", + "owner": "alice", + "path": "/home/alice/example.png", + "pe": { + "architecture": "x64", + "company": "Microsoft Corporation", + "description": "Paint", + "file_version": "6.3.9600.17415", + "imphash": "0c6803c4e922103c4dca5963aad36ddf", + "original_file_name": "MSPAINT.EXE", + "pehash": "73ff189b63cd6be375a7ff25179a38d347651975", + "product": "Microsoft® Windows® Operating System" + }, + "size": 16384, + "target_path": "sample-target-path", + "type": "file", + "uid": "1001", + "x509": { + "alternative_names": [ + "*.elastic.co" + ], + "issuer": { + "common_name": [ + "Example SHA2 High Assurance Server CA" + ], + "country": [ + "US" + ], + "distinguished_name": "C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA", + "locality": [ + "Mountain View" + ], + "organization": [ + "Example Inc" + ], + "organizational_unit": [ + "www.example.com" + ], + "state_or_province": [ + "California" + ] + }, + "not_after": "2026-04-15T06:49:55.541Z", + "not_before": "2026-04-15T06:49:55.541Z", + "public_key_algorithm": "RSA", + "public_key_curve": "nistp521", + "public_key_exponent": 65537, + "public_key_size": 2048, + "serial_number": "55FBB9C7DEBF09809D12CCAA", + "signature_algorithm": "SHA256-RSA", + "subject": { + "common_name": [ + "shared.global.example.net" + ], + "country": [ + "US" + ], + "distinguished_name": "C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net", + "locality": [ + "San Francisco" + ], + "organization": [ + "Example, Inc." + ], + "organizational_unit": [ + "item-0" + ], + "state_or_province": [ + "California" + ] + }, + "version_number": "3" + } + }, + "group": { + "domain": "corp.example.com", + "id": "S-1-5-21-3623811015-3361044348-30300820-513", + "name": [ + "sample-resource" + ] + }, + "host": { + "architecture": "x86_64", + "boot": { + "id": "88a1f0ed-5ae5-41ee-af6b-41921c311872" + }, + "cpu": { + "usage": 1 + }, + "disk": { + "read": { + "bytes": 42 + }, + "write": { + "bytes": 42 + } + }, + "domain": "CONTOSO", + "geo": { + "city_name": "Montreal", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "CA", + "country_name": "Canada", + "location": { + "lat": 37, + "lon": -122 + }, + "name": "boston-dc", + "postal_code": "94040", + "region_iso_code": "CA-QC", + "region_name": "Quebec", + "timezone": "America/Argentina/Buenos_Aires" + }, + "hostname": "sample-hostname", + "id": "sample-id", + "ip": [ + "81.2.69.144" + ], + "mac": [ + "00-00-5E-00-53-23", + "00-00-5E-00-53-24" + ], + "name": "sample-resource", + "network": { + "egress": { + "bytes": 42, + "packets": 42 + }, + "ingress": { + "bytes": 42, + "packets": 42 + } + }, + "os": { + "family": "debian", + "full": "Mac OS Mojave", + "kernel": "4.4.0-112-generic", + "name": "Mac OS X", + "platform": "darwin", + "type": "macos", + "version": "10.14.1" + }, + "pid_ns_ino": "256383", + "type": "EXEC", + "uptime": 1325 + }, + "http": { + "request": { + "body": { + "bytes": 887, + "content": "Hello world" + }, + "bytes": 1437, + "id": "123e4567-e89b-12d3-a456-426614174000", + "method": "POST", + "mime_type": "image/gif", + "referrer": "https://blog.example.com/" + }, + "response": { + "body": { + "bytes": 887, + "content": "Hello world" + }, + "bytes": 1437, + "mime_type": "image/gif", + "status_code": 404 + }, + "version": "1.1" + }, + "input": { + "type": "aws-s3" + }, + "log": { + "file": { + "path": "/var/log/fun-times.log" + }, + "level": "error", + "logger": "org.elasticsearch.bootstrap.Bootstrap", + "offset": 0, + "origin": { + "file": { + "line": 42, + "name": "Bootstrap.java" + }, + "function": "init" + } + }, + "message": "Hello World", + "network": { + "application": "aim", + "bytes": 368, + "community_id": "1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=", + "direction": "inbound", + "forwarded_ip": "67.43.156.1", + "iana_number": "6", + "name": "Guest Wifi", + "packets": 24, + "protocol": "http", + "transport": "tcp", + "type": "ipv4", + "vlan": { + "id": "10", + "name": "outside" + } + }, + "observer": { + "geo": { + "city_name": "Montreal", + "continent_code": "NA", + "continent_name": "North America", + "country_iso_code": "CA", + "country_name": "Canada", + "location": { + "lat": 37, + "lon": -122 + }, + "name": "boston-dc", + "postal_code": "94040", + "region_iso_code": "CA-QC", + "region_name": "Quebec", + "timezone": "America/Argentina/Buenos_Aires" + }, + "hostname": "sample-hostname", + "ip": [ + "81.2.69.144" + ], + "mac": [ + "00-00-5E-00-53-23", + "00-00-5E-00-53-24" + ], + "name": "1_proxySG", + "os": { + "family": "debian", + "full": "Mac OS Mojave", + "kernel": "4.4.0-112-generic", + "name": "Mac OS X", + "platform": "darwin", + "type": "macos", + "version": "10.14.1" + }, + "product": [ + "Endpoint Privilege Management", + "s200" + ], + "serial_number": "sample-serial-number", + "type": "firewall", + "vendor": [ + "BeyondTrust", + "Symantec" + ], + "version": "sample-version" + }, + "orchestrator": { + "api_version": "v1beta1", + "cluster": { + "id": "sample-id", + "name": "sample-resource", + "url": "sample-url", + "version": "sample-version" + }, + "namespace": "kube-system", + "organization": "elastic", + "resource": { + "id": "sample-id", + "ip": [ + "81.2.69.144" + ], + "name": "test-pod-cdcws", + "parent": { + "type": "DaemonSet" + }, + "type": "service" + }, + "type": "kubernetes" + }, + "organization": { + "id": [ + "sample-id" + ], + "name": "sample-resource" + }, + "package": { + "architecture": "x86_64", + "build_version": "36f4f7e89dd61b0988b12ee000b98966867710cd", + "checksum": "68b329da9893e34099c7d8ad5cb9c940", + "description": "Open source programming language to build simple/reliable/efficient software.", + "install_scope": "global", + "installed": "2026-04-15T06:49:55.541Z", + "license": "Apache License 2.0", + "name": "go", + "path": "/usr/local/Cellar/go/1.12.9/", + "reference": "https://golang.org", + "size": 62231, + "type": "rpm", + "version": "1.12.9" + }, + "related": { + "hash": [ + "b1946ac92492d2347c6235b4d2611184", + "alice", + "d41d8cd98f00b204e9800998ecf8427e", + "da39a3ee5e6b4b0d3255bfef95601890afd80709", + "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b", + "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e", + "0c6803c4e922103c4dca5963aad36ddf", + "73ff189b63cd6be375a7ff25179a38d347651975", + "3::", + "T100000000000000000000000000000000000000000000000000000000000000000000", + "f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26", + "123456789012345678901234567890ABCD" + ], + "hosts": [ + "DESKTOP-ACME-01" + ], + "ip": [ + "81.2.69.144", + "10.10.10.10", + "10.10.10.11", + "67.43.156.1" + ], + "user": [ + "alice.williams@example.com", + "Alice Williams", + "DESKTOP-ACME-01", + "S-1-5-21-3623811015-3361044348-30300820-1013", + "alice", + "Albert Einstein", + "S-1-5-21-202424912787-2692429404-2351956786-1000", + "a.einstein" + ] + }, + "tags": [ + "collect_sqs_logs", + "preserve_original_event", + "forwarded", + "beyondtrust_epm-event", + "production", + "env2" + ], + "user": { + "domain": "alice", + "id": "alice" + } +} diff --git a/packages/beyondtrust_epm/docs/README.md b/packages/beyondtrust_epm/docs/README.md new file mode 100644 index 00000000000..27718e9441c --- /dev/null +++ b/packages/beyondtrust_epm/docs/README.md @@ -0,0 +1,791 @@ +# BeyondTrust EPM Integration for Elastic + +## Overview + +[BeyondTrust Endpoint Privilege Management (EPM)](https://www.beyondtrust.com/products/endpoint-privilege-management) is a security solution that enforces least-privilege policies across endpoints, controls application usage, audits privileged activity, and tracks event activity. It helps organizations reduce their attack surface by managing and monitoring privilege escalation, application control, event activity, and configuration changes across users and devices. + +The BeyondTrust EPM integration for Elastic collects audit and event logs using the **BeyondTrust EPM Management API** or through **AWS S3/SQS** cloud storage, and visualizes them in Kibana. + +### Compatibility + +The BeyondTrust EPM integration is compatible with BeyondTrust EPM version **26.1** and Management API version **v3**. + +### How it works + +This integration supports two collection methods: + +- **Direct API polling** via CEL input, which periodically queries the BeyondTrust EPM Management API using OAuth 2.0 (Client Credentials) authentication. +- **Cloud storage** via AWS S3/SQS, for organizations that export audit and event logs from BeyondTrust EPM to an AWS S3 bucket using the built-in SIEM integration. + +## What data does this integration collect? + +This integration collects log messages of the following type: + +- `Audit`: Collects audit logs via the **BeyondTrust EPM Management API** (endpoint: `/management-api/v3/ActivityAudits/Details`) or via **AWS S3/SQS** for organizations that export logs from BeyondTrust EPM to an S3 bucket. +- `Event`: Collects event logs via the **BeyondTrust EPM Management API** (endpoint: `/management-api/v3/Events/search`) or via **AWS S3/SQS** for organizations that export logs from BeyondTrust EPM to an S3 bucket. + +### Supported use cases + +Integrating BeyondTrust EPM with Elastic provides centralized visibility into privileged activity and configuration changes across your endpoints, enabling efficient monitoring, investigation, and compliance reporting within Kibana dashboards. + +## What do I need to use this integration? + +### From BeyondTrust EPM (API collection) + +To collect data via the Management API, you need a **Client ID** and **Client Secret** with OAuth 2.0 Client Credentials authentication. + +1. Sign in to `app.beyondtrust.io`. +2. Navigate to **Configuration** > **API Registration**. +3. Create or select an API client and copy the **Client ID** and **Client Secret**. + +For more information on configuring API registration in BeyondTrust EPM, refer to the [API Settings guide](https://docs.beyondtrust.com/epm-wm/docs/pathfinder-epm-api-settings) in the BeyondTrust documentation. + +### From BeyondTrust EPM (AWS S3 collection) + +To collect data using AWS S3, configure BeyondTrust EPM to export logs to an S3 bucket, then point Elastic at that bucket. + +#### Step 1: Set up AWS infrastructure: + +1. Create an **S3 bucket** and note the bucket name and region. +2. Create an **IAM access policy** with these permissions: + - List: `ListAllMyBuckets` + - Write: `PutObject` + - Read: `GetBucketAcl`, `GetBucketLocation`, `GetUser`, `SimulatePrincipalPolicy` +3. Create an **IAM user** with programmatic access, attach the policy, and save the **Access Key ID** and **Secret Access Key**. + +#### Step 2: Configure SIEM export in BeyondTrust EPM: + +1. Sign in to **app.beyondtrust.io**. +2. Navigate to **Endpoint Privilege Management for Windows and Mac** > **Configuration** > **SIEM Settings**. +3. Select **Enable SIEM Integration**, then choose **S3** as the Integration Type. +4. Enter the **Access Key ID**, **Secret Access Key**, **Bucket** name, and **Region**. +5. Set the data format to **ECS - Elastic Common Schema**. +6. Click **Validate Settings**, then **Save Settings**. + +> **Note:** Only one SIEM integration can be configured at a time. Events are batched and exported to S3 in one-minute intervals in JSON format. + +For more information on configuring SIEM settings in BeyondTrust EPM, refer to the [SIEM Settings guide](https://docs.beyondtrust.com/epm-wm/docs/pathfinder-epm-siem-settings) in the BeyondTrust documentation. + +## How do I deploy this integration? + +This integration supports both Elastic Agentless-based and Agent-based installations. + +### Agentless-based installation + +Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). + +Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. + +### Agent-based installation + +Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host. + +### Configure + +1. In the top search bar in Kibana, search for **Integrations**. +2. In the search bar, type **BeyondTrust EPM**. +3. Select the **BeyondTrust EPM** integration from the search results. +4. Select **Add BeyondTrust EPM** to add the integration. +5. Enable and configure only the collection methods which you will use. + + * To **Collect logs using BeyondTrust EPM API (CEL)**: + + - Set the **URL** to the base URL of your BeyondTrust EPM instance (e.g., `https://app.beyondtrust.io`). + - Set the **Client ID** and **Client Secret** obtained from API Registration. + - Optionally adjust **Initial Interval**, **Interval**, **Page Size**, and **HTTP Client Timeout**. + + * To **Collect logs using AWS S3**: + + - Set the **Bucket ARN** of the S3 bucket configured in BeyondTrust EPM SIEM Settings. + - Set **AWS Access Key ID** and **Secret Access Key** for an IAM user with read access to the bucket. + - Optionally configure **Queue URL** (SQS) if using event-driven notifications instead of bucket polling. + +6. Select **Save and continue** to save the integration. + +## Troubleshooting + +For help with Elastic ingest tools, check [Common problems](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems). + +### Validation + +#### Dashboard populated + +1. In the top search bar in Kibana, search for **Dashboards**. +2. In the search bar, type **BeyondTrust EPM**, and verify the dashboard information is populated. + +## Scaling + +For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation. + +## Reference + +### Audit + +#### Audit fields + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | +| aws.s3.bucket.arn | The AWS S3 bucket ARN. | keyword | +| aws.s3.bucket.name | The AWS S3 bucket name. | keyword | +| aws.s3.object.key | The AWS S3 Object key. