Add support for FireEye HX acquisition packages in process_tree (#616)

* add FireEye HX acquisitions support to proctree * remove erroneous mapping * make HX schema source more explicit * Black formatting fix --------- Co-authored-by: lroude <lroude@cert.corp> Co-authored-by: Ian Hellen <ianhelle@microsoft.com>
microsoft · Mar 8, 2023 · 85fd101 · 85fd101
1 parent e5a91e5
commit 85fd101
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/msticpy/transform/proc_tree_builder.py b/msticpy/transform/proc_tree_builder.py
@@ -15,6 +15,7 @@
 # pylint: disable=unused-import
 from .proc_tree_schema import ProcSchema  # noqa: F401
 from .proc_tree_schema import (  # noqa: F401
+    HX_PROCESSEVENT_SCH,
     LX_EVENT_SCH,
     MDE_EVENT_SCH,
     MDE_INT_EVENT_SCH,

diff --git a/msticpy/transform/proc_tree_schema.py b/msticpy/transform/proc_tree_schema.py
@@ -242,12 +242,28 @@ def blank_schema_dict(cls) -> Dict[str, Any]:
     host_name_column="Computer",
 )
 
+# FireEye HX processEvent from 'stateagentinspector' or 'eventbuffer' audits
+HX_PROCESSEVENT_SCH = ProcSchema(
+    time_stamp="starttime",
+    process_name="process",
+    process_id="pid",
+    parent_name="parentprocess",
+    parent_id="parentpid",
+    cmd_line="processcmdline",
+    user_name="username",
+    path_separator="\\",
+    event_id_column="eventtype",
+    event_id_identifier="start",
+    host_name_column="hostname",
+)
+
 SUPPORTED_SCHEMAS = (
     WIN_EVENT_SCH,
     LX_EVENT_SCH,
     MDE_INT_EVENT_SCH,
     MDE_EVENT_SCH,
     SYSMON_PROCESS_CREATE_EVENT_SCH,
+    HX_PROCESSEVENT_SCH,
 )