Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sysmon Network Events Feature Request #219

Closed
c2defense opened this issue Jul 1, 2019 · 1 comment

Comments

@c2defense
Copy link

commented Jul 1, 2019

Two very popular open source programs (Zeek and Suricata) used as passive network sensors and Intrusion Detection Systems (IDS) have implemented a "Community Flow ID". This flow hash is a calculation of the IP src / IP dst / IP proto / source port / dest port fields that results in a common hash that be correlated between the two systems.

The original specification is here: https://github.com/corelight/community-id-spec

If this calculation is added as an additional field in the Network Event ID 3, then network connections could be correlated between a host sysmon's log and a network sensor's log in a SIEM.

See bro's implementation here: https://github.com/corelight/bro-community-id
See Suricata's implementation here: OISF/suricata#3507

Auditbeat by ElasticCo provides a "Sysmon" like capability for Linux systems by logging process creations and network events by process. They have also implemented the Community ID specification. This allows for correlation of the network connection logged by the host to the IDS events. See their implementation here: https://www.elastic.co/guide/en/beats/auditbeat/7.x/community-id.html

@analyze-v

This comment has been minimized.

Copy link
Collaborator

commented Jul 11, 2019

This is a great suggestion. Have added it to the Sysmon backlog for review

@analyze-v analyze-v closed this Jul 11, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.