Add support for FireEye HX acquisition packages in process_tree

[ZeArioch]

Hello 👋 this is just in case you are open to supporting third-party commercial tools.

FireEye's endpoint security HX product records process creation events and can make them available in data acquisition packages as XML structured data (see sample below). This is easily parsed into pandas DataFrames, and provides all required information for a process_tree schema.

I successfully tested this in a notebook, I could provide a sample acquisition package if needed.

<eventItem sequence_num="4257223597" uid="379727734">
    <timestamp>2023-01-11T06:21:59.774Z</timestamp>
    <eventType>processEvent</eventType>
    <details>
     <detail>
      <name>eventType</name>
      <value>start</value>
     </detail>
     <detail>
      <name>pid</name>
      <value>11604</value>
     </detail>
     <detail>
      <name>processPath</name>
      <value>C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe</value>
     </detail>
     <detail>
      <name>process</name>
      <value>msedge.exe</value>
     </detail>
     <detail>
      <name>parentPid</name>
      <value>17936</value>
     </detail>
     <detail>
      <name>parentProcessPath</name>
      <value>C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe</value>
     </detail>
     <detail>
      <name>parentProcess</name>
      <value>msedge.exe</value>
     </detail>
     <detail>
      <name>username</name>
      <value>SNIP_DOMAIN\SNIP_USER</value>
     </detail>
     <detail>
      <name>startTime</name>
      <value>2023-01-11T06:21:59.774Z</value>
     </detail>
     <detail>
      <name>md5</name>
      <value>0fd9e9bd708f1f69c9bb987cfc1f9a4c</value>
     </detail>
     <detail>
      <name>processCmdLine</name>
      <value>"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" SNIP_CMDLINE</value>
     </detail>
    </details>
   </eventItem>

Note: the hostname comes from another source inside the HX acquisition package and is added to the dataframe on the side.

[ianhelle]

Nice - thanks for the submission!
Definitely open to supporting whatever schemas people want to add.

[ianhelle]

/azpipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[ZeArioch]

@microsoft-github-policy-service agree

[ianhelle]

/azpipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[ianhelle]

/azpipelines run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).