diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 9f945154456..c9e85c54963 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -249,6 +249,7 @@ /packages/trellix_epo_cloud @elastic/security-external-integrations /packages/trend_micro_vision_one @elastic/security-external-integrations /packages/trendmicro @elastic/security-external-integrations +/packages/tychon @elastic/security-external-integrations /packages/udp @elastic/security-external-integrations /packages/universal_profiling_agent @elastic/profiling /packages/universal_profiling_collector @elastic/profiling diff --git a/packages/tychon/_dev/build/build.yml b/packages/tychon/_dev/build/build.yml new file mode 100644 index 00000000000..49e8fdaa97d --- /dev/null +++ b/packages/tychon/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@v8.10.0 diff --git a/packages/tychon/_dev/build/docs/README.md b/packages/tychon/_dev/build/docs/README.md new file mode 100644 index 00000000000..46f08f8c29b --- /dev/null +++ b/packages/tychon/_dev/build/docs/README.md @@ -0,0 +1,21 @@ +# TYCHON Agentless + +[TYCHON Agentless](https://tychon.io/products/tychon-agentless/) is an integration that lets you collect TYCHON's gold source Master Endpoint Record data from endpoints, including vulnerability and STIG results, without heavy resource use or software installation. You can then investigate the TYCHON data using Elastic's analytics, visualizations, and dashboards. [Contact us to learn more.](https://tychon.io/start-a-free-trial/) + +## Compatibility + +* This integration supports Windows and RedHat/CENTOS Endpoint Operating Systems. +* This integration requires a TYCHON Agentless license. +* This integration requires [TYCHON Vulnerability Definition](https://support.tychon.io/) files. +* The Linux Endpoint requires RedHat's [OpenScap](https://www.open-scap.org/tools/openscap-base/) to be installed for STIG and CVE to report data. +* This integration supports Elastic 8.8+. + +## Returned Data Fields + +### ARP Table Information + +TYCHON scans Endpoint ARP Tables and returns the results. + +{{fields "tychon_arp"}} + +{{event "tychon_arp"}} diff --git a/packages/tychon/_dev/deploy/docker/docker-compose.yml b/packages/tychon/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..6c4a8e5ac32 --- /dev/null +++ b/packages/tychon/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,8 @@ +version: '2.3' +services: + tychon-filestream: + image: alpine + volumes: + - ./sample_logs:/sample_logs:ro + - ${SERVICE_LOGS_DIR}:/var/log + command: /bin/sh -c "cp /sample_logs/* /var/log/" diff --git a/packages/tychon/_dev/deploy/docker/sample_logs/tychon-arp.log b/packages/tychon/_dev/deploy/docker/sample_logs/tychon-arp.log new file mode 100644 index 00000000000..4facc458359 --- /dev/null +++ b/packages/tychon/_dev/deploy/docker/sample_logs/tychon-arp.log @@ -0,0 +1 @@ +{"script.type":"powershell","host.os.build":"22621","host.ip":["10.154.5.200"],"host.hostname":"DESKTOP-AF7CIQM","host.os.name":"Microsoft Windows 11 Pro","host.hardware.manufacturer":"Dell Inc.","@timestamp":"2023-08-16T05:22:36Z","script.start":"2023-08-16T05:22:36Z","destination.mac":"00-09-0F-AA-00-02","host.hardware.owner":"james_sudbury@msn.com","host.hardware.cpu.caption":"Intel64 Family 6 Model 141 Stepping 1","destination.hostname":"Request timed out (700 ms)","host.os.organization":"","host.workgroup":"WORKGROUP","host.hardware.serial_number":"HYLCKG3","host.ipv4":"10.154.5.200","host.os.version":"2009","network.direction":"external","host.hardware.bios.name":"Dell Inc.","host.type":"Workstation","network.type":"IPv4","destination.name":"Request timed out (700 ms)","host.id":"47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP","host.biossn":"4C4C4544-0059-4C10-8043-C8C04F4B4733","host.mac":["60:E3:2B:4B:40:E2"],"network.interface":"Ethernet 3","host.oem.model":"XPS 17 9710","host.uptime":"594263.4592614","id":"DESKTOP-AF7CIQM#6#10.70.4.15#10.70.4.16","script.current_time":"2023-08-16T05:22:37Z","script.name":"Get-TychonArpInfo.ps1","network.state":"dynamic","script.version":"2.3.53.0","host.oem.manufacturer":"Dell","host.os.description":"","script.current_duration":"1809.94","host.ipv6":"fe80::c2c9:f4e0:eb65:2c33","destination.ip":"10.70.4.16","host.hardware.bios.version":"1.20.1","host.domain":"","host.os.family":"Windows"} diff --git a/packages/tychon/changelog.yml b/packages/tychon/changelog.yml new file mode 100644 index 00000000000..0053b951252 --- /dev/null +++ b/packages/tychon/changelog.yml @@ -0,0 +1,5 @@ +- version: 0.0.1 + changes: + - description: Initial release of package. + type: enhancement + link: https://github.com/joeperuzzi/integrations/pull/1 # FIXME Replace with the real PR link diff --git a/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.log b/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.log new file mode 100644 index 00000000000..3b0e09d4b15 --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.log @@ -0,0 +1 @@ +{"script.type":"powershell","host.os.build":"22621","host.ip":["10.154.5.200"],"host.hostname":"DESKTOP-AF7CIQM","host.os.name":"Microsoft Windows 11 Pro","host.hardware.manufacturer":"Dell Inc.","@timestamp":"2023-08-16T05:22:36Z","script.start":"2023-08-16T05:22:36Z","destination.mac":"00-09-0F-AA-00-02","host.hardware.owner":"james_sudbury@msn.com","host.hardware.cpu.caption":"Intel64 Family 6 Model 141 Stepping 1","destination.hostname":"Request timed out (700 ms)","host.os.organization":"","host.workgroup":"WORKGROUP","host.hardware.serial_number":"HYLCKG3","host.ipv4":"10.154.5.200","host.os.version":"2009","network.direction":"external","host.hardware.bios.name":"Dell Inc.","host.type":"Workstation","network.type":"IPv4","destination.name":"Request timed out (700 ms)","host.id":"47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP","host.biossn":"4C4C4544-0059-4C10-8043-C8C04F4B4733","host.mac":["60:E3:2B:4B:40:E2"],"network.interface":"Ethernet 3","host.oem.model":"XPS 17 9710","host.uptime":"594263.4592614","id":"DESKTOP-AF7CIQM#6#10.70.4.15#10.70.4.16","script.current_time":"2023-08-16T05:22:37Z","script.name":"Get-TychonArpInfo.ps1","network.state":"dynamic","script.version":"2.3.53.0","host.oem.manufacturer":"Dell","host.os.description":"","script.current_duration":"1809.94","host.ipv6":"fe80::c2c9:f4e0:eb65:2c33","destination.ip":"10.70.4.16","host.hardware.bios.version":"1.20.1","host.domain":"","host.os.family":"Windows"} \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.log-expected.json b/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.log-expected.json new file mode 100644 index 00000000000..1ff55b6237d --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.log-expected.json @@ -0,0 +1,87 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-16T05:22:36.000Z", + "ecs": { + "version": "8.10.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "state", + "type": [ + "info" + ] + }, + "tychon": { + "arp": { + "destination": { + "hostname": "Request timed out (700 ms)", + "ip": "10.70.4.16", + "mac": "00-09-0F-AA-00-02", + "name": "Request timed out (700 ms)" + }, + "host": { + "biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", + "domain": "", + "hardware": { + "bios": { + "name": "Dell Inc.", + "version": "1.20.1" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 141 Stepping 1" + }, + "manufacturer": "Dell Inc.", + "owner": "james_sudbury@msn.com", + "serial_number": "HYLCKG3" + }, + "hostname": "DESKTOP-AF7CIQM", + "id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", + "ip": [ + "10.154.5.200" + ], + "ipv4": [ + "10.154.5.200" + ], + "ipv6": "fe80::c2c9:f4e0:eb65:2c33", + "mac": [ + "60-E3-2B-4B-40-E2" + ], + "oem": { + "manufacturer": "Dell", + "model": "XPS 17 9710" + }, + "os": { + "build": "22621", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 11 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 594263, + "workgroup": "WORKGROUP" + }, + "network": { + "direction": "external", + "interface": "Ethernet 3", + "state": "dynamic", + "type": "IPv4" + }, + "script": { + "current_duration": "1809.94", + "current_time": "2023-08-16T05:22:37Z", + "name": "Get-TychonArpInfo.ps1", + "start": "2023-08-16T05:22:36Z", + "type": "powershell", + "version": "2.3.53.0" + } + }, + "id": "DESKTOP-AF7CIQM#6#10.70.4.15#10.70.4.16" + } + } + ] +} \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_arp/_dev/test/system/test-logfile-config.yml