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.new_adapter_version | Adapter version installed in the computer. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.new_agent_id | Guid to store the new Agent Id assigned to the computer. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.new_computer_group_id | The computer group Id that the agent is going to be assigned to. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.new_computer_group_name | The computer group name that the agent is going to be assigned to. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.new_host_type | The host type detected for the agent. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.new_os_name | Os Name assigned detected by the adapter. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.new_timestamp | TimeStamp of the audit event. | date | +| beyondtrust_epm.audit.agent_data_auditing.old_adapter_version | Present adapter version, in case of updating, this value can reflect the last adapter version used. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.old_agent_id | Guid to store the old Agent Id if there is a change in Agent Id. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.old_computer_group_id | The computer group Id that the agent was assigned to. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.old_computer_group_name | The computer group name that the agent was assigned to. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.old_host_type | The present Host type found by the adapter. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.old_os_name | The present Os Name detected by the adapter. | keyword | +| beyondtrust_epm.audit.agent_data_auditing.old_timestamp | TimeStamp of a previous audit event. | date | +| beyondtrust_epm.audit.api_client_data_auditing.deleted | | boolean | +| beyondtrust_epm.audit.api_client_data_auditing.new_description | | keyword | +| beyondtrust_epm.audit.api_client_data_auditing.new_description.text | Multi-field of `beyondtrust_epm.audit.api_client_data_auditing.new_description`. | match_only_text | +| beyondtrust_epm.audit.api_client_data_auditing.new_name | | keyword | +| beyondtrust_epm.audit.api_client_data_auditing.old_description | | keyword | +| beyondtrust_epm.audit.api_client_data_auditing.old_description.text | Multi-field of `beyondtrust_epm.audit.api_client_data_auditing.old_description`. | match_only_text | +| beyondtrust_epm.audit.api_client_data_auditing.old_name | | keyword | +| beyondtrust_epm.audit.api_client_data_auditing.secret_updated | | boolean | +| beyondtrust_epm.audit.audit_type | audit type. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.auth_request_api_client_id | Authorization Request API Client ID. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.auth_request_api_client_secret | Authorization Request Client Secret. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.auth_request_client_id | Authorization Request ClientId. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.auth_request_client_secret | Authorization Request Client Secret. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.auth_request_config_changed | Is Authorization Request Config changed?. | boolean | +| beyondtrust_epm.audit.authorization_request_data_auditing.auth_request_host_name | Authorization Requests Hostname. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.auth_request_integration_enabled | Old Value is Authorization Request Integration Enabled?. | boolean | +| beyondtrust_epm.audit.authorization_request_data_auditing.auth_request_password | Authorization Request Password. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.auth_request_user_name | Authorization Request User Name. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.old_auth_request_api_client_id | Old Value Authorization Request API Client ID. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.old_auth_request_api_client_secret | Old Value Authorization Request Client Secret. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.old_auth_request_client_id | Old Value Authorization Request ClientId. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.old_auth_request_client_secret | Old Value Authorization Request Client Secret. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.old_auth_request_host_name | Old Value Authorization Requests Hostname. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.old_auth_request_integration_enabled | Old Value is Authorization Request Integration Enabled?. | boolean | +| beyondtrust_epm.audit.authorization_request_data_auditing.old_auth_request_password | Old Value Authorization Request Password. | keyword | +| beyondtrust_epm.audit.authorization_request_data_auditing.old_auth_request_user_name | Old Value Authorization Request User Name. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_app_event_log_type | New value of application event log type. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_beyond_insight_cert_name | New value of Beyond insight certificate name. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_beyond_insight_url | New value of Beyond insight URL. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_beyond_insight_work_group | New value of Beyond insight group. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_cert_mode | New value of certificate mode. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_config_audit_enabled | New value of config audit enabled. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_config_audit_mode | New value of config audit mode. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_crl_fail_open | New value of crl fail open. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_download_audit_mode | New value of download audit mode. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_hook_load_method | New value of hook load method. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_policy_enabled | New value of policy enabled. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_policy_precedence | New value of policy precedence. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.new_ps_mode | New value of ps mode. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_app_event_log_type | Old value of app event log type. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_beyond_insight_cert_name | Old value of Beyond insight certificate name. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_beyond_insight_url | Old value of Beyond insight URL. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_beyond_insight_work_group | Old value of Beyond insight group. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_cert_mode | Old value of certificate mode. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_config_audit_enabled | Old value of config audit enabled. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_config_audit_mode | Old value of config audit mode. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_crl_fail_open | Old value of crl fail open. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_download_audit_mode | Old value of download audit mode. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_hook_load_method | Old value of hook load method. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_policy_enabled | Old value of policy enabled. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_policy_precedence | Old value of policy precedence. | keyword | +| beyondtrust_epm.audit.auto_update_group_client_settings_data_auditing.old_ps_mode | Old value of ps mode. | keyword | +| beyondtrust_epm.audit.auto_update_group_config_settings_data_auditing.new_adapter_version | New value of adapter version for package manager. | keyword | +| beyondtrust_epm.audit.auto_update_group_config_settings_data_auditing.new_client_version | New value of client version for package manager. | keyword | +| beyondtrust_epm.audit.auto_update_group_config_settings_data_auditing.new_enable_auto_update | New value of Enable auto update for package manager. | keyword | +| beyondtrust_epm.audit.auto_update_group_config_settings_data_auditing.new_use_latest_version | New value of use latest version for package manager. | keyword | +| beyondtrust_epm.audit.auto_update_group_config_settings_data_auditing.old_adapter_version | Old value of adapter version for package manager. | keyword | +| beyondtrust_epm.audit.auto_update_group_config_settings_data_auditing.old_client_version | Old value of client version for package manager. | keyword | +| beyondtrust_epm.audit.auto_update_group_config_settings_data_auditing.old_enable_auto_update | Old value of Enable auto update for package manager. | keyword | +| beyondtrust_epm.audit.auto_update_group_config_settings_data_auditing.old_use_latest_version | Old value of use latest version for package manager. | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.new_anti_tamper | | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.new_badge_icons | | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.new_biometric_authentication_enabled | | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.new_mount_assist | | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.new_sudo_enabled | | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.old_anti_tamper | | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.old_badge_icons | | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.old_biometric_authentication_enabled | | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.old_mount_assist | | keyword | +| beyondtrust_epm.audit.auto_update_group_mac_client_settings_data_auditing.old_sudo_enabled | | keyword | +| beyondtrust_epm.audit.auto_update_rate_limit_data_auditing.old_pm_requests_limit_minutes | Old Value Auto update request limits in minutes. | long | +| beyondtrust_epm.audit.auto_update_rate_limit_data_auditing.old_pm_requests_limits | Old Value Auto update request limits. | long | +| beyondtrust_epm.audit.auto_update_rate_limit_data_auditing.pm_requests_limit_minutes | Auto update request limits in minutes. | long | +| beyondtrust_epm.audit.auto_update_rate_limit_data_auditing.pm_requests_limits | Auto update request limits. | long | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.azure_ad_client_id | Azure AD Client Id used in the integration. | keyword | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.azure_ad_client_secret | Azure AD Client Secret. | keyword | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.azure_ad_config_changed | Is Azure AD Configuration changed?. | boolean | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.azure_ad_integration_enabled | Is Microsoft Entra ID Integration enabled?. | boolean | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.azure_ad_tenant_id | Old Value Azure AD Tenant ID. | keyword | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.azure_ad_use_certificate_auth | Azure AD Use Certified Authorization. | boolean | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.old_azure_ad_client_id | Old Value Azure AD Client Id used in the integration. | keyword | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.old_azure_ad_client_secret | Old Value Azure AD Client Secret. | keyword | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.old_azure_ad_integration_enabled | Old Value Is Microsoft Entra ID Integration enabled?. | boolean | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.old_azure_ad_tenant_id | Old Value Azure AD Tenant ID. | keyword | +| beyondtrust_epm.audit.azure_ad_integration_data_auditing.old_azure_ad_use_certificate_auth | Old Value Azure AD Use Certified Authorization. | boolean | +| beyondtrust_epm.audit.changed_by | Changed by enum used for activity audits. | keyword | +| beyondtrust_epm.audit.computer_data_auditing.deactivated_agents | | flattened | +| beyondtrust_epm.audit.computer_data_auditing.new_deleted_agents | | keyword | +| beyondtrust_epm.audit.computer_data_auditing.updated_policies_on | | flattened | +| beyondtrust_epm.audit.computer_policy_data_auditing.deactivated_agent_deletion_days | Deactivated Agent Deletion Days. | long | +| beyondtrust_epm.audit.computer_policy_data_auditing.enable_deactivated_agent_deletion | Is enable deactivated Agent Deletion. | boolean | +| beyondtrust_epm.audit.computer_policy_data_auditing.inactivity_agent_deactivation_days | Deactivation Days for inactivity. | long | +| beyondtrust_epm.audit.computer_policy_data_auditing.old_deactivated_agent_deletion_days | Old Value Deactivated Agent Deletion Days. | long | +| beyondtrust_epm.audit.computer_policy_data_auditing.old_enable_deactivated_agent_deletion | Old Value Is enable deactivated Agent Deletion. | boolean | +| beyondtrust_epm.audit.computer_policy_data_auditing.old_inactivity_agent_deactivation_days | Old Value Deactivation