default.yml

---
description: Ingest pipeline for normalizing CrowdStrike Falcon logs
processors:
  - set:
      field: ecs.version
      value: '8.8.0'
  - rename:
      field: message
      target_field: event.original
      ignore_missing: true
  - json:
      field: event.original
      target_field: crowdstrike
  - remove:
      field:
        - host.name
      ignore_missing: true
  - remove:
      field: crowdstrike.event.ProcessStartTime
      ignore_missing: true
      if: ctx?.crowdstrike?.event?.ProcessStartTime == 0
  - date:
      field: crowdstrike.event.ProcessStartTime
      target_field: crowdstrike.event.ProcessStartTime
      timezone: UTC
      formats:
        - UNIX_MS
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.ProcessStartTime != null &&
        !(ctx.crowdstrike.event.ProcessStartTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.ProcessStartTime) + 1) >= 12
  - remove:
      field: crowdstrike.event.ProcessEndTime
      ignore_missing: true
      if: ctx?.crowdstrike?.event?.ProcessEndTime == 0
  - date:
      field: crowdstrike.event.ProcessEndTime
      target_field: crowdstrike.event.ProcessEndTime
      timezone: UTC
      formats:
        - UNIX_MS
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.ProcessEndTime != null &&
        !(ctx.crowdstrike.event.ProcessEndTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.ProcessEndTime) + 1) >= 12
  - remove:
      field: crowdstrike.event.IncidentStartTime
      ignore_missing: true
      if: ctx?.crowdstrike?.event?.IncidentStartTime == 0
  - date:
      field: crowdstrike.event.IncidentStartTime
      target_field: crowdstrike.event.IncidentStartTime
      timezone: UTC
      formats:
        - UNIX_MS
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.IncidentStartTime != null &&
        !(ctx.crowdstrike.event.IncidentStartTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.IncidentStartTime) + 1) >= 12
  - remove:
      field: crowdstrike.event.IncidentEndTime
      ignore_missing: true
      if: ctx?.crowdstrike?.event?.IncidentEndTime == 0
  - date:
      field: crowdstrike.event.IncidentEndTime
      target_field: crowdstrike.event.IncidentEndTime
      timezone: UTC
      formats:
        - UNIX_MS
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.IncidentEndTime != null &&
        !(ctx.crowdstrike.event.IncidentEndTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.IncidentEndTime) + 1) >= 12
  - remove:
      field: crowdstrike.event.StartTimestamp
      ignore_missing: true
      if: ctx?.crowdstrike?.event?.StartTimestamp == 0
  - date:
      field: crowdstrike.event.StartTimestamp
      target_field: crowdstrike.event.StartTimestamp
      timezone: UTC
      formats:
        - UNIX_MS
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.StartTimestamp != null &&
        !(ctx.crowdstrike.event.StartTimestamp instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.StartTimestamp) + 1) >= 12
  - remove:
      field: crowdstrike.event.EndTimestamp
      ignore_missing: true
      if: ctx?.crowdstrike?.event?.EndTimestamp == 0
  - date:
      field: crowdstrike.event.EndTimestamp
      target_field: crowdstrike.event.EndTimestamp
      timezone: UTC
      formats:
        - UNIX_MS
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.EndTimestamp != null &&
        !(ctx.crowdstrike.event.EndTimestamp instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.EndTimestamp) + 1) >= 12
  - remove:
      field: crowdstrike.event.UTCTimestamp
      ignore_missing: true
      if: ctx?.crowdstrike?.event?.UTCTimestamp == 0
  - date:
      field: crowdstrike.event.UTCTimestamp
      target_field: crowdstrike.event.UTCTimestamp
      timezone: UTC
      formats:
        - UNIX_MS
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.UTCTimestamp != null &&
        !(ctx.crowdstrike.event.UTCTimestamp instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.UTCTimestamp) + 1) >= 12
  - remove:
      field: crowdstrike.metadata.eventCreationTime
      ignore_missing: true
      if: ctx?.crowdstrike?.metadata?.eventCreationTime == 0
  - date:
      field: crowdstrike.metadata.eventCreationTime
      target_field: crowdstrike.metadata.eventCreationTime
      timezone: UTC
      formats:
        - UNIX_MS
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.metadata?.eventCreationTime != null &&
        !(ctx.crowdstrike.metadata.eventCreationTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.metadata.eventCreationTime) + 1) >= 12
  - date:
      field: crowdstrike.event.ProcessStartTime
      target_field: crowdstrike.event.ProcessStartTime
      timezone: UTC
      formats:
        - UNIX
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.ProcessStartTime != null &&