b/packages/tychon/data_stream/tychon_arp/_dev/test/system/test-logfile-config.yml new file mode 100644 index 00000000000..8fc28a0bbd5 --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/_dev/test/system/test-logfile-config.yml @@ -0,0 +1,8 @@ +service: tychon-filestream +input: filestream +data_stream: + vars: + preserve_original_event: true + preserve_duplicate_custom_fields: true + paths: + - '{{SERVICE_LOGS_DIR}}/*.log' diff --git a/packages/tychon/data_stream/tychon_arp/agent/stream/stream.yml.hbs b/packages/tychon/data_stream/tychon_arp/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..27b454b7750 --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/agent/stream/stream.yml.hbs @@ -0,0 +1,22 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +prospector.scanner.exclude_files: [".gz$"] +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_arp/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_arp/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..b5d3997e698 --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,95 @@ +--- +description: Pipeline for TYCHON ARP Tables +processors: + - rename: + tag: rename_message + field: message + target_field: event.original + - json: + field: event.original + target_field: tychon.arp + - dot_expander: + tag: expand_dots + path: tychon.arp + field: '*' + - rename: + tag: rename_tychon_timestamp + field: 'tychon.arp.@timestamp' + target_field: 'tychon.timestamp' + - rename: + tag: rename_tychon_id + field: 'tychon.arp.id' + target_field: 'tychon.id' + - date: + tag: date_timestamp + field: 'tychon.timestamp' + formats: + - ISO8601 + - set: + field: ecs.version + value: 8.10.0 + - set: + field: event.kind + value: state + - gsub: + field: tychon.arp.host.mac + pattern: ':' + replacement: '-' + ignore_missing: true + - split: + field: tychon.arp.host.ipv4 + separator: ',' + ignore_missing: true + - convert: + field: tychon.arp.host.uptime + type: string + ignore_missing: true + - split: + field: tychon.arp.host.uptime + separator: '\.+' + target_field: tempuptime + ignore_failure: true + - set: + field: tychon.arp.host.uptime + value: '{{{tempuptime.0}}}' + ignore_failure: true + - remove: + field: tempuptime + ignore_failure: true + ignore_missing: true + - convert: + tag: convert_host_uptime + field: tychon.arp.host.uptime + type: long + ignore_missing: true + - set: + field: event.category + value: [network] + - set: + field: event.type + value: [info] + - convert: + tag: convert_script_current_duration + field: tychon.script.current_duration + type: float + ignore_missing: true + - remove: + tag: remove_preserve_original_event + field: event.original + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + ignore_failure: true + ignore_missing: true + - remove: + tag: remove_preserve_duplicate_custom_fields + # add fields here that have been copied into ECS fields. + field: + - tychon.timestamp + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + ignore_missing: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' diff --git a/packages/tychon/data_stream/tychon_arp/fields/agent.yml b/packages/tychon/data_stream/tychon_arp/fields/agent.yml new file mode 100644 index 00000000000..0e3ebb4f05c --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/fields/agent.yml @@ -0,0 +1,101 @@ +- name: elastic_agent + type: group + fields: + - name: id + description: Elastic Agent Id. + type: keyword + - name: snapshot + description: Elastic Agent snapshot. + type: boolean + - name: version + description: Elastic Agent Version. + type: keyword +- name: script + type: group + fields: + - name: current_duration + description: Scanner Script Duration. + type: long + - name: current_time + description: Current datetime. + type: date + - name: name + description: Scanner Script Name. + type: keyword + - name: start + description: Scanner Start datetime. + type: date + - name: type + description: Scanner Script Type. + type: keyword + - name: version + description: Scanner Script Version. + type: version +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: biossn + description: Host BIOS Serial Number. + type: keyword + - name: ipv4 + description: Host IPv4 addresses. + type: ip + - name: ipv6 + description: Host IPv6 addresses. + type: keyword + - name: workgroup + description: Host Workgroup Network Name. + type: keyword + - name: oem + type: group + fields: + - name: manufacturer + description: Host OEM Manufacturer. + type: keyword + - name: model + description: Host OEM Model. + type: keyword + - name: os + type: group + fields: + - name: build + description: Host OS Build. + type: keyword + - name: description + description: Host OS Description. + type: text + - name: organization + description: Host OS Organization. + type: keyword + - name: hardware + type: group + fields: + - name: bios + type: group + fields: + - name: name + description: Host BIOS Name. + type: keyword + - name: version + description: Host BIOS Version. + type: keyword + - name: cpu + type: group + fields: + - name: caption + description: Host CPU Caption. + type: keyword + - name: manufacturer + description: Host BIOS Manufacturer. + type: keyword + - name: owner + description: Host BIOS Owner. + type: keyword + - name: serial_number + description: Host BIOS Serial Number. + type: keyword diff --git a/packages/tychon/data_stream/tychon_arp/fields/base-fields.yml b/packages/tychon/data_stream/tychon_arp/fields/base-fields.yml new file mode 100644 index 00000000000..3524f6c16fc --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/fields/base-fields.yml @@ -0,0 +1,17 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module + value: tychon +- name: event.dataset + type: constant_keyword + description: Event dataset + value: tychon.tychon_arp diff --git a/packages/tychon/data_stream/tychon_arp/fields/beats.yml b/packages/tychon/data_stream/tychon_arp/fields/beats.yml new file mode 100644 index 00000000000..f69a96ea421 --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/fields/beats.yml @@ -0,0 +1,33 @@ +- description: Type of Filebeat input. + name: input.type + type: keyword +- description: Flags for the log file. + name: log.flags + type: keyword +- description: Offset of the entry in the log file. + name: log.offset + type: long +- description: Path to the log file. + name: log.file.path + type: keyword +- description: Source address from which the log event was read / sent from. + name: log.source.address + type: keyword +- description: Referrer for this HTTP request. + name: http.request.referer + type: keyword +- description: Syslog numeric facility of the event. + name: syslog.facility + type: long +- description: Syslog text-based facility of the event. + name: syslog.facility_label + type: keyword +- description: Syslog priority of the event. + name: syslog.priority + type: long +- description: Syslog text-based severity of the event. + name: syslog.severity_label + type: keyword +- description: Name of host parsed from syslog message. + name: hostname + type: keyword diff --git a/packages/tychon/data_stream/tychon_arp/fields/ecs.yml b/packages/tychon/data_stream/tychon_arp/fields/ecs.yml new file mode 100644 index 00000000000..cf870d25e7a --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/fields/ecs.yml @@ -0,0 +1,66 @@ +- external: ecs + name: '@timestamp' +- external: ecs + name: agent.ephemeral_id +- external: ecs + name: agent.id +- external: ecs + name: agent.name +- external: ecs + name: agent.type +- external: ecs + name: agent.version +- external: ecs + name: destination.ip +- external: ecs + name: destination.mac +- external: ecs + name: ecs.version +- external: ecs + name: event.agent_id_status +- external: ecs + name: event.category +- external: ecs + name: event.kind +- external: ecs + name: event.timezone +- external: ecs + name: host.architecture +- external: ecs + name: host.domain +- external: ecs + name: host.hostname +- external: ecs + name: host.id +- external: ecs + name: host.ip +- external: ecs + name: host.mac +- external: ecs + name: host.name +- external: ecs + name: host.os.family +- external: ecs + name: host.os.kernel +- external: ecs + name: host.os.name +- external: ecs + name: host.os.platform +- external: ecs + name: host.os.type +- external: ecs + name: host.os.version +- external: ecs + name: host.type +- external: ecs + name: host.uptime +- external: ecs + name: network.direction +- external: ecs + name: network.type +- external: ecs + name: tags +- external: ecs + name: error.message +- external: ecs + name: event.ingested diff --git a/packages/tychon/data_stream/tychon_arp/fields/fields.yml b/packages/tychon/data_stream/tychon_arp/fields/fields.yml new file mode 100644 index 00000000000..4c810b3645a --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/fields/fields.yml @@ -0,0 +1,107 @@ +- name: tychon + type: group + fields: + - name: timestamp + type: date + - name: id + description: TYCHON unique document identifier. + type: keyword + - name: arp + type: group + fields: + - name: destination + type: group + fields: + - name: hostname + type: keyword + - name: ip + type: keyword + - name: mac + type: keyword + - name: name + type: keyword + - name: host + type: group + fields: + - name: biossn + type: keyword + - name: domain + type: keyword + - name: hardware + type: group + fields: + - name: bios.name + type: keyword + - name: bios.version + type: keyword + - name: cpu.caption + type: keyword + - name: manufacturer + type: keyword + - name: owner + type: keyword + - name: serial_number + type: keyword + - name: hostname + type: keyword + - name: id + type: keyword + - name: ip + type: keyword + - name: ipv4 + type: keyword + - name: ipv6 + type: keyword + - name: mac + type: keyword + - name: oem.manufacturer + type: keyword + - name: oem.model + type: keyword + - name: os + type: group + fields: + - name: build + type: keyword + - name: description + type: keyword + - name: family + type: keyword + - name: name + type: keyword + - name: organization + type: keyword + - name: version + type: keyword + - name: type + type: keyword + - name: uptime + type: long + - name: workgroup + type: keyword + - name: network + type: group + fields: + - name: direction + type: keyword + - name: interface + type: keyword + - name: state + type: keyword + - name: type + type: keyword + - name: script + type: group + fields: + - name: current_duration + type: keyword + - name: current_time + type: keyword + - name: name + type: keyword + - name: start + type: keyword + - name: type + type: keyword + - name: version + type: keyword diff --git a/packages/tychon/data_stream/tychon_arp/manifest.yml b/packages/tychon/data_stream/tychon_arp/manifest.yml new file mode 100644 index 00000000000..2f0ec874964 --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/manifest.yml @@ -0,0 +1,49 @@ +title: Endpoint Arp Table Information +type: logs +streams: + - input: filestream + title: Endpoint Arp Table Information + description: TYCHON will report on the entire ARP table from an endpoint. + template_path: stream.yml.hbs + vars: + - name: paths + type: text + title: TYCHON Output Arp Location + multi: true + required: true + show_user: true + default: + - C:\ProgramData\TYCHONCLOUD\eventlogs\tychon_arp_info.json + - /var/log/tychoncloud/eventlogs/tychon_arp_info.json + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - tychon-arp-info + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve tychon.tychon_arp fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_arp/sample_event.json b/packages/tychon/data_stream/tychon_arp/sample_event.json new file mode 100644 index 00000000000..3e2ce532ee3 --- /dev/null +++ b/packages/tychon/data_stream/tychon_arp/sample_event.json @@ -0,0 +1,141 @@ +{ + "@timestamp": "2023-08-16T05:22:36.000Z", + "agent": { + "ephemeral_id": "ee26f1c6-89c7-42c9-8f72-13b1d52bc1c2", + "id": "0874c904-40cc-4817-b0f8-557b17245c75", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "tychon.tychon_arp", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.10.0" + }, + "elastic_agent": { + "id": "0874c904-40cc-4817-b0f8-557b17245c75", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "tychon.tychon_arp", + "ingested": "2023-10-18T03:41:39Z", + "kind": "state", + "original": "{\"script.type\":\"powershell\",\"host.os.build\":\"22621\",\"host.ip\":[\"10.154.5.200\"],\"host.hostname\":\"DESKTOP-AF7CIQM\",\"host.os.name\":\"Microsoft Windows 11 Pro\",\"host.hardware.manufacturer\":\"Dell Inc.