search

ocsf / ocsf-schema

OCSF Schema
Apache License 2.0
582 stars 118 forks source link

Adjust Windows Resource Activity class (201003) to be aligned with Windows event 4662 #1090

Open eliraz-levi opened 1 month ago

eliraz-levi commented 1 month ago

Windows Resource Activity class (201003) is not aligned with fields exist in Windows event 4662 - “An operation was performed on an object”. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662 Windows event 4662 is an essential security event to detect and investigate DCSync attack which is a very common attack in active directory environment https://attack.mitre.org/techniques/T1003/006/ .

Current gaps:

  1. Windows event 4662 includes information about the access that was performed. This information is represented by attributes accesses, access_mask. However, the Windows Resource Activity class (201003) doesn’t include equivalent attributes.
  2. Windows event 4662 supports including several Windows object GUIDs (under properties field) while Windows Resource Activity class supports only one: win_resource.uid .
eliraz-levi commented 1 month ago

@mikeradka - thank you for your comments here. I understand why Entity Management class is a better mapping. Yet, it lacks access_list and access_mask, would you think it's a good idea to add them to the Entity Management class ? Furthermore, it lacks a list of managed_entity objects for cases where we access multiple objects at once. Replacing managed_entity by a list of managed_entity objects would results in breaking change. How would you suggest to address it ?

eliraz-levi commented 1 month ago

An updated PR was created https://github.com/ocsf/ocsf-schema/pull/1105