        !(ctx.crowdstrike.event.ProcessStartTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.ProcessStartTime) + 1) < 12
  - date:
      field: crowdstrike.event.ProcessEndTime
      target_field: crowdstrike.event.ProcessEndTime
      timezone: UTC
      formats:
        - UNIX
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.ProcessEndTime != null &&
        !(ctx.crowdstrike.event.ProcessEndTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.ProcessEndTime) + 1) < 12
  - date:
      field: crowdstrike.event.IncidentStartTime
      target_field: crowdstrike.event.IncidentStartTime
      timezone: UTC
      formats:
        - UNIX
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.IncidentStartTime != null &&
        !(ctx.crowdstrike.event.IncidentStartTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.IncidentStartTime) + 1) < 12
  - date:
      field: crowdstrike.event.IncidentEndTime
      target_field: crowdstrike.event.IncidentEndTime
      timezone: UTC
      formats:
        - UNIX
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.IncidentEndTime != null &&
        !(ctx.crowdstrike.event.IncidentEndTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.IncidentEndTime) + 1) < 12
  - date:
      field: crowdstrike.event.StartTimestamp
      target_field: crowdstrike.event.StartTimestamp
      timezone: UTC
      formats:
        - UNIX
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.StartTimestamp != null &&
        !(ctx.crowdstrike.event.StartTimestamp instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.StartTimestamp) + 1) < 12
  - date:
      field: crowdstrike.event.EndTimestamp
      target_field: crowdstrike.event.EndTimestamp
      timezone: UTC
      formats:
        - UNIX
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.EndTimestamp != null &&
        !(ctx.crowdstrike.event.EndTimestamp instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.EndTimestamp) + 1) < 12
  - date:
      field: crowdstrike.event.UTCTimestamp
      target_field: crowdstrike.event.UTCTimestamp
      timezone: UTC
      formats:
        - UNIX
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.event?.UTCTimestamp != null &&
        !(ctx.crowdstrike.event.UTCTimestamp instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.event.UTCTimestamp) + 1) < 12
  - date:
      field: crowdstrike.metadata.eventCreationTime
      target_field: crowdstrike.metadata.eventCreationTime
      timezone: UTC
      formats:
        - UNIX
      ignore_failure: true
      if: |
        ctx?.crowdstrike?.metadata?.eventCreationTime != null &&
        !(ctx.crowdstrike.metadata.eventCreationTime instanceof String) &&
        (int)(Math.log10(ctx.crowdstrike.metadata.eventCreationTime) + 1) < 12
  - set:
      field: event.outcome
      value: success
      if: ctx?.crowdstrike?.event?.Success == true
  - set:
      field: event.outcome
      value: failure
      if: ctx?.crowdstrike?.event?.Success == false
  - set:
      field: event.outcome
      value: unknown
      if: ctx?.event?.outcome == null
  - convert:
      field: crowdstrike.metadata.eventCreationTime
      target_field: "@timestamp"
      type: string
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: crowdstrike.event.LateralMovement
      type: long
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: crowdstrike.event.LocalPort
      type: long
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: crowdstrike.event.MatchCount
      type: long
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: crowdstrike.event.MatchCountSinceLastReport
      type: long
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: crowdstrike.event.PID
      type: long
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: crowdstrike.event.RemotePort
      type: long
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: source.port
      type: long
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: destination.port
      type: long
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: crowdstrike.event.UserName
      target_field: user.name
      type: string
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: crowdstrike.event.UserId
      target_field: user.name
      type: string
      ignore_missing: true
      ignore_failure: true
      if: ctx?.user?.name == null || ctx?.user?.name == ""
  - set:
      field: user.email
      value: "{{user.name}}"
      ignore_empty_value: true
      ignore_failure: true
      if: ctx?.user?.name != null && /@/.split(ctx.user.name).length == 2
  - script:
      lang: painless
      source: |
        def commandLine = ctx?.crowdstrike?.event?.CommandLine;
        if (commandLine != null) {