Days for inactivity. | long | +| beyondtrust_epm.audit.created | created. | date | +| beyondtrust_epm.audit.details | Details. | keyword | +| beyondtrust_epm.audit.details.text | Multi-field of `beyondtrust_epm.audit.details`. | match_only_text | +| beyondtrust_epm.audit.entity | Entity. | keyword | +| beyondtrust_epm.audit.entity_name | Name of the entity that was modified. | keyword | +| beyondtrust_epm.audit.error_info | | flattened | +| beyondtrust_epm.audit.group_data_auditing.add_policy_revisions | | flattened | +| beyondtrust_epm.audit.group_data_auditing.new_agents | | flattened | +| beyondtrust_epm.audit.group_data_auditing.new_description | | keyword | +| beyondtrust_epm.audit.group_data_auditing.new_description.text | Multi-field of `beyondtrust_epm.audit.group_data_auditing.new_description`. | match_only_text | +| beyondtrust_epm.audit.group_data_auditing.new_is_default | | boolean | +| beyondtrust_epm.audit.group_data_auditing.new_name | | keyword | +| beyondtrust_epm.audit.group_data_auditing.old_description | | keyword | +| beyondtrust_epm.audit.group_data_auditing.old_description.text | Multi-field of `beyondtrust_epm.audit.group_data_auditing.old_description`. | match_only_text | +| beyondtrust_epm.audit.group_data_auditing.old_is_default | | boolean | +| beyondtrust_epm.audit.group_data_auditing.old_name | | keyword | +| beyondtrust_epm.audit.group_data_auditing.remove_agents | | flattened | +| beyondtrust_epm.audit.group_data_auditing.remove_policy_revisions | | flattened | +| beyondtrust_epm.audit.id | Id. | keyword | +| beyondtrust_epm.audit.installation_key_data_auditing.deleted | | boolean | +| beyondtrust_epm.audit.installation_key_data_auditing.new_disabled | | boolean | +| beyondtrust_epm.audit.installation_key_data_auditing.new_label | | keyword | +| beyondtrust_epm.audit.installation_key_data_auditing.old_disabled | | boolean | +| beyondtrust_epm.audit.installation_key_data_auditing.old_label | | keyword | +| beyondtrust_epm.audit.locked | | boolean | +| beyondtrust_epm.audit.management_rule_data_auditing.new_priority | New Priority Value for rule. | long | +| beyondtrust_epm.audit.management_rule_data_auditing.old_priority | Old priority value for rule. | long | +| beyondtrust_epm.audit.mmc_remote_client_data_auditing.client_id | ClientId selected. | keyword | +| beyondtrust_epm.audit.mmc_remote_client_data_auditing.enabled | Is Remote Client enabled?. | boolean | +| beyondtrust_epm.audit.mmc_remote_client_data_auditing.old_client_id | Old Value ClientId selected. | keyword | +| beyondtrust_epm.audit.mmc_remote_client_data_auditing.old_enabled | Old Value Is Remote Client enabled?. | boolean | +| beyondtrust_epm.audit.open_id_config_data_auditing.new_authentication_type | New Authentication Type. | keyword | +| beyondtrust_epm.audit.open_id_config_data_auditing.new_client_id | New ClientId. | keyword | +| beyondtrust_epm.audit.open_id_config_data_auditing.new_domain | New Domain. | keyword | +| beyondtrust_epm.audit.open_id_config_data_auditing.new_open_id_connect_provider | New OpenIdProvider. | keyword | +| beyondtrust_epm.audit.open_id_config_data_auditing.old_authentication_type | Old Authentication Type. | keyword | +| beyondtrust_epm.audit.open_id_config_data_auditing.old_client_id | Old client ID. | keyword | +| beyondtrust_epm.audit.open_id_config_data_auditing.old_domain | Old domain. | keyword | +| beyondtrust_epm.audit.open_id_config_data_auditing.old_open_id_connect_provider | Old OpenId Provider. | keyword | +| beyondtrust_epm.audit.open_id_config_data_auditing.secret_updated | Is Secret Updated?. | boolean | +| beyondtrust_epm.audit.permission_group_data_auditing.new_description | | keyword | +| beyondtrust_epm.audit.permission_group_data_auditing.new_description.text | Multi-field of `beyondtrust_epm.audit.permission_group_data_auditing.new_description`. | match_only_text | +| beyondtrust_epm.audit.permission_group_data_auditing.new_name | | keyword | +| beyondtrust_epm.audit.permission_group_data_auditing.new_number_of_users | | keyword | +| beyondtrust_epm.audit.permission_group_data_auditing.old_description | | keyword | +| beyondtrust_epm.audit.permission_group_data_auditing.old_description.text | Multi-field of `beyondtrust_epm.audit.permission_group_data_auditing.old_description`. | match_only_text | +| beyondtrust_epm.audit.permission_group_data_auditing.old_name | | keyword | +| beyondtrust_epm.audit.permission_group_data_auditing.old_number_of_users | | keyword | +| beyondtrust_epm.audit.permission_group_data_auditing.permission_set_id | | keyword | +| beyondtrust_epm.audit.policy_data_auditing.new_description | | keyword | +| beyondtrust_epm.audit.policy_data_auditing.new_description.text | Multi-field of `beyondtrust_epm.audit.policy_data_auditing.new_description`. | match_only_text | +| beyondtrust_epm.audit.policy_data_auditing.new_name | | keyword | +| beyondtrust_epm.audit.policy_data_auditing.old_description | | keyword | +| beyondtrust_epm.audit.policy_data_auditing.old_description.text | Multi-field of `beyondtrust_epm.audit.policy_data_auditing.old_description`. | match_only_text | +| beyondtrust_epm.audit.policy_data_auditing.old_name | | keyword | +| beyondtrust_epm.audit.policy_revision_data_auditing.new_annotation_note | | keyword | +| beyondtrust_epm.audit.policy_revision_data_auditing.new_annotation_note.text | Multi-field of `beyondtrust_epm.audit.policy_revision_data_auditing.new_annotation_note`. | match_only_text | +| beyondtrust_epm.audit.policy_revision_data_auditing.new_groups | | flattened | +| beyondtrust_epm.audit.reputation_settings_data_auditing.old_reputation_integration_api_key | Old Value Reputation Integration Key. | keyword | +| beyondtrust_epm.audit.reputation_settings_data_auditing.old_reputation_integration_enabled | Old Value Is reputation integration enabled?. | boolean | +| beyondtrust_epm.audit.reputation_settings_data_auditing.reputation_config_changed | Reputation Configuration changed. | boolean | +| beyondtrust_epm.audit.reputation_settings_data_auditing.reputation_integration_api_key | Reputation Integration Key. | keyword | +| beyondtrust_epm.audit.reputation_settings_data_auditing.reputation_integration_enabled | Is reputation integration enabled?. | boolean | +| beyondtrust_epm.audit.security_settings_data_auditing.old_token_timeout | Old Value Token Timeout. | long | +| beyondtrust_epm.audit.security_settings_data_auditing.token_timeout | Token Timeout. | long | +| beyondtrust_epm.audit.settings_data_auditing.add_domain | | keyword | +| beyondtrust_epm.audit.settings_data_auditing.modify_domain_new_value | | keyword | +| beyondtrust_epm.audit.settings_data_auditing.modify_domain_old_value | | keyword | +| beyondtrust_epm.audit.settings_data_auditing.remove_domain | | keyword | +| beyondtrust_epm.audit.siem_integration_base_detail_model.siem_format | Data format selected. | keyword | +| beyondtrust_epm.audit.siem_integration_base_detail_model.siem_integration_enabled | Is siem integration enabled?. | boolean | +| beyondtrust_epm.audit.siem_integration_base_detail_model.siem_integration_type | Type of integration selected. | keyword | +| beyondtrust_epm.audit.siem_integration_qradar_auditing.cert | Cert. | keyword | +| beyondtrust_epm.audit.siem_integration_qradar_auditing.cert.text | Multi-field of `beyondtrust_epm.audit.siem_integration_qradar_auditing.cert`. | match_only_text | +| beyondtrust_epm.audit.siem_integration_qradar_auditing.host_name | Hostname. | keyword | +| beyondtrust_epm.audit.siem_integration_qradar_auditing.port | Port. | keyword | +| beyondtrust_epm.audit.siem_integration_qradar_auditing.siem_format | Data format selected. | keyword | +| beyondtrust_epm.audit.siem_integration_qradar_auditing.siem_integration_enabled | Is siem integration enabled?. | boolean | +| beyondtrust_epm.audit.siem_integration_qradar_auditing.siem_integration_type | Type of integration selected. | keyword | +| beyondtrust_epm.audit.siem_integration_s3_auditing.siem_access_key_id | AccessKeyId. | keyword | +| beyondtrust_epm.audit.siem_integration_s3_auditing.siem_bucket_name | AWS Bucket name. | keyword | +| beyondtrust_epm.audit.siem_integration_s3_auditing.siem_codec | Codec. | keyword | +| beyondtrust_epm.audit.siem_integration_s3_auditing.siem_format | Data format selected. | keyword | +| beyondtrust_epm.audit.siem_integration_s3_auditing.siem_integration_enabled | Is siem integration enabled?. | boolean | +| beyondtrust_epm.audit.siem_integration_s3_auditing.siem_integration_type | Type of integration selected. | keyword | +| beyondtrust_epm.audit.siem_integration_s3_auditing.siem_region_name | Region. | keyword | +| beyondtrust_epm.audit.siem_integration_s3_auditing.siem_sse_enabled | Is SSE enabled. | boolean | +| beyondtrust_epm.audit.siem_integration_sentinel_auditing.siem_format | Data format selected. | keyword | +| beyondtrust_epm.audit.siem_integration_sentinel_auditing.siem_integration_enabled | Is siem integration enabled?. | boolean | +| beyondtrust_epm.audit.siem_integration_sentinel_auditing.siem_integration_type | Type of integration selected. | keyword | +| beyondtrust_epm.audit.siem_integration_sentinel_auditing.table_name | TableName. | keyword | +| beyondtrust_epm.audit.siem_integration_sentinel_auditing.workspace_id | WorkspaceId. | keyword | +| beyondtrust_epm.audit.siem_integration_splunk_auditing.host_name | Hostname. | keyword | +| beyondtrust_epm.audit.siem_integration_splunk_auditing.index | Index. | keyword | +| beyondtrust_epm.audit.siem_integration_splunk_auditing.siem_format | Data format selected. | keyword | +| beyondtrust_epm.audit.siem_integration_splunk_auditing.siem_integration_enabled | Is siem integration enabled?. | boolean | +| beyondtrust_epm.audit.siem_integration_splunk_auditing.siem_integration_type | Type of integration selected. | keyword | +| beyondtrust_epm.audit.user | user name. | keyword | +| beyondtrust_epm.audit.user_data_auditing.deleted_at | Deleted date of the user. | date | +| beyondtrust_epm.audit.user_data_auditing.new_date_time_display_format | New Datetime Display Format. | keyword | +| beyondtrust_epm.audit.user_data_auditing.new_disabled | New Disabled. | boolean | +| beyondtrust_epm.audit.user_data_auditing.new_email_address | New Email Address. | keyword | +| beyondtrust_epm.audit.user_data_auditing.new_olson_time_zone_id | New Timezone. | keyword | +| beyondtrust_epm.audit.user_data_auditing.new_permission_sets.permission_set_id | The Id of the permission set. | keyword | +| beyondtrust_epm.audit.user_data_auditing.new_permission_sets.permission_set_name | The name of the permission set. | keyword | +| beyondtrust_epm.audit.user_data_auditing.new_preferred_language | New Preferred Language. | keyword | +| beyondtrust_epm.audit.user_data_auditing.new_user_type | new user type. | keyword | +| beyondtrust_epm.audit.user_data_auditing.old_date_time_display_format | Old Datetime Display Format. | keyword | +| beyondtrust_epm.audit.user_data_auditing.old_disabled | Old Disabled. | boolean | +| beyondtrust_epm.audit.user_data_auditing.old_email_address | Old Email Address. | keyword | +| beyondtrust_epm.audit.user_data_auditing.old_olson_time_zone_id | Old Timezone. | keyword | +| beyondtrust_epm.audit.user_data_auditing.old_permission_sets.permission_set_id | The Id of the permission set. | keyword | +| beyondtrust_epm.audit.user_data_auditing.old_permission_sets.permission_set_name | The name of the permission set. | keyword | +| beyondtrust_epm.audit.user_data_auditing.old_preferred_language | Old Preferred Language. | keyword | +| beyondtrust_epm.audit.user_data_auditing.old_user_type | old user type. | keyword | +| beyondtrust_epm.audit.user_data_auditing.roles.new_roles.role_id | role id. | keyword | +| beyondtrust_epm.audit.user_data_auditing.roles.new_roles.role_name | role name. | keyword | +| beyondtrust_epm.audit.user_data_auditing.roles.old_roles.role_id | role id. | keyword | +| beyondtrust_epm.audit.user_data_auditing.roles.old_roles.role_name | role name. | keyword | +| beyondtrust_epm.audit.user_data_auditing.roles.resource_id | Id of the resource. | keyword | +| beyondtrust_epm.audit.user_data_auditing.roles.resource_name | Resource name. | keyword | +| beyondtrust_epm.audit.user_data_auditing.roles.resource_type | Type of resource. | keyword | +| beyondtrust_epm.audit.user_id | User id. | keyword | +| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | +| input.type | Type of Filebeat input. | keyword | +| log.offset | Log offset. | long | +| observer.product | The product name of the observer. | constant_keyword | +| observer.vendor | Vendor name of the observer. | constant_keyword | + + +### Example event + +#### Audit + +An example event for `audit` looks as following: + +```json +{ + "@timestamp": "2026-04-08T14:32:15.234Z", + "agent": { + "ephemeral_id": "811aab89-56c0-4970-b01e-85b41c56e6b2", + "id": "869883ad-4a20-41a5-868b-e4450f4de69f", + "name": "elastic-agent-74696", + "type": "filebeat", + "version": "8.18.0" + }, + "aws": { + "s3": { + "bucket": { + "arn": "arn:aws:s3:::elastic-package-beyondtrust-epm-bucket-11922", + "name": "elastic-package-beyondtrust-epm-bucket-11922" + }, + "object": { + "key": "audit.log" + } + } + }, + "beyondtrust_epm": { + "audit": { + "agent_data_auditing": { + "new_adapter_version": "25.1.0.234", + "new_agent_id": "f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0", + "new_computer_group_id": "g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1", + "new_computer_group_name": "Production_Servers", + "new_host_type": "Windows