\",\"@timestamp\":\"2023-08-16T05:22:36Z\",\"script.start\":\"2023-08-16T05:22:36Z\",\"destination.mac\":\"00-09-0F-AA-00-02\",\"host.hardware.owner\":\"james_sudbury@msn.com\",\"host.hardware.cpu.caption\":\"Intel64 Family 6 Model 141 Stepping 1\",\"destination.hostname\":\"Request timed out (700 ms)\",\"host.os.organization\":\"\",\"host.workgroup\":\"WORKGROUP\",\"host.hardware.serial_number\":\"HYLCKG3\",\"host.ipv4\":\"10.154.5.200\",\"host.os.version\":\"2009\",\"network.direction\":\"external\",\"host.hardware.bios.name\":\"Dell Inc.\",\"host.type\":\"Workstation\",\"network.type\":\"IPv4\",\"destination.name\":\"Request timed out (700 ms)\",\"host.id\":\"47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP\",\"host.biossn\":\"4C4C4544-0059-4C10-8043-C8C04F4B4733\",\"host.mac\":[\"60:E3:2B:4B:40:E2\"],\"network.interface\":\"Ethernet 3\",\"host.oem.model\":\"XPS 17 9710\",\"host.uptime\":\"594263.4592614\",\"id\":\"DESKTOP-AF7CIQM#6#10.70.4.15#10.70.4.16\",\"script.current_time\":\"2023-08-16T05:22:37Z\",\"script.name\":\"Get-TychonArpInfo.ps1\",\"network.state\":\"dynamic\",\"script.version\":\"2.3.53.0\",\"host.oem.manufacturer\":\"Dell\",\"host.os.description\":\"\",\"script.current_duration\":\"1809.94\",\"host.ipv6\":\"fe80::c2c9:f4e0:eb65:2c33\",\"destination.ip\":\"10.70.4.16\",\"host.hardware.bios.version\":\"1.20.1\",\"host.domain\":\"\",\"host.os.family\":\"Windows\"}", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "192.168.128.7" + ], + "mac": [ + "02-42-C0-A8-80-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "5.15.49-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "input": { + "type": "filestream" + }, + "log": { + "file": { + "path": "/tmp/service_logs/tychon-arp.log" + }, + "offset": 0 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "tychon-arp-info" + ], + "tychon": { + "arp": { + "destination": { + "hostname": "Request timed out (700 ms)", + "ip": "10.70.4.16", + "mac": "00-09-0F-AA-00-02", + "name": "Request timed out (700 ms)" + }, + "host": { + "biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", + "domain": "", + "hardware": { + "bios": { + "name": "Dell Inc.", + "version": "1.20.1" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 141 Stepping 1" + }, + "manufacturer": "Dell Inc.", + "owner": "james_sudbury@msn.com", + "serial_number": "HYLCKG3" + }, + "hostname": "DESKTOP-AF7CIQM", + "id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", + "ip": [ + "10.154.5.200" + ], + "ipv4": [ + "10.154.5.200" + ], + "ipv6": "fe80::c2c9:f4e0:eb65:2c33", + "mac": [ + "60-E3-2B-4B-40-E2" + ], + "oem": { + "manufacturer": "Dell", + "model": "XPS 17 9710" + }, + "os": { + "build": "22621", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 11 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 594263, + "workgroup": "WORKGROUP" + }, + "network": { + "direction": "external", + "interface": "Ethernet 3", + "state": "dynamic", + "type": "IPv4" + }, + "script": { + "current_duration": "1809.94", + "current_time": "2023-08-16T05:22:37Z", + "name": "Get-TychonArpInfo.ps1", + "start": "2023-08-16T05:22:36Z", + "type": "powershell", + "version": "2.3.53.0" + } + }, + "id": "DESKTOP-AF7CIQM#6#10.70.4.15#10.70.4.16", + "timestamp": "2023-08-16T05:22:36Z" + } +} \ No newline at end of file diff --git a/packages/tychon/docs/README.md b/packages/tychon/docs/README.md new file mode 100644 index 00000000000..9f0cf490d26 --- /dev/null +++ b/packages/tychon/docs/README.md @@ -0,0 +1,284 @@ +# TYCHON Agentless + +[TYCHON Agentless](https://tychon.io/products/tychon-agentless/) is an integration that lets you collect TYCHON's gold source Master Endpoint Record data from endpoints, including vulnerability and STIG results, without heavy resource use or software installation. You can then investigate the TYCHON data using Elastic's analytics, visualizations, and dashboards. [Contact us to learn more.](https://tychon.io/start-a-free-trial/) + +## Compatibility + +* This integration supports Windows and RedHat/CENTOS Endpoint Operating Systems. +* This integration requires a TYCHON Agentless license. +* This integration requires [TYCHON Vulnerability Definition](https://support.tychon.io/) files. +* The Linux Endpoint requires RedHat's [OpenScap](https://www.open-scap.org/tools/openscap-base/) to be installed for STIG and CVE to report data. +* This integration supports Elastic 8.8+. + +## Returned Data Fields + +### ARP Table Information + +TYCHON scans Endpoint ARP Tables and returns the results. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | +| agent.ephemeral_id | Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not. | keyword | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | +| agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | keyword | +| agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | +| agent.version | Version of the agent. | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| elastic_agent.id | Elastic Agent Id. | keyword | +| elastic_agent.snapshot | Elastic Agent snapshot. | boolean | +| elastic_agent.version | Elastic Agent Version. | keyword | +| error.message | Error message. | match_only_text | +| event.agent_id_status | Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation. For example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used. If no validation is performed then the field should be omitted. The allowed values are: `verified` - The `agent.id` field value matches expected value obtained from auth metadata. `mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata. `missing` - There was no `agent.id` field in the event to validate. `auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.dataset | Event dataset | constant_keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.module | Event module | constant_keyword | +| event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.biossn | Host BIOS Serial Number. | keyword | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hardware.bios.name | Host BIOS Name. | keyword | +| host.hardware.bios.version | Host BIOS Version. | keyword | +| host.hardware.cpu.caption | Host CPU Caption. | keyword | +| host.hardware.manufacturer | Host BIOS Manufacturer. | keyword | +| host.hardware.owner | Host BIOS Owner. | keyword | +| host.hardware.serial_number | Host BIOS Serial Number. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.ipv4 | Host IPv4 addresses. | ip | +| host.ipv6 | Host IPv6 addresses. | keyword | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | +| host.oem.manufacturer | Host OEM Manufacturer. | keyword | +| host.oem.model | Host OEM Model. | keyword | +| host.os.build | Host OS Build. | keyword | +| host.os.description | Host OS Description. | text | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | +| host.os.organization | Host OS Organization. | keyword | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| host.uptime | Seconds the host has been up. | long | +| host.workgroup | Host Workgroup Network Name. | keyword | +| hostname | Name of host parsed from syslog message. | keyword | +| http.request.referer | Referrer for this HTTP request. | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.file.path | Path to the log file. | keyword | +| log.flags | Flags for the log file. | keyword | +| log.offset | Offset of the entry in the log file. | long | +| log.source.address | Source address from which the log event was read / sent from. | keyword | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | +| script.current_duration | Scanner Script Duration. | long | +| script.current_time | Current datetime. | date | +| script.name | Scanner Script Name. | keyword | +| script.start | Scanner Start datetime. | date | +| script.type | Scanner Script Type. | keyword | +| script.version | Scanner Script Version. | version | +| syslog.facility | Syslog numeric facility of the event. | long | +| syslog.facility_label | Syslog text-based facility of the event. | keyword | +| syslog.priority | Syslog priority of the event. | long | +| syslog.severity_label | Syslog text-based severity of the event. | keyword | +| tags | List of