Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add event.category registry #1040

Merged
merged 6 commits into from
Oct 27, 2020
Merged

Add event.category registry #1040

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1f57c64
Add event.category registry
Oct 20, 2020
b9b7efc
Experimental artifacts
Oct 20, 2020
5e085bd
Changelog
Oct 20, 2020
68d4054
Adjust registry description to be closer to our initial definition fo…
Oct 26, 2020
77a7d04
Was missing a build of experimental artifacts
Oct 27, 2020
78f0624
Merge branch 'master' into category-registry
Oct 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ Thanks, you're awesome :-) -->

#### Added

* Added `event.category` allowed value "registry". #1040

#### Improvements

#### Deprecated
Expand Down
2 changes: 1 addition & 1 deletion docs/field-details.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1597,7 +1597,7 @@ Note: this field should contain an array of values.

*Important*: The field value must be one of the following:

authentication, configuration, database, driver, file, host, iam, intrusion_detection, malware, network, package, process, web
authentication, configuration, database, driver, file, host, iam, intrusion_detection, malware, network, package, process, registry, web

To learn more about when to use which value, visit the page
<<ecs-allowed-values-event-category,allowed values for event.category>>
Expand Down
13 changes: 13 additions & 0 deletions docs/field-values.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,7 @@ that will require subsequent breaking changes.
* <<ecs-event-category-network,network>>
* <<ecs-event-category-package,package>>
* <<ecs-event-category-process,process>>
* <<ecs-event-category-registry,registry>>
* <<ecs-event-category-web,web>>

[float]
Expand Down Expand Up @@ -298,6 +299,18 @@ Use this category of events to visualize and analyze process-specific informatio
access, change, end, info, start


[float]
[[ecs-event-category-registry]]
==== registry

Use this category of event for events related to the Windows registry.


*Expected event types for category registry:*

access, change, creation, deletion


[float]
[[ecs-event-category-web]]
==== web
Expand Down
7 changes: 7 additions & 0 deletions experimental/generated/ecs/ecs_flat.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1774,6 +1774,13 @@ event.category:
- info
- start
name: process
- description: Use this category of event for events related to the Windows registry.
expected_event_types:
- access
- change
- creation
- deletion
name: registry
- description: 'Relating to web server access. Use this category to create a dashboard
of web server/proxy activity from apache, IIS, nginx web servers, etc. Note:
events from network observers such as Zeek http log may also be included in
Expand Down
8 changes: 8 additions & 0 deletions experimental/generated/ecs/ecs_nested.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2168,6 +2168,14 @@ event:
- info
- start
name: process
- description: Use this category of event for events related to the Windows
registry.
expected_event_types:
- access
- change
- creation
- deletion
name: registry
- description: 'Relating to web server access. Use this category to create a
dashboard of web server/proxy activity from apache, IIS, nginx web servers,
etc. Note: events from network observers such as Zeek http log may also
Expand Down
7 changes: 7 additions & 0 deletions generated/ecs/ecs_flat.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1814,6 +1814,13 @@ event.category:
- info
- start
name: process
- description: Use this category of event for events related to the Windows registry.
expected_event_types:
- access
- change
- creation
- deletion
name: registry
- description: 'Relating to web server access. Use this category to create a dashboard
of web server/proxy activity from apache, IIS, nginx web servers, etc. Note:
events from network observers such as Zeek http log may also be included in
Expand Down
8 changes: 8 additions & 0 deletions generated/ecs/ecs_nested.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2209,6 +2209,14 @@ event:
- info
- start
name: process
- description: Use this category of event for events related to the Windows
registry.
expected_event_types:
- access
- change
- creation
- deletion
name: registry
- description: 'Relating to web server access. Use this category to create a
dashboard of web server/proxy activity from apache, IIS, nginx web servers,
etc. Note: events from network observers such as Zeek http log may also
Expand Down
8 changes: 8 additions & 0 deletions schemas/event.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,6 +277,14 @@
- end
- info
- start
- name: registry
description: >
Use this category of event for events related to the Windows registry.
expected_event_types:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for the add.
I think this seems like a good start. And I would err on the side of omitting info like you did. It's always easier to add later than it is to remove.

These values may not be specific enough, because they don't differentiate between key vs value changes. But I think 99% of the time, we're looking at changed values, not keys. So this is okay in my opinion.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MikePaquette Did you have a specific use in mind for "info"? This proposal is not yet adding it as an expected value.

One way Auditbeat uses "info" is to dump a list of all running processes, to establish a baseline. Then it reports process start/end as things happen.

I could see a similar use for dumping a set of registry keys (hopefully not the whole hive); then monitor for changes with creation/change/deletion. Was that the idea?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rw-access On specificity wrt key vs value activity, I'm not sure we should change the allowed values in event.type.

I would think event.action can be used to capture whether it's a change to a value or a data blob?

- access
webmat marked this conversation as resolved.
Show resolved Hide resolved
- change
- creation
- deletion
- name: web
description: >
Relating to web server access. Use this category to create a dashboard of
Expand Down