Server", + "new_os_name": "Windows Server 2022", + "new_timestamp": "2026-04-08T14:30:00.000Z", + "old_adapter_version": "25.0.1.198", + "old_agent_id": "e4f5g6h7-8i9j-0k1l-2m3n-o4p5q6r7s8t9", + "old_computer_group_id": "f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0", + "old_computer_group_name": "Workstations", + "old_host_type": "Windows Workstation", + "old_os_name": "Windows 10 Enterprise", + "old_timestamp": "2026-04-08T14:00:00.000Z" + }, + "api_client_data_auditing": { + "deleted": false, + "new_description": "Production environment API client for automated deployments", + "new_name": "ProductionAPIClient_v2", + "old_description": "Production API client", + "old_name": "ProductionAPIClient", + "secret_updated": false + }, + "audit_type": "PolicyModification", + "authorization_request_data_auditing": { + "auth_request_api_client_id": "api-client-v2", + "auth_request_api_client_secret": "***", + "auth_request_client_id": "bt-auth-client-v2", + "auth_request_client_secret": "***", + "auth_request_config_changed": true, + "auth_request_host_name": "auth.company.com", + "auth_request_integration_enabled": true, + "auth_request_password": "***", + "auth_request_user_name": "bt_service_account_v2", + "old_auth_request_api_client_id": "api-client-v1", + "old_auth_request_api_client_secret": "***", + "old_auth_request_client_id": "bt-auth-client-v1", + "old_auth_request_client_secret": "***", + "old_auth_request_host_name": "auth-old.company.local", + "old_auth_request_integration_enabled": false, + "old_auth_request_password": "***", + "old_auth_request_user_name": "bt_service_account" + }, + "auto_update_group_client_settings_data_auditing": { + "new_app_event_log_type": "Information", + "new_beyond_insight_cert_name": "BeyondInsight_Prod_2026", + "new_beyond_insight_url": "https://beyondinsight.company.com", + "new_beyond_insight_work_group": "DOMAIN", + "new_cert_mode": "Subject", + "new_config_audit_enabled": "true", + "new_config_audit_mode": "Detailed", + "new_crl_fail_open": "true", + "new_download_audit_mode": "Verbose", + "new_hook_load_method": "Advanced", + "new_policy_enabled": "true", + "new_policy_precedence": "Central", + "new_ps_mode": "Full", + "old_app_event_log_type": "Warning", + "old_beyond_insight_cert_name": "BeyondInsight_Prod_2025", + "old_beyond_insight_url": "https://beyondinsight.company.local", + "old_beyond_insight_work_group": "WORKGROUP", + "old_cert_mode": "Thumbprint", + "old_config_audit_enabled": "false", + "old_config_audit_mode": "Basic", + "old_crl_fail_open": "false", + "old_download_audit_mode": "Minimal", + "old_hook_load_method": "Standard", + "old_policy_enabled": "true", + "old_policy_precedence": "Local", + "old_ps_mode": "Restricted" + }, + "auto_update_group_config_settings_data_auditing": { + "new_adapter_version": "25.1.0.234", + "new_client_version": "25.1.0", + "new_enable_auto_update": "true", + "new_use_latest_version": "true", + "old_adapter_version": "25.0.1.198", + "old_client_version": "25.0.0", + "old_enable_auto_update": "false", + "old_use_latest_version": "false" + }, + "auto_update_group_mac_client_settings_data_auditing": { + "new_anti_tamper": "enabled", + "new_badge_icons": "visible", + "new_biometric_authentication_enabled": "true", + "new_mount_assist": "enabled", + "new_sudo_enabled": "true", + "old_anti_tamper": "disabled", + "old_badge_icons": "hidden", + "old_biometric_authentication_enabled": "false", + "old_mount_assist": "disabled", + "old_sudo_enabled": "false" + }, + "auto_update_rate_limit_data_auditing": { + "old_pm_requests_limit_minutes": 60, + "old_pm_requests_limits": 100, + "pm_requests_limit_minutes": 30, + "pm_requests_limits": 200 + }, + "azure_ad_integration_data_auditing": { + "azure_ad_client_id": "fedcba98-7654-3210-fedc-ba9876543210", + "azure_ad_client_secret": "***", + "azure_ad_config_changed": true, + "azure_ad_integration_enabled": true, + "azure_ad_tenant_id": "87654321-4321-4321-4321-210987654321", + "azure_ad_use_certificate_auth": true, + "old_azure_ad_client_id": "abcdef01-2345-6789-abcd-ef0123456789", + "old_azure_ad_client_secret": "***", + "old_azure_ad_integration_enabled": false, + "old_azure_ad_tenant_id": "12345678-1234-1234-1234-123456789012", + "old_azure_ad_use_certificate_auth": false + }, + "changed_by": "Portal", + "computer_data_auditing": { + "deactivated_agents": { + "desktop-178": "Hardware decommissioned", + "laptop-042": "Agent inactive for 30 days" + }, + "new_deleted_agents": [ + "LAPTOP-042", + "DESKTOP-178" + ], + "updated_policies_on": { + "server-db-01": "Server_Hardening_Policy_v3", + "workstation-001": "Windows_Security_Policy_v2" + } + }, + "computer_policy_data_auditing": { + "deactivated_agent_deletion_days": 60, + "enable_deactivated_agent_deletion": true, + "inactivity_agent_deactivation_days": 30, + "old_deactivated_agent_deletion_days": 90, + "old_enable_deactivated_agent_deletion": false, + "old_inactivity_agent_deactivation_days": 60 + }, + "entity": "PolicyRevision", + "entity_name": "Windows_Security_Policy_v2", + "group_data_auditing": { + "add_policy_revisions": { + "data_protection_policy": "Revision 2.1", + "finance_access_policy": "Revision 3.2" + }, + "new_agents": { + "workstation-501": "Finance_WS_01", + "workstation-502": "Finance_WS_02" + }, + "new_description": "All finance department users including contractors", + "new_is_default": false, + "new_name": "Finance_Department_Users", + "old_description": "Finance department users", + "old_is_default": false, + "old_name": "Finance_Users", + "remove_agents": { + "workstation-401": "Migrated to new group" + }, + "remove_policy_revisions": { + "legacy_finance_policy": "Revision 1.0" + } + }, + "installation_key_data_auditing": { + "deleted": false, + "new_disabled": false, + "new_label": "Production_Key_2026", + "old_disabled": false, + "old_label": "Production_Key_2025" + }, + "management_rule_data_auditing": { + "new_priority": 100, + "old_priority": 50 + }, + "mmc_remote_client_data_auditing": { + "client_id": "e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7", + "enabled": true, + "old_client_id": "d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6", + "old_enabled": false + }, + "open_id_config_data_auditing": { + "new_authentication_type": "OAuth2", + "new_client_id": "beyondtrust-client-prod-v2", + "new_domain": "auth.company.com", + "new_open_id_connect_provider": "https://login.company.com", + "old_authentication_type": "SAML", + "old_client_id": "beyondtrust-client-prod-v1", + "old_domain": "auth.company.local", + "old_open_id_connect_provider": "https://login.company.local", + "secret_updated": true + }, + "permission_group_data_auditing": { + "new_description": "Full security administration permissions including audit and compliance", + "new_name": "Advanced_Security_Permissions", + "new_number_of_users": "25", + "old_description": "Basic security permissions for viewing", + "old_name": "Basic_Security_Permissions", + "old_number_of_users": "50", + "permission_set_id": "h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2" + }, + "policy_data_auditing": { + "new_description": "Enhanced security policy with additional privilege management rules", + "new_name": "Enhanced_Security_Policy", + "old_description": "Standard security policy for general users", + "old_name": "Standard_Security_Policy" + }, + "policy_revision_data_auditing": { + "new_annotation_note": "Updated policy to include new CVE-2026-1234 mitigation", + "new_groups": { + "it_administrators": "Full access", + "security_team": "Audit access" + } + }, + "reputation_settings_data_auditing": { + "old_reputation_integration_api_key": "***", + "old_reputation_integration_enabled": false, + "reputation_config_changed": true, + "reputation_integration_api_key": "***", + "reputation_integration_enabled": true + }, + "security_settings_data_auditing": { + "old_token_timeout": 7200, + "token_timeout": 3600 + }, + "settings_data_auditing": { + "add_domain": "subsidiary.company.com", + "modify_domain_new_value": "company.com", + "modify_domain_old_value": "company.local", + "remove_domain": "subsi.company.com" + }, + "siem_integration_base_detail_model": { + "siem_format": "JSON", + "siem_integration_enabled": true, + "siem_integration_type": "Splunk" + }, + "siem_integration_qradar_auditing": { + "cert": "-----BEGIN CERTIFICATE-----\nMIID...certificate...content\n-----END CERTIFICATE-----", + "host_name": "qradar.company.com", + "port": "514", + "siem_format": "LEEF", + "siem_integration_enabled": false, + "siem_integration_type": "QRadar" + }, + "siem_integration_s3_auditing": { + "siem_access_key_id": "AKIAIOSFODNN7EXAMPLE", + "siem_bucket_name": "company-beyondtrust-logs", + "siem_codec": "gzip", + "siem_format": "JSON", + "siem_integration_enabled": true, + "siem_integration_type": "AWS", + "siem_region_name": "us-east-1", + "siem_sse_enabled": true + }, + "siem_integration_sentinel_auditing": { + "siem_format": "JSON", + "siem_integration_enabled": true, + "siem_integration_type": "Sentinel", + "table_name": "BeyondTrustAuditLogs", + "workspace_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890" + }, + "siem_integration_splunk_auditing": { + "host_name": "splunk-hec.company.com", + "index": "beyondtrust_audit", + "siem_format": "JSON", + "siem_integration_enabled": true, + "siem_integration_type": "Splunk" + }, + "user_data_auditing": { + "deleted_at": "2026-04-08T14:32:15.234Z", + "new_date_time_display_format": "MM/dd/yyyy HH:mm:ss", + "new_disabled": false, + "new_email_address": "john.doe@company.com", + "new_olson_time_zone_id": "America/New_York", + "new_permission_sets": [ + { + "permission_set_id": "d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6", + "permission_set_name": "Full_Admin_Access" + } + ], + "new_preferred_language": "en-US", + "new_user_type": "Administrator", + "old_date_time_display_format": "yyyy-MM-dd HH:mm:ss", + "old_disabled": false, + "old_email_address": "j.doe@company.com", + "old_olson_time_zone_id": "UTC", + "old_permission_sets": [ + { + "permission_set_id": "c0d1e2f3-4g5h-6i7j-8k9l-m0n1o2p3q4r5", + "permission_set_name": "Read_Only_Access" + } + ], + "old_preferred_language": "en-GB", + "old_user_type": "Standard", + "roles": [ + { + "new_roles": [ + { + "role_id": "b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9", + "role_name": "Security Administrator" + } + ], + "old_roles": [ + { + "role_id": "a5b6c7d8-1e2f-3g4h-5i6j-k7l8m9n0o1p2", + "role_name": "Policy Viewer" + } + ], + "resource_id": "f4g7h8i9-2j3k-4l5m-6n7o-p8q9r0s1t2u3", + "resource_name": "Global_Policy_Manager", + "resource_type": "PolicyManagement" + } + ] + } + } + }, + "cloud": { + "region": "us-east-1" + }, + "data_stream": { + "dataset": "beyondtrust_epm.audit", + "namespace": "12250", + "type": "logs" + }, + "ecs": { + "version": "9.3.0" + }, + "elastic_agent": { + "id": "869883ad-4a20-41a5-868b-e4450f4de69f", + "snapshot": false, + "version": "8.18.