Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
Sysmon Network Events Feature Request #219
Two very popular open source programs (Zeek and Suricata) used as passive network sensors and Intrusion Detection Systems (IDS) have implemented a "Community Flow ID". This flow hash is a calculation of the IP src / IP dst / IP proto / source port / dest port fields that results in a common hash that be correlated between the two systems.
The original specification is here: https://github.com/corelight/community-id-spec
If this calculation is added as an additional field in the Network Event ID 3, then network connections could be correlated between a host sysmon's log and a network sensor's log in a SIEM.
Auditbeat by ElasticCo provides a "Sysmon" like capability for Linux systems by logging process creations and network events by process. They have also implemented the Community ID specification. This allows for correlation of the network connection logged by the host to the IDS events. See their implementation here: https://www.elastic.co/guide/en/beats/auditbeat/7.x/community-id.html