Skip to content

Add event.category registry #1040

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
webmat merged 6 commits into from
Oct 27, 2020
Merged

Add event.category registry #1040

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1f57c64
Add event.category registry
Oct 20, 2020
b9b7efc
Experimental artifacts
Oct 20, 2020
5e085bd
Changelog
Oct 20, 2020
68d4054
Adjust registry description to be closer to our initial definition fo…
Oct 26, 2020
77a7d04
Was missing a build of experimental artifacts
Oct 27, 2020
78f0624
Merge branch 'master' into category-registry
Oct 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions CHANGELOG.next.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,15 @@ Thanks, you're awesome :-) -->

### Schema Changes

* Added `event.category` "session". #1049

#### Breaking changes

#### Bugfixes

#### Added

* Added `event.category` "registry". #1040
* Added `event.category` "session". #1049

#### Improvements

#### Deprecated
Expand Down
2 changes: 1 addition & 1 deletion docs/field-details.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1597,7 +1597,7 @@ Note: this field should contain an array of values.

*Important*: The field value must be one of the following:

authentication, configuration, database, driver, file, host, iam, intrusion_detection, malware, network, package, process, session, web
authentication, configuration, database, driver, file, host, iam, intrusion_detection, malware, network, package, process, registry, session, web

To learn more about when to use which value, visit the page
<<ecs-allowed-values-event-category,allowed values for event.category>>
Expand Down
13 changes: 13 additions & 0 deletions docs/field-values.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,7 @@ that will require subsequent breaking changes.
* <<ecs-event-category-network,network>>
* <<ecs-event-category-package,package>>
* <<ecs-event-category-process,process>>
* <<ecs-event-category-registry,registry>>
* <<ecs-event-category-session,session>>
* <<ecs-event-category-web,web>>

Expand Down Expand Up @@ -299,6 +300,18 @@ Use this category of events to visualize and analyze process-specific informatio
access, change, end, info, start


[float]
[[ecs-event-category-registry]]
==== registry

Having to do with settings and assets stored in the Windows registry. Use this category to visualize and analyze activity such as registry access and modifications.


*Expected event types for category registry:*

access, change, creation, deletion


[float]
[[ecs-event-category-session]]
==== session
Expand Down
9 changes: 9 additions & 0 deletions experimental/generated/ecs/ecs_flat.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1774,6 +1774,15 @@ event.category:
- info
- start
name: process
- description: Having to do with settings and assets stored in the Windows registry.
Use this category to visualize and analyze activity such as registry access
and modifications.
expected_event_types:
- access
- change
- creation
- deletion
name: registry
- description: The session category is applied to events and metrics regarding logical
persistent connections to hosts and services. Use this category to visualize
and analyze interactive or automated persistent connections between assets.
Expand Down
9 changes: 9 additions & 0 deletions experimental/generated/ecs/ecs_nested.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2168,6 +2168,15 @@ event:
- info
- start
name: process
- description: Having to do with settings and assets stored in the Windows registry.
Use this category to visualize and analyze activity such as registry access
and modifications.
expected_event_types:
- access
- change
- creation
- deletion
name: registry
- description: The session category is applied to events and metrics regarding
logical persistent connections to hosts and services. Use this category
to visualize and analyze interactive or automated persistent connections
Expand Down
9 changes: 9 additions & 0 deletions generated/ecs/ecs_flat.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1814,6 +1814,15 @@ event.category:
- info
- start
name: process
- description: Having to do with settings and assets stored in the Windows registry.
Use this category to visualize and analyze activity such as registry access
and modifications.
expected_event_types:
- access
- change
- creation
- deletion
name: registry
- description: The session category is applied to events and metrics regarding logical
persistent connections to hosts and services. Use this category to visualize
and analyze interactive or automated persistent connections between assets.
Expand Down
9 changes: 9 additions & 0 deletions generated/ecs/ecs_nested.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2209,6 +2209,15 @@ event:
- info
- start
name: process
- description: Having to do with settings and assets stored in the Windows registry.
Use this category to visualize and analyze activity such as registry access
and modifications.
expected_event_types:
- access
- change
- creation
- deletion
name: registry
- description: The session category is applied to events and metrics regarding
logical persistent connections to hosts and services. Use this category
to visualize and analyze interactive or automated persistent connections
Expand Down
9 changes: 9 additions & 0 deletions schemas/event.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,6 +277,15 @@
- end
- info
- start
- name: registry
description: >
Having to do with settings and assets stored in the Windows registry.
Use this category to visualize and analyze activity such as registry access and modifications.
expected_event_types:
Copy link
Copy Markdown
Contributor

@rw-access rw-access Oct 20, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for the add.
I think this seems like a good start. And I would err on the side of omitting info like you did. It's always easier to add later than it is to remove.

These values may not be specific enough, because they don't differentiate between key vs value changes. But I think 99% of the time, we're looking at changed values, not keys. So this is okay in my opinion.

Copy link
Copy Markdown
Contributor Author

@webmat webmat Oct 21, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MikePaquette Did you have a specific use in mind for "info"? This proposal is not yet adding it as an expected value.

One way Auditbeat uses "info" is to dump a list of all running processes, to establish a baseline. Then it reports process start/end as things happen.

I could see a similar use for dumping a set of registry keys (hopefully not the whole hive); then monitor for changes with creation/change/deletion. Was that the idea?

Copy link
Copy Markdown
Contributor Author

@webmat webmat Oct 21, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rw-access On specificity wrt key vs value activity, I'm not sure we should change the allowed values in event.type.

I would think event.action can be used to capture whether it's a change to a value or a data blob?

- access
- change
- creation
- deletion
- name: session
description: >
The session category is applied to events and metrics regarding logical persistent connections to hosts and services.
Expand Down