Open fukusuket opened 4 months ago
https://github.com/Yamato-Security/hayabusa/issues/1339#issuecomment-2092704365
Or even better, if we could define in details: 'TgtUser: %TargetUserName% ¦ SrcIp: %IpAddress%' and get the following results: Count: 4 ¦ TgtUser: tanaka/Administrator/adsyncadmin/suzuki ¦ SrcIp: -
https://github.com/Yamato-Security/hayabusa/pull/1341#issuecomment-2099492290
- If top level Channel has multiple values, should it be an array or string?
- If top level EventID has multiple values, should it be an array or string?
- If each field under Details has multiple values, should it be an array or string?
- Should the aggregate results of Channel and EventID be placed under Details?
@fukusuket I talked to someone who is more familiar with importing into elastic stack and he said that elastic will create multiple logs (documents) when arrays are used and it will make parsing more difficult so I think we should avoid arrays and keep everything as strings. We should probably keep the Channel and EventID information not in Details, but in the normal fields so that it makes searching for them easier.
@YamatoSecurity Thank you for checking :) Is the expected JSON output format like the following?
¦
. Count/IpAddress/SubStatus
... under the Details field and store values in each.
{
"Timestamp": "2021-10-24 06:50:11.666 +09:00",
"RuleTitle": "TEST_TITLE",
"Level": "info",
"Computer": "HOSTA ¦ HOSTB",
"Channel": "Sysmon ¦ Security",
"EventID": "4624 ¦ 4625",
"RecordID": "",
"Details": {
"Count": 2,
"IpAddress": "10.23.23.9",
"SubStatus": "0x0",
"LogonType": "10"
},
"ExtraFieldInfo": "-"
}
@fukusuket LGTM!
https://github.com/Yamato-Security/hayabusa/issues/1373#issue-2369875686
Problems:
1. Top 5 computers with most unique detections shows only n/a but should include the correlation rule results
https://github.com/Yamato-Security/hayabusa/pull/1376#issue-2372922094
Channel
and EventID
info? When there are multiple values, we can separate them with ¦
.ExtraFieldInfo
is blank (··
) but would nice to have it as -
which we use for n/a
. So ··
-> · - ·
EvtxFile
is also -
but many users ask me how they can look up the evtx file from this alert so it would be nice to get this information as well. Again, separate by ¦
when there are multiple values.SubStatus: 0xc000006a
to SubStatus: WRONG PW
, etc...
https://github.com/Yamato-Security/hayabusa/pull/1341#issuecomment-2097170105