          commandLine = commandLine.trim();

          if (commandLine != "") {
            def args = new ArrayList(Arrays.asList(/ /.split(commandLine)));
            args.removeIf(arg -> arg == "");

            ctx.process = [
              'command_line': commandLine,
              'args': args,
              'executable': args.get(0)
            ]
          }
        }
  - pipeline:
      name: '{{ IngestPipeline "detection_summary" }}'
      if: ctx?.crowdstrike?.metadata?.eventType == "DetectionSummaryEvent"
  - pipeline:
      name: '{{ IngestPipeline "incident_summary" }}'
      if: ctx?.crowdstrike?.metadata?.eventType == "IncidentSummaryEvent"
  - pipeline:
      name: '{{ IngestPipeline "user_activity_audit" }}'
      if: ctx?.crowdstrike?.metadata?.eventType == "UserActivityAuditEvent"
  - pipeline:
      name: '{{ IngestPipeline "auth_activity_audit" }}'
      if: ctx?.crowdstrike?.metadata?.eventType == "AuthActivityAuditEvent"
  - pipeline:
      name: '{{ IngestPipeline "firewall_match" }}'
      if: ctx?.crowdstrike?.metadata?.eventType == "FirewallMatchEvent"
  - pipeline:
      name: '{{ IngestPipeline "remote_response_session_start" }}'
      if: ctx?.crowdstrike?.metadata?.eventType == "RemoteResponseSessionStartEvent"
  - pipeline:
      name: '{{ IngestPipeline "remote_response_session_end" }}'
      if: ctx?.crowdstrike?.metadata?.eventType == "RemoteResponseSessionEndEvent"
  - script:
      lang: painless
      if: ctx?.crowdstrike?.event != null
      params:
        values:
          - null
          - ''
          - '-'
          - 'N/A'
          - 'NA'
          - 0
      source: |
        ctx.crowdstrike.event.entrySet().removeIf(entry -> params.values.contains(entry.getValue()));
  - script:
      lang: painless
      if: ctx?.crowdstrike?.metadata != null
      params:
        values:
          - null
          - ''
          - '-'
          - 'N/A'
          - 'NA'
      source: |
        ctx.crowdstrike.metadata.entrySet().removeIf(entry -> params.values.contains(entry.getValue()));
  - append:
      field: related.user
      value: "{{user.name}}"
      allow_duplicates: false
      ignore_failure: true
      if: ctx?.user?.name != null && ctx?.user?.name != ""
  - append:
      field: related.ip
      value: "{{source.ip}}"
      ignore_failure: true
      allow_duplicates: false
      if: ctx?.source?.ip != null && ctx?.source?.ip != ""
  - append:
      field: related.ip
      value: "{{destination.ip}}"
      ignore_failure: true
      allow_duplicates: false
      if: ctx?.destination?.ip != null && ctx?.destination?.ip != ""
  - append:
      field: related.hosts
      value: "{{host.name}}"
      ignore_failure: true
      allow_duplicates: false
      if: ctx?.host?.name != null && ctx?.host?.name != ""
  - remove:
      field: event.original
      if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))"
      ignore_failure: true
      ignore_missing: true
  - remove:
      field: _tmp
      ignore_failure: true
      ignore_missing: true
  - fingerprint:
      fields:
        - '@timestamp'
        - crowdstrike.event.SessionId
        - crowdstrike.event.DetectId
        - crowdstrike.metadata.eventType
        - crowdstrike.metadata.customerIDString
      target_field: _id
      ignore_missing: true

  - script:
      lang: painless
      description: This script processor iterates over the whole document to remove fields with null values.
      source: |
        void handleMap(Map map) {
          for (def x : map.values()) {
            if (x instanceof Map) {
                handleMap(x);
            } else if (x instanceof List) {
                handleList(x);
            }
          }
          map.values().removeIf(v -> v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0));
        }
        void handleList(List list) {
          for (def x : list) {
              if (x instanceof Map) {
                  handleMap(x);
              } else if (x instanceof List) {
                  handleList(x);
              }
          }
          list.removeIf(v -> v == null || v == '' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0));
        }
        handleMap(ctx);
on_failure:
  - set:
      field: event.kind
      value: pipeline_error
  - append:
      field: error.message
      value: '{{{ _ingest.on_failure_message }}}'