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "configuration" + ], + "created": "2026-04-08T14:32:15.234Z", + "dataset": "beyondtrust_epm.audit", + "id": "10574823", + "ingested": "2026-05-28T11:05:04Z", + "kind": "event", + "original": "{\"id\":10574823,\"details\":\"User john.doe modified security policy settings for Windows Defender Exclusions\",\"userId\":\"a7b5c3d1-8f2e-4a6b-9c3d-e5f7a2b4c6d8\",\"user\":\"john.doe@company.com\",\"entity\":\"PolicyRevision\",\"entityName\":\"Windows_Security_Policy_v2\",\"auditType\":\"PolicyModification\",\"created\":\"2026-04-08T14:32:15.2340000\",\"changedBy\":\"Portal\",\"apiClientDataAuditing\":{\"newName\":\"ProductionAPIClient_v2\",\"oldName\":\"ProductionAPIClient\",\"newDescription\":\"Production environment API client for automated deployments\",\"oldDescription\":\"Production API client\",\"secretUpdated\":false,\"deleted\":false},\"computerDataAuditing\":{\"updatedPoliciesOn\":{\"WORKSTATION-001\":\"Windows_Security_Policy_v2\",\"SERVER-DB-01\":\"Server_Hardening_Policy_v3\"},\"deactivatedAgents\":{\"LAPTOP-042\":\"Agent inactive for 30 days\",\"DESKTOP-178\":\"Hardware decommissioned\"},\"newDeletedAgents\":[\"LAPTOP-042\",\"DESKTOP-178\"]},\"groupDataAuditing\":{\"newName\":\"Finance_Department_Users\",\"oldName\":\"Finance_Users\",\"newDescription\":\"All finance department users including contractors\",\"oldDescription\":\"Finance department users\",\"newIsDefault\":false,\"oldIsDefault\":false,\"addPolicyRevisions\":{\"Finance_Access_Policy\":\"Revision 3.2\",\"Data_Protection_Policy\":\"Revision 2.1\"},\"removePolicyRevisions\":{\"Legacy_Finance_Policy\":\"Revision 1.0\"},\"newAgents\":{\"WORKSTATION-501\":\"Finance_WS_01\",\"WORKSTATION-502\":\"Finance_WS_02\"},\"removeAgents\":{\"WORKSTATION-401\":\"Migrated to new group\"}},\"installationKeyDataAuditing\":{\"oldLabel\":\"Production_Key_2025\",\"newLabel\":\"Production_Key_2026\",\"newDisabled\":false,\"oldDisabled\":false,\"deleted\":false},\"policyDataAuditing\":{\"newName\":\"Enhanced_Security_Policy\",\"oldName\":\"Standard_Security_Policy\",\"newDescription\":\"Enhanced security policy with additional privilege management rules\",\"oldDescription\":\"Standard security policy for general users\"},\"policyRevisionDataAuditing\":{\"newGroups\":{\"IT_Administrators\":\"Full access\",\"Security_Team\":\"Audit access\"},\"newAnnotationNote\":\"Updated policy to include new CVE-2026-1234 mitigation\"},\"settingsDataAuditing\":{\"addDomain\":\"subsidiary.company.com\",\"removeDomain\":\"subsi.company.com\",\"modifyDomainOldValue\":\"company.local\",\"modifyDomainNewValue\":\"company.com\"},\"userDataAuditing\":{\"newEmailAddress\":\"john.doe@company.com\",\"oldEmailAddress\":\"j.doe@company.com\",\"newOlsonTimeZoneId\":\"America/New_York\",\"oldOlsonTimeZoneId\":\"UTC\",\"newDateTimeDisplayFormat\":\"MM/dd/yyyy HH:mm:ss\",\"oldDateTimeDisplayFormat\":\"yyyy-MM-dd HH:mm:ss\",\"newPreferredLanguage\":\"en-US\",\"oldPreferredLanguage\":\"en-GB\",\"newDisabled\":false,\"oldDisabled\":false,\"newUserType\":\"Administrator\",\"oldUserType\":\"Standard\",\"deletedAt\":\"2026-04-08T14:32:15.2340000\",\"roles\":[{\"resourceType\":\"PolicyManagement\",\"resourceId\":\"f4g7h8i9-2j3k-4l5m-6n7o-p8q9r0s1t2u3\",\"resourceName\":\"Global_Policy_Manager\",\"newRoles\":[{\"roleId\":\"b8c6d4e2-9f3a-5b7c-0d4e-f6g8b3c5d7e9\",\"roleName\":\"Security Administrator\"}],\"oldRoles\":[{\"roleId\":\"a5b6c7d8-1e2f-3g4h-5i6j-k7l8m9n0o1p2\",\"roleName\":\"Policy Viewer\"}]}],\"newPermissionSets\":[{\"permissionSetId\":\"d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6\",\"permissionSetName\":\"Full_Admin_Access\"}],\"oldPermissionSets\":[{\"permissionSetId\":\"c0d1e2f3-4g5h-6i7j-8k9l-m0n1o2p3q4r5\",\"permissionSetName\":\"Read_Only_Access\"}]},\"openIdConfigDataAuditing\":{\"oldAuthenticationType\":\"SAML\",\"newAuthenticationType\":\"OAuth2\",\"oldDomain\":\"auth.company.local\",\"newDomain\":\"auth.company.com\",\"oldClientId\":\"beyondtrust-client-prod-v1\",\"newClientId\":\"beyondtrust-client-prod-v2\",\"secretUpdated\":true,\"oldOpenIDConnectProvider\":\"https://login.company.local\",\"newOpenIDConnectProvider\":\"https://login.company.com\"},\"mmcRemoteClientDataAuditing\":{\"enabled\":true,\"oldEnabled\":false,\"clientId\":\"e2f3g4h5-6i7j-8k9l-0m1n-o2p3q4r5s6t7\",\"oldClientId\":\"d1e2f3g4-5h6i-7j8k-9l0m-n1o2p3q4r5s6\"},\"computerPolicyDataAuditing\":{\"oldInactivityAgentDeactivationDays\":60,\"oldEnableDeactivatedAgentDeletion\":false,\"oldDeactivatedAgentDeletionDays\":90,\"inactivityAgentDeactivationDays\":30,\"enableDeactivatedAgentDeletion\":true,\"deactivatedAgentDeletionDays\":60},\"azureADIntegrationDataAuditing\":{\"oldAzureAdTenantId\":\"12345678-1234-1234-1234-123456789012\",\"oldAzureAdClientId\":\"abcdef01-2345-6789-abcd-ef0123456789\",\"oldAzureAdClientSecret\":\"***\",\"oldAzureAdUseCertificateAuth\":false,\"oldAzureAdIntegrationEnabled\":false,\"azureAdTenantId\":\"87654321-4321-4321-4321-210987654321\",\"azureAdClientId\":\"fedcba98-7654-3210-fedc-ba9876543210\",\"azureAdClientSecret\":\"***\",\"azureAdUseCertificateAuth\":true,\"azureAdIntegrationEnabled\":true,\"azureAdConfigChanged\":true},\"authorizationRequestDataAuditing\":{\"oldAuthRequestIntegrationEnabled\":false,\"oldAuthRequestHostName\":\"auth-old.company.local\",\"oldAuthRequestClientId\":\"bt-auth-client-v1\",\"oldAuthRequestClientSecret\":\"***\",\"oldAuthRequestPassword\":\"***\",\"oldAuthRequestUserName\":\"bt_service_account\",\"oldAuthRequestApiClientId\":\"api-client-v1\",\"oldAuthRequestApiClientSecret\":\"***\",\"authRequestIntegrationEnabled\":true,\"authRequestHostName\":\"auth.company.com\",\"authRequestClientId\":\"bt-auth-client-v2\",\"authRequestClientSecret\":\"***\",\"authRequestPassword\":\"***\",\"authRequestUserName\":\"bt_service_account_v2\",\"authRequestApiClientId\":\"api-client-v2\",\"authRequestApiClientSecret\":\"***\",\"authRequestConfigChanged\":true},\"reputationSettingsDataAuditing\":{\"oldReputationIntegrationEnabled\":false,\"oldReputationIntegrationApiKey\":\"***\",\"reputationIntegrationEnabled\":true,\"reputationIntegrationApiKey\":\"***\",\"reputationConfigChanged\":true},\"securitySettingsDataAuditing\":{\"tokenTimeout\":3600,\"oldTokenTimeout\":7200},\"siemIntegrationBaseDetailModel\":{\"siemIntegrationEnabled\":true,\"siemIntegrationType\":\"Splunk\",\"siemFormat\":\"JSON\"},\"siemIntegrationQradarAuditing\":{\"siemIntegrationEnabled\":false,\"siemIntegrationType\":\"QRadar\",\"siemFormat\":\"LEEF\",\"hostName\":\"qradar.company.com\",\"port\":\"514\",\"cert\":\"-----BEGIN CERTIFICATE-----\\nMIID...certificate...content\\n-----END CERTIFICATE-----\"},\"siemIntegrationS3Auditing\":{\"siemIntegrationEnabled\":true,\"siemIntegrationType\":\"AWS\",\"siemFormat\":\"JSON\",\"siemAccessKeyId\":\"AKIAIOSFODNN7EXAMPLE\",\"siemBucketName\":\"company-beyondtrust-logs\",\"siemCodec\":\"gzip\",\"siemRegionName\":\"us-east-1\",\"siemSseEnabled\":true},\"siemIntegrationSentinelAuditing\":{\"siemIntegrationEnabled\":true,\"siemIntegrationType\":\"Sentinel\",\"siemFormat\":\"JSON\",\"tableName\":\"BeyondTrustAuditLogs\",\"workspaceId\":\"a1b2c3d4-e5f6-7890-abcd-ef1234567890\"},\"siemIntegrationSplunkAuditing\":{\"siemIntegrationEnabled\":true,\"siemIntegrationType\":\"Splunk\",\"siemFormat\":\"JSON\",\"hostName\":\"splunk-hec.company.com\",\"index\":\"beyondtrust_audit\"},\"agentDataAuditing\":{\"newAgentId\":\"f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0\",\"oldAgentId\":\"e4f5g6h7-8i9j-0k1l-2m3n-o4p5q6r7s8t9\",\"newTimestamp\":\"2026-04-08T14:30:00.0000000\",\"oldTimestamp\":\"2026-04-08T14:00:00.0000000\",\"newHostType\":\"Windows Server\",\"oldHostType\":\"Windows Workstation\",\"newOsName\":\"Windows Server 2022\",\"oldOsName\":\"Windows 10 Enterprise\",\"newAdapterVersion\":\"25.1.0.234\",\"oldAdapterVersion\":\"25.0.1.198\",\"newComputerGroupId\":\"g6h7i8j9-0k1l-2m3n-4o5p-q6r7s8t9u0v1\",\"oldComputerGroupId\":\"f5g6h7i8-9j0k-1l2m-3n4o-p5q6r7s8t9u0\",\"newComputerGroupName\":\"Production_Servers\",\"oldComputerGroupName\":\"Workstations\"},\"managementRuleDataAuditing\":{\"newPriority\":100,\"oldPriority\":50},\"autoUpdateRateLimitDataAuditing\":{\"oldPmRequestsLimits\":100,\"oldPmRequestsLimitMinutes\":60,\"pmRequestsLimits\":200,\"pmRequestsLimitMinutes\":30},\"autoUpdateGroupConfigSettingsDataAuditing\":{\"newEnableAutoUpdate\":\"true\",\"newUseLatestVersion\":\"true\",\"newClientVersion\":\"25.1.0\",\"newAdapterVersion\":\"25.1.0.234\",\"oldEnableAutoUpdate\":\"false\",\"oldUseLatestVersion\":\"false\",\"oldClientVersion\":\"25.0.0\",\"oldAdapterVersion\":\"25.0.1.198\"},\"autoUpdateGroupClientSettingsDataAuditing\":{\"oldAppEventLogType\":\"Warning\",\"oldBeyondInsightCertName\":\"BeyondInsight_Prod_2025\",\"oldBeyondInsightUrl\":\"https://beyondinsight.company.local\",\"oldBeyondInsightWorkGroup\":\"WORKGROUP\",\"oldCertMode\":\"Thumbprint\",\"oldConfigAuditEnabled\":\"false\",\"oldConfigAuditMode\":\"Basic\",\"oldCrlFailOpen\":\"false\",\"oldDownloadAuditMode\":\"Minimal\",\"oldHookLoadMethod\":\"Standard\",\"oldPolicyEnabled\":\"true\",\"oldPolicyPrecedence\":\"Local\",\"oldPsMode\":\"Restricted\",\"newPsMode\":\"Full\",\"newBeyondInsightCertName\":\"BeyondInsight_Prod_2026\",\"newBeyondInsightUrl\":\"https://beyondinsight.company.com\",\"newBeyondInsightWorkGroup\":\"DOMAIN\",\"newAppEventLogType\":\"Information\",\"newHookLoadMethod\":\"Advanced\",\"newCertMode\":\"Subject\",\"newConfigAuditEnabled\":\"true\",\"newConfigAuditMode\":\"Detailed\",\"newCrlFailOpen\":\"true\",\"newDownloadAuditMode\":\"Verbose\",\"newPolicyEnabled\":\"true\",\"newPolicyPrecedence\":\"Central\"},\"permissionGroupDataAuditing\":{\"permissionSetId\":\"h7i8j9k0-1l2m-3n4o-5p6q-r7s8t9u0v1w2\",\"newName\":\"Advanced_Security_Permissions\",\"oldName\":\"Basic_Security_Permissions\",\"newDescription\":\"Full security administration permissions including audit and compliance\",\"oldDescription\":\"Basic security permissions for viewing\",\"newNumberOfUsers\":\"25\",\"oldNumberOfUsers\":\"50\"},\"autoUpdateGroupMacClientSettingsDataAuditing\":{\"newAntiTamper\":\"enabled\",\"newMountAssist\":\"enabled\",\"newSudoEnabled\":\"true\",\"newBiometricAuthenticationEnabled\":\"true\",\"newBadgeIcons\":\"visible\",\"oldAntiTamper\":\"disabled\",\"oldMountAssist\":\"disabled\",\"oldSudoEnabled\":\"false\",\"oldBiometricAuthenticationEnabled\":\"false\",\"oldBadgeIcons\":\"hidden\"}}", + "type": [ + "change" + ] + }, + "input": { + "type": "aws-s3" + }, + "log": { + "file": { + "path": "https://elastic-package-beyondtrust-epm-bucket-11922.s3.us-east-1.amazonaws.com/audit.log" + }, + "offset": 0 + }, + "message": "User john.doe modified security policy settings for Windows Defender Exclusions", + "related": { + "user": [ + "a7b5c3d1-8f2e-4a6b-9c3d-e5f7a2b4c6d8", + "john.doe@company.com", + "Portal" + ] + }, + "tags": [ + "collect_sqs_logs", + "preserve_original_event", + "forwarded", + "beyondtrust_epm-audit" + ], + "user": { + "id": "a7b5c3d1-8f2e-4a6b-9c3d-e5f7a2b4c6d8", + "name": "john.doe@company.com" + } +} +``` + +### Inputs used + +These inputs are used in the integration: + +- [CEL](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-cel) +- [AWS S3](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-aws-s3) + +### API usage + +This integration dataset uses the following API: + +* List Activity Audit Details (endpoint: `/management-api/v3/ActivityAudits/Details`) +* List Event Details (endpoint: `/management-api/v3/Events/search`) diff --git a/packages/beyondtrust_epm/img/beyondtrust-epm-event.png b/packages/beyondtrust_epm/img/beyondtrust-epm-event.png new file mode 100644 index 00000000000..399b4ce0a1b Binary files /dev/null and b/packages/beyondtrust_epm/img/beyondtrust-epm-event.png differ diff --git a/packages/beyondtrust_epm/img/beyondtrust_epm-audit.png b/packages/beyondtrust_epm/img/beyondtrust_epm-audit.png new file mode 100644 index 00000000000..dc9e3d97513 Binary files /dev/null and b/packages/beyondtrust_epm/img/beyondtrust_epm-audit.png differ diff --git a/packages/beyondtrust_epm/img/beyondtrust_epm-logo.svg b/packages/beyondtrust_epm/img/beyondtrust_epm-logo.svg new file mode 100644 index 00000000000..cfeb7869b91 --- /dev/null +++ b/packages/beyondtrust_epm/img/beyondtrust_epm-logo.svg @@ -0,0 +1,34 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/packages/beyondtrust_epm/kibana/dashboard/beyondtrust_epm-20f84912-15d7-4fa5-94eb-a2c945a6d477.json b/packages/beyondtrust_epm/kibana/dashboard/beyondtrust_epm-20f84912-15d7-4fa5-94eb-a2c945a6d477.json new file mode 100644 index 00000000000..bb923eed5ed --- /dev/null +++ b/packages/beyondtrust_epm/kibana/dashboard/beyondtrust_epm-20f84912-15d7-4fa5-94eb-a2c945a6d477.json @@ -0,0 +1,2171 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": { + "3762263d-fbe6-4458-ae3a-0829038fb6b2": { + "explicitInput": { + "dataViewId": "logs-*", + "exclude": null, + "existsSelected": null, + "fieldName": "beyondtrust_epm.audit.entity", + "hideActionBar": null, + "hideExclude": null, + "hideExists": null, + "hideSort": null, + "placeholder": null, + "runPastTimeout": null, + "searchTechnique": "prefix", + "selectedOptions": [], + "singleSelect": null, + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Entity" + }, + "grow": true, + "order": 0, + "type": "optionsListControl", + "width": "medium" + }, + "9ffbe5da-86a0-43ec-8c7f-0afb33caeb59": { + "explicitInput": { + "dataViewId": "logs-*", + "exclude": null, + "existsSelected": null, + "fieldName": "beyondtrust_epm.audit.audit_type", + "hideActionBar": null, + "hideExclude": null, + "hideExists": null, + "hideSort": null, + "placeholder": null, + "runPastTimeout": null, + "searchTechnique": "prefix", + "selectedOptions": [], + "singleSelect": null, + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Audit Type" + }, + "grow": true, + "order": 1, + "type": "optionsListControl", + "width": "medium" + } + }, + "showApplySelections": false + }, + "description": "This dashboard shows Audit log collected by the BeyondTrust EPM Integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f622ff57-029c-4168-96ae-5f24f0a6fea1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "f622ff57-029c-4168-96ae-5f24f0a6fea1": { + "columnOrder": [ + "83236c8f-eeb2-42e6-bd4a-2ce91c6ce038", + "a0d70cb3-fe38-49d5-b9f0-4572994d1abf", + "f4710ce1-5e8c-4fb3-8681-f3881d73cb5f" + ], + "columns": { + "83236c8f-eeb2-42e6-bd4a-2ce91c6ce038": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Old Computer Group", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f4710ce1-5e8c-4fb3-8681-f3881d73cb5f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.agent_data_auditing.old_computer_group_name" + }, + "a0d70cb3-fe38-49d5-b9f0-4572994d1abf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "New Computer