[CrowdStrike]: Expand event categorization for FDR event types

[navnit-elastic]

Integration Name

CrowdStrike [crowdstrike]

Dataset Name

fdr

Integration Version

all

Agent Version

NA

OS Version and Architecture

NA

User Goal

Based on the ECS categorization pipeline, CrowdStrike FDR integration does not supports all FDR event types, this cause the events to not have event.category, event.type, event.kind.

Existing Features

The CrowdStrike FDR integration ECS categorize a subset of FDR event types.

What did you see?

Missing event types cause some documents to not have event.category, event.type and event.kind.

Anything else?

No response

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[navnit-elastic]

Hello,

As part of expanding coverage of FDR event types, we have identified the most relevant event types for security platform requirements and listed them in this spreadsheet.

The event types are further grouped by priority levels to enable phased implementation. This document includes event name, description and relevant ECS event categorization fields.

Attached is the event categorization in JSON format:

crowdstrike_integration_prioritized_missing_events.json

I would like the team to review this document and provide their feedback on the priority levels and ECS categorization.

[narph]

cc @cpascale43 , can we get your feedback above?

[navnit-elastic]

Adding support for missing event types requires:

• Updates to existing FDR pipeline to correctly parse event fields and add categorization fields
• Updating categorize.yml with 134 new event categorizations

The majority of fields overlap with currently supported event types, so minimal changes to field definitions are expected.

[navnit-elastic]

@kcreddy, As a next step toward adding new event types to the FDR data stream, we can consider adding the following priority event types for Windows, macOS, and Linux platforms in Phase 1.

We can utilize our CrowdStrike instance and CrowdStrike documentation to generate sample logs.

---

Add following event types to data_stream/fdr/elasticsearch/ingest_pipeline/categorize.yml in the script params map so that ECS event.category, event.kind, event.outcome, and event.type are set correctly.

Event Type	event.category	event.kind	event.outcome	event.type
ActiveDirectoryAccountPasswordUpdate	authentication	event	success	info
ActiveDirectoryAuditPasswordModificationAttempt	authentication	event	-	info
ImpersonationTokenInfo	authentication	event	-	info
LoginItemAdded	authentication	event	success	info
LogonBehaviorCompositionDetectInfo	authentication	event	-	info
OpenDirectoryPasswordModification	authentication	event	success	info
ProcessTokenPrivilegesEdited	authentication	event	success	info
ProcessTokenStolen	authentication	event	success	info
SmbClientShareLogonBruteForceLowThreshold	authentication	event	-	info start
SmbClientShareLogonBruteForceSuspected	authentication	event	-	info start
SuspiciousCredentialModuleLoad	authentication	event	success	info
SystemTokenStolen	authentication	event	success	info
UACCredentialCaptureElevation	authentication	event	success	info
ZerologonExploitAttempt	authentication	event	-	info

---

2. New fields (fields.yml)

The following 6 fields are used by these event types and are not present in data_stream/fdr/fields/fields.yml.

Field name	Type	Used by event(s)
ActiveDirectoryAuditActionType	keyword	ActiveDirectoryAuditPasswordModificationAttempt
ODErrorCode	keyword	OpenDirectoryPasswordModification (macOS)
ODNodeName	keyword	OpenDirectoryPasswordModification (macOS)
ResponsiblePid	keyword	LoginItemAdded (macOS)
TokenObjectCheckType	keyword	ProcessTokenStolen, ProcessTokenPrivilegesEdited, SystemTokenStolen
UACPromptType	keyword	UACCredentialCaptureElevation

---

3. Default pipeline (default.yml)

No changes are required in data_stream/fdr/elasticsearch/ingest_pipeline/default.yml for these 14 event types.

---

4. Overlapping / existing fields

These event types also use many fields that already exist in fields.yml, including but not limited to:

• ContextTimeStamp, ContextProcessId, ContextThreadId, ContextImageFileName
• AccountObjectGuid, AccountObjectSid, SamAccountName, AccountDomain
• AuthenticationId, TokenType, TreeId
• ImageFileName, TargetFileName, CommandLine
• ClientComputerName, UserName, UserSid
• EtwRawProcessId, EtwRawThreadId
• LaunchItemUrl

No additions are needed for these.