Group", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f4710ce1-5e8c-4fb3-8681-f3881d73cb5f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.agent_data_auditing.new_computer_group_name" + }, + "f4710ce1-5e8c-4fb3-8681-f3881d73cb5f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "logs-*", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "logs-*", + "timeField": "@timestamp", + "title": "logs-*" + } + ], + "initialContext": null, + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "83236c8f-eeb2-42e6-bd4a-2ce91c6ce038" + }, + { + "columnId": "a0d70cb3-fe38-49d5-b9f0-4572994d1abf" + }, + { + "columnId": "f4710ce1-5e8c-4fb3-8681-f3881d73cb5f" + } + ], + "layerId": "f622ff57-029c-4168-96ae-5f24f0a6fea1", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "c96adc68-9ea5-4a32-aed0-bdc2f38fbe33", + "w": 24, + "x": 0, + "y": 52 + }, + "panelIndex": "c96adc68-9ea5-4a32-aed0-bdc2f38fbe33", + "title": "Top Computer Group Change", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-597d0e1a-a1a9-43a7-84aa-40327ea79e86", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dcbeb2b8-6076-4dda-98e2-0f0e4a95b7a4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "597d0e1a-a1a9-43a7-84aa-40327ea79e86": { + "columnOrder": [ + "d24ebb0f-0700-4ff5-aca6-4292973124b0", + "49d2c861-304f-4043-91c6-777f8466da0a" + ], + "columns": { + "49d2c861-304f-4043-91c6-777f8466da0a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d24ebb0f-0700-4ff5-aca6-4292973124b0": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "49d2c861-304f-4043-91c6-777f8466da0a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dcbeb2b8-6076-4dda-98e2-0f0e4a95b7a4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "d24ebb0f-0700-4ff5-aca6-4292973124b0" + }, + { + "columnId": "49d2c861-304f-4043-91c6-777f8466da0a" + } + ], + "layerId": "597d0e1a-a1a9-43a7-84aa-40327ea79e86", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "f78ae957-b730-4036-8b13-5cc9923b1feb", + "w": 24, + "x": 24, + "y": 52 + }, + "panelIndex": "f78ae957-b730-4036-8b13-5cc9923b1feb", + "title": "Top Users", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-dd8e09e5-09b0-4461-9654-dec223ece6e8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "30c62aca-508f-4cb7-ba42-62267fae15c0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "dd8e09e5-09b0-4461-9654-dec223ece6e8": { + "columnOrder": [ + "c3375829-dd9a-4080-a2c8-5d628bc423d3", + "b428fba8-31aa-45df-b0bd-d7fd69235484", + "4da86192-2d92-4d6a-abc4-58062d26ca61" + ], + "columns": { + "4da86192-2d92-4d6a-abc4-58062d26ca61": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b428fba8-31aa-45df-b0bd-d7fd69235484": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "New User Role", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4da86192-2d92-4d6a-abc4-58062d26ca61", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.user_data_auditing.roles.new_roles.role_name" + }, + "c3375829-dd9a-4080-a2c8-5d628bc423d3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Old User Role", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4da86192-2d92-4d6a-abc4-58062d26ca61", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.user_data_auditing.roles.old_roles.role_name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "30c62aca-508f-4cb7-ba42-62267fae15c0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "b428fba8-31aa-45df-b0bd-d7fd69235484", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "c3375829-dd9a-4080-a2c8-5d628bc423d3" + }, + { + "columnId": "4da86192-2d92-4d6a-abc4-58062d26ca61" + } + ], + "layerId": "dd8e09e5-09b0-4461-9654-dec223ece6e8", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "f638128f-4e01-43d5-a3fb-8e7998074364", + "w": 24, + "x": 24, + "y": 67 + }, + "panelIndex": "f638128f-4e01-43d5-a3fb-8e7998074364", + "title": "Top User Role Change", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-34112419-f254-4d5e-96a1-e8fbb0f83aff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9ff8da0c-fa10-46ad-a1b6-e50f9cb9f17f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "34112419-f254-4d5e-96a1-e8fbb0f83aff": { + "columnOrder": [ + "7037cb8f-00c3-4387-83cb-6c960451f3f0", + "a1565a71-1ea7-488e-bb18-d6b641a3121f", + "976a7635-0452-4e8f-89e0-69ef17dddf87" + ], + "columns": { + "7037cb8f-00c3-4387-83cb-6c960451f3f0": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Old User Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "976a7635-0452-4e8f-89e0-69ef17dddf87", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.user_data_auditing.old_user_type" + }, + "976a7635-0452-4e8f-89e0-69ef17dddf87": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "a1565a71-1ea7-488e-bb18-d6b641a3121f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "New User Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "976a7635-0452-4e8f-89e0-69ef17dddf87", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.user_data_auditing.new_user_type" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "9ff8da0c-fa10-46ad-a1b6-e50f9cb9f17f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "a1565a71-1ea7-488e-bb18-d6b641a3121f", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "7037cb8f-00c3-4387-83cb-6c960451f3f0" + }, + { + "columnId": "976a7635-0452-4e8f-89e0-69ef17dddf87" + } + ], + "layerId": "34112419-f254-4d5e-96a1-e8fbb0f83aff", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "624ecefb-ee2c-45db-92f1-5f20baeb8463", + "w": 24, + "x": 0, + "y": 67 + }, + "panelIndex": "624ecefb-ee2c-45db-92f1-5f20baeb8463", + "title": "Top User Type Change", + "type": "lens" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "This dashboard provides centralized visibility into audit events generated by BeyondTrust Endpoint Privilege Management.\n\nIt includes a Control Panel for filtering by Entity and Audit Type. Event activity is broken down through a Bar Chart showing Events by Entity and four Pie Charts covering Audit Type, Old Host Type, New Host Type, and SIEM Integration Type. Change tracking is surfaced through three Tables showing Top User Role Change, Top User Type Change, and Top Computer Group Change, alongside a Top Users table highlighting the most active accounts.\n\nTogether, these visualizations help teams monitor privilege-related audit trends, track configuration changes across users and agents, and investigate SIEM integration activity.\n\n**[Integration Page](/app/integrations/detail/beyondtrust_epm)**", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 18, + "i": "3434947c-06be-4a7a-9f11-1edf2d631b28", + "w": 17, + "x": 0, + "y": 4 + }, + "panelIndex": "3434947c-06be-4a7a-9f11-1edf2d631b28", + "title": "Overview", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b79d927d-df7e-4a92-81c6-842bfe2c8ce0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0071147b-09f0-459b-a349-3586247fa13a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b79d927d-df7e-4a92-81c6-842bfe2c8ce0": { + "columnOrder": [ + "85c5d846-26e4-4900-8e42-04f9641a5ab9", + "316727c2-f0b0-4038-a82d-1b9264fd95fa" + ], + "columns": { + "316727c2-f0b0-4038-a82d-1b9264fd95fa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "85c5d846-26e4-4900-8e42-04f9641a5ab9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Entity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "316727c2-f0b0-4038-a82d-1b9264fd95fa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.entity_name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0071147b-09f0-459b-a349-3586247fa13a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "316727c2-f0b0-4038-a82d-1b9264fd95fa" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "b79d927d-df7e-4a92-81c6-842bfe2c8ce0", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "85c5d846-26e4-4900-8e42-04f9641a5ab9" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 18, + "i": "c17493c3-0f68-4783-af5a-bfdcefad42ca", + "w": 31, + "x": 17, + "y": 4 + }, + "panelIndex": "c17493c3-0f68-4783-af5a-bfdcefad42ca", + "title": "Events by Entity", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-629ede16-8571-4701-9a3e-7a74cde9a7fb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f7ce99be-d25e-42ae-996d-e38405836707", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "629ede16-8571-4701-9a3e-7a74cde9a7fb": { + "columnOrder": [ + "a8881959-472d-43a0-9f52-4324f48e4219", + "91fc7de0-d050-41e6-b86d-e602a6da4d37" + ], + "columns": { + "91fc7de0-d050-41e6-b86d-e602a6da4d37": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "a8881959-472d-43a0-9f52-4324f48e4219": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Audit Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "91fc7de0-d050-41e6-b86d-e602a6da4d37", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.audit_type" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f7ce99be-d25e-42ae-996d-e38405836707", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "629ede16-8571-4701-9a3e-7a74cde9a7fb", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "91fc7de0-d050-41e6-b86d-e602a6da4d37" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "a8881959-472d-43a0-9f52-4324f48e4219" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "3e31bbd1-a388-452f-940e-223f46f10a39", + "w": 24, + "x": 24, + "y": 22 + }, + "panelIndex": "3e31bbd1-a388-452f-940e-223f46f10a39", + "title": "Events by Audit Type", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d0417d6c-f0d3-4008-a1d3-0f864eaa9a01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "72723c72-05e0-4143-bcb4-eca72cb53ec3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d0417d6c-f0d3-4008-a1d3-0f864eaa9a01": { + "columnOrder": [ + "4b65aee0-ac4c-4b28-b5eb-ee1c07d7b189", + "e59da977-e718-4ce3-8ffa-0edd9ef70d6a" + ], + "columns": { + "4b65aee0-ac4c-4b28-b5eb-ee1c07d7b189": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "SIEM Integration Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e59da977-e718-4ce3-8ffa-0edd9ef70d6a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.siem_integration_base_detail_model.siem_integration_type" + }, + "e59da977-e718-4ce3-8ffa-0edd9ef70d6a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "72723c72-05e0-4143-bcb4-eca72cb53ec3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "d0417d6c-f0d3-4008-a1d3-0f864eaa9a01", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "e59da977-e718-4ce3-8ffa-0edd9ef70d6a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "4b65aee0-ac4c-4b28-b5eb-ee1c07d7b189" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "eb6afcd7-b230-4028-b4d8-c4dad68e8497", + "w": 24, + "x": 0, + "y": 22 + }, + "panelIndex": "eb6afcd7-b230-4028-b4d8-c4dad68e8497", + "title": "Events by SIEM Integration Type", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4e09f22e-311e-4a36-8892-13413feb4d0d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "4e09f22e-311e-4a36-8892-13413feb4d0d": { + "columnOrder": [ + "88ac5d1b-0c19-4fce-b025-70122cf2b6ed", + "760338ab-437c-4dac-9320-d5cdd0b5a5e0" + ], + "columns": { + "760338ab-437c-4dac-9320-d5cdd0b5a5e0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "88ac5d1b-0c19-4fce-b025-70122cf2b6ed": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Old Host Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "760338ab-437c-4dac-9320-d5cdd0b5a5e0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.agent_data_auditing.old_host_type" + } + }, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "logs-*", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "logs-*", + "timeField": "@timestamp", + "title": "logs-*" + } + ], + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "4e09f22e-311e-4a36-8892-13413feb4d0d", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "760338ab-437c-4dac-9320-d5cdd0b5a5e0" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "88ac5d1b-0c19-4fce-b025-70122cf2b6ed" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "0e18317d-3715-46af-80ad-45ce0de44ae8", + "w": 24, + "x": 0, + "y": 37 + }, + "panelIndex": "0e18317d-3715-46af-80ad-45ce0de44ae8", + "title": "Events by Old Host Type", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4e09f22e-311e-4a36-8892-13413feb4d0d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2c0c218e-7a53-4ddd-a2f1-6b3a63b965e5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4e09f22e-311e-4a36-8892-13413feb4d0d": { + "columnOrder": [ + "88ac5d1b-0c19-4fce-b025-70122cf2b6ed", + "760338ab-437c-4dac-9320-d5cdd0b5a5e0" + ], + "columns": { + "760338ab-437c-4dac-9320-d5cdd0b5a5e0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "88ac5d1b-0c19-4fce-b025-70122cf2b6ed": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "New Host Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "760338ab-437c-4dac-9320-d5cdd0b5a5e0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "beyondtrust_epm.audit.agent_data_auditing.new_host_type" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2c0c218e-7a53-4ddd-a2f1-6b3a63b965e5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "4e09f22e-311e-4a36-8892-13413feb4d0d", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "760338ab-437c-4dac-9320-d5cdd0b5a5e0" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "88ac5d1b-0c19-4fce-b025-70122cf2b6ed" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "72e3748d-f7c3-460f-a6f4-03708a1622e4", + "w": 24, + "x": 24, + "y": 37 + }, + "panelIndex": "72e3748d-f7c3-460f-a6f4-03708a1622e4", + "title": "Events by New Host Type", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "layout": "horizontal", + "links": [ + { + "destinationRefName": "link_9c1ae8a7-7b2e-4051-9937-93580f966553_dashboard", + "id": "9c1ae8a7-7b2e-4051-9937-93580f966553", + "label": "Audit", + "options": { + "openInNewTab": false, + "useCurrentDateRange": false, + "useCurrentFilters": false + }, + "order": 0, + "type": "dashboardLink" + }, + { + "destinationRefName": "link_2c672620-1db3-4721-95f7-d21ada4814fc_dashboard", + "id": "2c672620-1db3-4721-95f7-d21ada4814fc", + "label": "Event", + "options": { + "openInNewTab": false, + "useCurrentDateRange": false, + "useCurrentFilters": false + }, + "order": 1, + "type": "dashboardLink" + } + ] + }, + "enhancements": {} + }, + "gridData": { + "h": 4, + "i": "fb9b5bbc-e0bc-48d8-9361-fc6839d5a826", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "fb9b5bbc-e0bc-48d8-9361-fc6839d5a826", + "type": "links" + } + ], + "timeRestore": false, + "title": "[Logs BeyondTrust EPM] Audit", + "version": 3 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-05-26T09:08:09.749Z", + "id": "beyondtrust_epm-20f84912-15d7-4fa5-94eb-a2c945a6d477", + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c96adc68-9ea5-4a32-aed0-bdc2f38fbe33:indexpattern-datasource-layer-f622ff57-029c-4168-96ae-5f24f0a6fea1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f78ae957-b730-4036-8b13-5cc9923b1feb:indexpattern-datasource-layer-597d0e1a-a1a9-43a7-84aa-40327ea79e86", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f78ae957-b730-4036-8b13-5cc9923b1feb:dcbeb2b8-6076-4dda-98e2-0f0e4a95b7a4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f638128f-4e01-43d5-a3fb-8e7998074364:indexpattern-datasource-layer-dd8e09e5-09b0-4461-9654-dec223ece6e8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f638128f-4e01-43d5-a3fb-8e7998074364:30c62aca-508f-4cb7-ba42-62267fae15c0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "624ecefb-ee2c-45db-92f1-5f20baeb8463:indexpattern-datasource-layer-34112419-f254-4d5e-96a1-e8fbb0f83aff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "624ecefb-ee2c-45db-92f1-5f20baeb8463:9ff8da0c-fa10-46ad-a1b6-e50f9cb9f17f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c17493c3-0f68-4783-af5a-bfdcefad42ca:indexpattern-datasource-layer-b79d927d-df7e-4a92-81c6-842bfe2c8ce0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c17493c3-0f68-4783-af5a-bfdcefad42ca:0071147b-09f0-459b-a349-3586247fa13a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3e31bbd1-a388-452f-940e-223f46f10a39:indexpattern-datasource-layer-629ede16-8571-4701-9a3e-7a74cde9a7fb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3e31bbd1-a388-452f-940e-223f46f10a39:f7ce99be-d25e-42ae-996d-e38405836707", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eb6afcd7-b230-4028-b4d8-c4dad68e8497:indexpattern-datasource-layer-d0417d6c-f0d3-4008-a1d3-0f864eaa9a01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eb6afcd7-b230-4028-b4d8-c4dad68e8497:72723c72-05e0-4143-bcb4-eca72cb53ec3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0e18317d-3715-46af-80ad-45ce0de44ae8:indexpattern-datasource-layer-4e09f22e-311e-4a36-8892-13413feb4d0d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "72e3748d-f7c3-460f-a6f4-03708a1622e4:indexpattern-datasource-layer-4e09f22e-311e-4a36-8892-13413feb4d0d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "72e3748d-f7c3-460f-a6f4-03708a1622e4:2c0c218e-7a53-4ddd-a2f1-6b3a63b965e5", + "type": "index-pattern" + }, + { + "id": "beyondtrust_epm-20f84912-15d7-4fa5-94eb-a2c945a6d477", + "name": "fb9b5bbc-e0bc-48d8-9361-fc6839d5a826:link_9c1ae8a7-7b2e-4051-9937-93580f966553_dashboard", + "type": "dashboard" + }, + { + "id": "beyondtrust_epm-2ed6e850-d14a-4504-940c-49eb04afe9b8", + "name": "fb9b5bbc-e0bc-48d8-9361-fc6839d5a826:link_2c672620-1db3-4721-95f7-d21ada4814fc_dashboard", + "type": "dashboard" + }, + { + "id": "logs-*", + "name": "controlGroup_3762263d-fbe6-4458-ae3a-0829038fb6b2:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_9ffbe5da-86a0-43ec-8c7f-0afb33caeb59:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/packages/beyondtrust_epm/kibana/dashboard/beyondtrust_epm-2ed6e850-d14a-4504-940c-49eb04afe9b8.json b/packages/beyondtrust_epm/kibana/dashboard/beyondtrust_epm-2ed6e850-d14a-4504-940c-49eb04afe9b8.json new file mode 100644 index 00000000000..7943d258189 --- /dev/null +++ b/packages/beyondtrust_epm/kibana/dashboard/beyondtrust_epm-2ed6e850-d14a-4504-940c-49eb04afe9b8.json @@ -0,0 +1,2214 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": { + "2c86895d-bd6a-4389-8e41-327da7ca8025": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "event.action", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Event Action" + }, + "grow": true, + "order": 2, + "type": "optionsListControl", + "width": "medium" + }, + "42ea20f5-2c8d-4b10-bc54-8bc87179d89b": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "host.name", + "searchTechnique": "prefix", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Host" + }, + "grow": true, + "order": 1, + "type": "optionsListControl", + "width": "medium" + }, + "7c8f6437-f133-4ea7-b5d7-8f423ebd0044": { + "explicitInput": { + "dataViewId": "logs-*", + "fieldName": "event.severity", + "searchTechnique": "exact", + "selectedOptions": [], + "sort": { + "by": "_count", + "direction": "desc" + }, + "title": "Severity" + }, + "grow": true, + "order": 0, + "type": "optionsListControl", + "width": "medium" + } + }, + "showApplySelections": false + }, + "description": "This dashboard shows Event log collected by the BeyondTrust EPM Integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "600c3d9c-8a04-479c-991c-ae2cb25caecd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e57ff93e-6d80-47c1-ba75-96f333c49a9f": { + "columnOrder": [ + "93800f62-2104-445f-927f-356556e37899", + "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + ], + "columns": { + "23474353-2a56-4d3a-a569-2be5f3a8a1d2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "93800f62-2104-445f-927f-356556e37899": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "MITRE Tactic", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.tactic.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "600c3d9c-8a04-479c-991c-ae2cb25caecd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "93800f62-2104-445f-927f-356556e37899" + }, + { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + } + ], + "layerId": "e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "d8f2fa6c-c0a6-4ba5-b19b-f2de6ff0d3b1", + "w": 24, + "x": 24, + "y": 33 + }, + "panelIndex": "d8f2fa6c-c0a6-4ba5-b19b-f2de6ff0d3b1", + "title": "Top MITRE Tactics", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5bb8d3b3-1187-44a3-a09e-a34dc6bf7148", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e57ff93e-6d80-47c1-ba75-96f333c49a9f": { + "columnOrder": [ + "93800f62-2104-445f-927f-356556e37899", + "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + ], + "columns": { + "23474353-2a56-4d3a-a569-2be5f3a8a1d2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "93800f62-2104-445f-927f-356556e37899": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "MITRE Technique", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.technique.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5bb8d3b3-1187-44a3-a09e-a34dc6bf7148", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "93800f62-2104-445f-927f-356556e37899" + }, + { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + } + ], + "layerId": "e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "1f5c4145-d47a-47d6-b4f5-3572426a0273", + "w": 24, + "x": 0, + "y": 33 + }, + "panelIndex": "1f5c4145-d47a-47d6-b4f5-3572426a0273", + "title": "Top MITRE Techniques", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "e57ff93e-6d80-47c1-ba75-96f333c49a9f": { + "columnOrder": [ + "93800f62-2104-445f-927f-356556e37899", + "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + ], + "columns": { + "23474353-2a56-4d3a-a569-2be5f3a8a1d2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "93800f62-2104-445f-927f-356556e37899": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "logs-*", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "logs-*", + "timeField": "@timestamp", + "title": "logs-*" + } + ], + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "93800f62-2104-445f-927f-356556e37899" + }, + { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + } + ], + "layerId": "e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "f6d38a40-5e7e-41bc-a763-811c5750eef1", + "w": 24, + "x": 0, + "y": 48 + }, + "panelIndex": "f6d38a40-5e7e-41bc-a763-811c5750eef1", + "title": "Top Hosts", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "e57ff93e-6d80-47c1-ba75-96f333c49a9f": { + "columnOrder": [ + "93800f62-2104-445f-927f-356556e37899", + "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + ], + "columns": { + "23474353-2a56-4d3a-a569-2be5f3a8a1d2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "93800f62-2104-445f-927f-356556e37899": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" + } + }, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "logs-*", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "logs-*", + "timeField": "@timestamp", + "title": "logs-*" + } + ], + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "93800f62-2104-445f-927f-356556e37899" + }, + { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + } + ], + "layerId": "e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "55816585-e89c-4707-b581-2fe97abf6130", + "w": 24, + "x": 0, + "y": 63 + }, + "panelIndex": "55816585-e89c-4707-b581-2fe97abf6130", + "title": "Top Users", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "e57ff93e-6d80-47c1-ba75-96f333c49a9f": { + "columnOrder": [ + "93800f62-2104-445f-927f-356556e37899", + "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + ], + "columns": { + "23474353-2a56-4d3a-a569-2be5f3a8a1d2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "93800f62-2104-445f-927f-356556e37899": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "logs-*", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "logs-*", + "timeField": "@timestamp", + "title": "logs-*" + } + ], + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "93800f62-2104-445f-927f-356556e37899" + }, + { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + } + ], + "layerId": "e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "ebe28e70-b4f3-415a-bbd6-29b0297797bf", + "w": 24, + "x": 24, + "y": 48 + }, + "panelIndex": "ebe28e70-b4f3-415a-bbd6-29b0297797bf", + "title": "Top Source IP", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "e57ff93e-6d80-47c1-ba75-96f333c49a9f": { + "columnOrder": [ + "93800f62-2104-445f-927f-356556e37899", + "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + ], + "columns": { + "23474353-2a56-4d3a-a569-2be5f3a8a1d2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "93800f62-2104-445f-927f-356556e37899": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + } + }, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "logs-*", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "logs-*", + "timeField": "@timestamp", + "title": "logs-*" + } + ], + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "93800f62-2104-445f-927f-356556e37899" + }, + { + "columnId": "23474353-2a56-4d3a-a569-2be5f3a8a1d2" + } + ], + "layerId": "e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "ad663490-7f90-4f05-b303-72913cb36fc1", + "w": 24, + "x": 24, + "y": 63 + }, + "panelIndex": "ad663490-7f90-4f05-b303-72913cb36fc1", + "title": "Top Destination IP", + "type": "lens" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Overview**\n\nThis dashboard provides key insights into BeyondTrust EPM events, highlighting event distribution by action, severity, and host, along with trends over time to identify patterns or spikes. It includes MITRE ATT\u0026CK mappings through top tactics and techniques, and visual breakdowns of events by action, severity, and outcome. Additionally, it showcases the most active entities, including top hosts, users, source IPs, and destination IPs, offering a concise view of system activity and potential security concerns.\n\n[**Integrations Page**](/app/integrations/detail/beyondtrust_epm/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 14, + "i": "8b60306d-2b20-4df2-8621-ea63b20a9e82", + "w": 15, + "x": 0, + "y": 4 + }, + "panelIndex": "8b60306d-2b20-4df2-8621-ea63b20a9e82", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8676480b-d8ee-4551-a564-3e64fb8388d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b0c2e9d0-fa43-44cd-b9ff-e9941bd5d753", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8676480b-d8ee-4551-a564-3e64fb8388d1": { + "columnOrder": [ + "8d972fcc-51e5-4477-9d0d-bab76a4df114", + "fdc926e2-ae62-45d9-9489-4217429518b0" + ], + "columns": { + "8d972fcc-51e5-4477-9d0d-bab76a4df114": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "fdc926e2-ae62-45d9-9489-4217429518b0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b0c2e9d0-fa43-44cd-b9ff-e9941bd5d753", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "fdc926e2-ae62-45d9-9489-4217429518b0" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "8676480b-d8ee-4551-a564-3e64fb8388d1", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "8d972fcc-51e5-4477-9d0d-bab76a4df114" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 14, + "i": "9a3dbfe5-9419-47ed-b1a8-e05f3484c2ab", + "w": 19, + "x": 15, + "y": 4 + }, + "panelIndex": "9a3dbfe5-9419-47ed-b1a8-e05f3484c2ab", + "title": "Events over Time", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2791bb42-915f-458f-897c-009682fe3646", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "2791bb42-915f-458f-897c-009682fe3646": { + "columnOrder": [ + "c48ea20c-d170-4488-ab65-ce49b203b8c5", + "6fb9e1b2-2e0f-4460-b7fd-0a53e60c9450" + ], + "columns": { + "6fb9e1b2-2e0f-4460-b7fd-0a53e60c9450": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "c48ea20c-d170-4488-ab65-ce49b203b8c5": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6fb9e1b2-2e0f-4460-b7fd-0a53e60c9450", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.severity" + } + }, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "logs-*", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "logs-*", + "timeField": "@timestamp", + "title": "logs-*" + } + ], + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "2791bb42-915f-458f-897c-009682fe3646", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "6fb9e1b2-2e0f-4460-b7fd-0a53e60c9450" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "c48ea20c-d170-4488-ab65-ce49b203b8c5" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 14, + "i": "d7ea5e64-89d3-4476-b205-199c68645d35", + "w": 14, + "x": 34, + "y": 4 + }, + "panelIndex": "d7ea5e64-89d3-4476-b205-199c68645d35", + "title": "Events by Severity", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2791bb42-915f-458f-897c-009682fe3646", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "2791bb42-915f-458f-897c-009682fe3646": { + "columnOrder": [ + "c48ea20c-d170-4488-ab65-ce49b203b8c5", + "6fb9e1b2-2e0f-4460-b7fd-0a53e60c9450" + ], + "columns": { + "6fb9e1b2-2e0f-4460-b7fd-0a53e60c9450": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "c48ea20c-d170-4488-ab65-ce49b203b8c5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Outcome", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6fb9e1b2-2e0f-4460-b7fd-0a53e60c9450", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + } + }, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "logs-*", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "logs-*", + "timeField": "@timestamp", + "title": "logs-*" + } + ], + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "2791bb42-915f-458f-897c-009682fe3646", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "6fb9e1b2-2e0f-4460-b7fd-0a53e60c9450" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "c48ea20c-d170-4488-ab65-ce49b203b8c5" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "d4a2253f-46d4-474b-a68f-44999a7415f0", + "w": 24, + "x": 0, + "y": 18 + }, + "panelIndex": "d4a2253f-46d4-474b-a68f-44999a7415f0", + "title": "Events by Outcome", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4be7025d-a8a9-4056-9500-8580f118ada8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b34a5894-698a-4cf2-a7e8-bef383b790b0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4be7025d-a8a9-4056-9500-8580f118ada8": { + "columnOrder": [ + "e72e6969-ea0a-47db-8a0e-d0b065995b50", + "1766f293-e9d2-491a-875b-db64b37cb99a" + ], + "columns": { + "1766f293-e9d2-491a-875b-db64b37cb99a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e72e6969-ea0a-47db-8a0e-d0b065995b50": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "1766f293-e9d2-491a-875b-db64b37cb99a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b34a5894-698a-4cf2-a7e8-bef383b790b0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "1766f293-e9d2-491a-875b-db64b37cb99a" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "4be7025d-a8a9-4056-9500-8580f118ada8", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "e72e6969-ea0a-47db-8a0e-d0b065995b50" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "beyondtrust_epm.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "beyondtrust_epm.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "0ad6ee70-0651-4692-a4c1-95a48fca55b8", + "w": 24, + "x": 24, + "y": 18 + }, + "panelIndex": "0ad6ee70-0651-4692-a4c1-95a48fca55b8", + "title": "Events by Action", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "layout": "horizontal", + "links": [ + { + "destinationRefName": "link_9c1ae8a7-7b2e-4051-9937-93580f966553_dashboard", + "id": "9c1ae8a7-7b2e-4051-9937-93580f966553", + "label": "Audit", + "options": { + "openInNewTab": false, + "useCurrentDateRange": false, + "useCurrentFilters": false + }, + "order": 0, + "type": "dashboardLink" + }, + { + "destinationRefName": "link_2c672620-1db3-4721-95f7-d21ada4814fc_dashboard", + "id": "2c672620-1db3-4721-95f7-d21ada4814fc", + "label": "Event", + "options": { + "openInNewTab": false, + "useCurrentDateRange": false, + "useCurrentFilters": false + }, + "order": 1, + "type": "dashboardLink" + } + ] + }, + "enhancements": {} + }, + "gridData": { + "h": 4, + "i": "7a8fc266-c0d6-432f-bd71-cb5f548bb575", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "7a8fc266-c0d6-432f-bd71-cb5f548bb575", + "type": "links" + } + ], + "timeRestore": false, + "title": "[Logs BeyondTrust EPM] Event", + "version": 3 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-05-26T09:08:08.949Z", + "id": "beyondtrust_epm-2ed6e850-d14a-4504-940c-49eb04afe9b8", + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d8f2fa6c-c0a6-4ba5-b19b-f2de6ff0d3b1:indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d8f2fa6c-c0a6-4ba5-b19b-f2de6ff0d3b1:600c3d9c-8a04-479c-991c-ae2cb25caecd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1f5c4145-d47a-47d6-b4f5-3572426a0273:indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1f5c4145-d47a-47d6-b4f5-3572426a0273:5bb8d3b3-1187-44a3-a09e-a34dc6bf7148", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6d38a40-5e7e-41bc-a763-811c5750eef1:indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "55816585-e89c-4707-b581-2fe97abf6130:indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ebe28e70-b4f3-415a-bbd6-29b0297797bf:indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ad663490-7f90-4f05-b303-72913cb36fc1:indexpattern-datasource-layer-e57ff93e-6d80-47c1-ba75-96f333c49a9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9a3dbfe5-9419-47ed-b1a8-e05f3484c2ab:indexpattern-datasource-layer-8676480b-d8ee-4551-a564-3e64fb8388d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9a3dbfe5-9419-47ed-b1a8-e05f3484c2ab:b0c2e9d0-fa43-44cd-b9ff-e9941bd5d753", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d7ea5e64-89d3-4476-b205-199c68645d35:indexpattern-datasource-layer-2791bb42-915f-458f-897c-009682fe3646", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d4a2253f-46d4-474b-a68f-44999a7415f0:indexpattern-datasource-layer-2791bb42-915f-458f-897c-009682fe3646", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0ad6ee70-0651-4692-a4c1-95a48fca55b8:indexpattern-datasource-layer-4be7025d-a8a9-4056-9500-8580f118ada8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0ad6ee70-0651-4692-a4c1-95a48fca55b8:b34a5894-698a-4cf2-a7e8-bef383b790b0", + "type": "index-pattern" + }, + { + "id": "beyondtrust_epm-20f84912-15d7-4fa5-94eb-a2c945a6d477", + "name": "7a8fc266-c0d6-432f-bd71-cb5f548bb575:link_9c1ae8a7-7b2e-4051-9937-93580f966553_dashboard", + "type": "dashboard" + }, + { + "id": "beyondtrust_epm-2ed6e850-d14a-4504-940c-49eb04afe9b8", + "name": "7a8fc266-c0d6-432f-bd71-cb5f548bb575:link_2c672620-1db3-4721-95f7-d21ada4814fc_dashboard", + "type": "dashboard" + }, + { + "id": "logs-*", + "name": "controlGroup_7c8f6437-f133-4ea7-b5d7-8f423ebd0044:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_42ea20f5-2c8d-4b10-bc54-8bc87179d89b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2c86895d-bd6a-4389-8e41-327da7ca8025:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/packages/beyondtrust_epm/manifest.yml b/packages/beyondtrust_epm/manifest.yml new file mode 100644 index 00000000000..cc6e56a59bd --- /dev/null +++ b/packages/beyondtrust_epm/manifest.yml @@ -0,0 +1,230 @@ +format_version: 3.3.2 +name: beyondtrust_epm +title: BeyondTrust EPM +version: 0.1.0 +description: Collect logs from BeyondTrust EPM with Elastic Agent. +type: integration +categories: + - security +conditions: + kibana: + version: ^8.18.0 || ^9.0.0 + elastic: + subscription: basic +screenshots: + - src: /img/beyondtrust_epm-audit.png + title: Audit Dashboard + size: 600x600 + type: image/png + - src: /img/beyondtrust-epm-event.png + title: BeyondTrust EPM Event Dashboard + size: 600x600 + type: image/png +icons: + - src: /img/beyondtrust_epm-logo.svg + title: BeyondTrust EPM logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: beyondtrust_epm + title: BeyondTrust EPM + description: Collect logs from BeyondTrust EPM. + deployment_modes: + default: + enabled: true + agentless: + enabled: true + organization: security + division: engineering + team: security-service-integrations + inputs: + - type: cel + title: Collect BeyondTrust EPM logs via API + description: Collecting BeyondTrust EPM logs via API. + vars: + - name: url + type: url + title: URL + description: Base URL of the BeyondTrust EPM instance. + multi: false + required: true + show_user: true + - name: client_id + type: text + title: Client ID + description: Client ID obtained from BeyondTrust EPM instance. + multi: false + required: true + show_user: true + secret: true + - name: client_secret + type: password + title: Client Secret + description: Client Secret obtained from BeyondTrust EPM instance. + multi: false + required: true + show_user: true + secret: true + - name: proxy_url + type: text + title: Proxy URL + description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + multi: false + required: false + show_user: false + - name: ssl + type: yaml + title: SSL Configuration + description: SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- + - type: aws-s3 + title: Collect Beyondtrust EPM logs via AWS S3 or AWS SQS + description: Collecting logs from Beyondtrust EPM via AWS S3 or AWS SQS. + vars: + - name: collect_s3_logs + required: true + show_user: true + title: Collect logs via S3 Bucket + description: To collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue. + type: bool + multi: false + default: false + - name: access_key_id + type: password + title: Access Key ID + multi: false + required: false + show_user: true + description: First part of access key. This parameter along with the secret_access_key parameter is required if we are not providing shared_credential_file. + secret: true + - name: secret_access_key + type: password + title: Secret Access Key + multi: false + required: false + show_user: true + description: Second part of access key. This parameter along with the access_key_id parameter is required if we are not providing shared_credential_file. + secret: true + - name: region + type: text + title: '[SQS] Region' + multi: false + required: false + show_user: true + description: The name of the AWS region of the end point. If this option is given it takes precedence over the region name obtained from the queue_url value. + - name: session_token + type: password + title: Session Token + multi: false + required: false + show_user: true + description: Required when using temporary security credentials. + secret: true + - name: shared_credential_file + type: text + title: Shared Credential File + multi: false + required: false + show_user: false + description: Directory of the shared credentials file. This parameter is required if we are not providing value for the parameters - secret_access_key and access_key_id. + - name: credential_profile_name + type: text + title: Credential Profile Name + multi: false + required: false + show_user: false + description: Profile name in shared credentials file. + - name: role_arn + type: text + title: Role ARN + multi: false + required: false + show_user: false + description: AWS IAM Role to assume. + - name: default_region + type: text + title: Default AWS Region + multi: false + required: false + show_user: false + default: '' + description: >- + Default region to query if no other region is set. Most AWS services offer a regional endpoint that can be used to make requests. Some services, such as IAM, do not support regions. If a region is not provided by any other way (environment variable, credential or instance profile), the value set here will be used. + - name: endpoint + type: text + title: Endpoint + multi: false + required: false + show_user: false + description: URL of the entry point for an AWS web service. + - name: fips_enabled + type: bool + title: FIPS Enabled + default: false + multi: false + required: false + show_user: false + description: Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint. + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + - name: ssl + type: yaml + title: SSL Configuration + description: SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- +owner: + github: elastic/security-service-integrations + type: elastic diff --git a/packages/beyondtrust_epm/validation.yml b/packages/beyondtrust_epm/validation.yml new file mode 100644 index 00000000000..69cb321d6d4 --- /dev/null +++ b/packages/beyondtrust_epm/validation.yml @@ -0,0 +1,4 @@ +errors: + exclude_checks: + - SVR00004 + - SVR00003