keywords used to tag each event. | keyword | +| tychon.arp.destination.hostname | | keyword | +| tychon.arp.destination.ip | | keyword | +| tychon.arp.destination.mac | | keyword | +| tychon.arp.destination.name | | keyword | +| tychon.arp.host.biossn | | keyword | +| tychon.arp.host.domain | | keyword | +| tychon.arp.host.hardware.bios.name | | keyword | +| tychon.arp.host.hardware.bios.version | | keyword | +| tychon.arp.host.hardware.cpu.caption | | keyword | +| tychon.arp.host.hardware.manufacturer | | keyword | +| tychon.arp.host.hardware.owner | | keyword | +| tychon.arp.host.hardware.serial_number | | keyword | +| tychon.arp.host.hostname | | keyword | +| tychon.arp.host.id | | keyword | +| tychon.arp.host.ip | | keyword | +| tychon.arp.host.ipv4 | | keyword | +| tychon.arp.host.ipv6 | | keyword | +| tychon.arp.host.mac | | keyword | +| tychon.arp.host.oem.manufacturer | | keyword | +| tychon.arp.host.oem.model | | keyword | +| tychon.arp.host.os.build | | keyword | +| tychon.arp.host.os.description | | keyword | +| tychon.arp.host.os.family | | keyword | +| tychon.arp.host.os.name | | keyword | +| tychon.arp.host.os.organization | | keyword | +| tychon.arp.host.os.version | | keyword | +| tychon.arp.host.type | | keyword | +| tychon.arp.host.uptime | | long | +| tychon.arp.host.workgroup | | keyword | +| tychon.arp.network.direction | | keyword | +| tychon.arp.network.interface | | keyword | +| tychon.arp.network.state | | keyword | +| tychon.arp.network.type | | keyword | +| tychon.arp.script.current_duration | | keyword | +| tychon.arp.script.current_time | | keyword | +| tychon.arp.script.name | | keyword | +| tychon.arp.script.start | | keyword | +| tychon.arp.script.type | | keyword | +| tychon.arp.script.version | | keyword | +| tychon.id | TYCHON unique document identifier. | keyword | +| tychon.timestamp | | date | + + +An example event for `tychon_arp` looks as following: + +```json +{ + "@timestamp": "2023-08-16T05:22:36.000Z", + "agent": { + "ephemeral_id": "ee26f1c6-89c7-42c9-8f72-13b1d52bc1c2", + "id": "0874c904-40cc-4817-b0f8-557b17245c75", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "tychon.tychon_arp", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.10.0" + }, + "elastic_agent": { + "id": "0874c904-40cc-4817-b0f8-557b17245c75", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "tychon.tychon_arp", + "ingested": "2023-10-18T03:41:39Z", + "kind": "state", + "original": "{\"script.type\":\"powershell\",\"host.os.build\":\"22621\",\"host.ip\":[\"10.154.5.200\"],\"host.hostname\":\"DESKTOP-AF7CIQM\",\"host.os.name\":\"Microsoft Windows 11 Pro\",\"host.hardware.manufacturer\":\"Dell Inc.\",\"@timestamp\":\"2023-08-16T05:22:36Z\",\"script.start\":\"2023-08-16T05:22:36Z\",\"destination.mac\":\"00-09-0F-AA-00-02\",\"host.hardware.owner\":\"james_sudbury@msn.com\",\"host.hardware.cpu.caption\":\"Intel64 Family 6 Model 141 Stepping 1\",\"destination.hostname\":\"Request timed out (700 ms)\",\"host.os.organization\":\"\",\"host.workgroup\":\"WORKGROUP\",\"host.hardware.serial_number\":\"HYLCKG3\",\"host.ipv4\":\"10.154.5.200\",\"host.os.version\":\"2009\",\"network.direction\":\"external\",\"host.hardware.bios.name\":\"Dell Inc.\",\"host.type\":\"Workstation\",\"network.type\":\"IPv4\",\"destination.name\":\"Request timed out (700 ms)\",\"host.id\":\"47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP\",\"host.biossn\":\"4C4C4544-0059-4C10-8043-C8C04F4B4733\",\"host.mac\":[\"60:E3:2B:4B:40:E2\"],\"network.interface\":\"Ethernet 3\",\"host.oem.model\":\"XPS 17 9710\",\"host.uptime\":\"594263.4592614\",\"id\":\"DESKTOP-AF7CIQM#6#10.70.4.15#10.70.4.16\",\"script.current_time\":\"2023-08-16T05:22:37Z\",\"script.name\":\"Get-TychonArpInfo.ps1\",\"network.state\":\"dynamic\",\"script.version\":\"2.3.53.0\",\"host.oem.manufacturer\":\"Dell\",\"host.os.description\":\"\",\"script.current_duration\":\"1809.94\",\"host.ipv6\":\"fe80::c2c9:f4e0:eb65:2c33\",\"destination.ip\":\"10.70.4.16\",\"host.hardware.bios.version\":\"1.20.1\",\"host.domain\":\"\",\"host.os.family\":\"Windows\"}", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "192.168.128.7" + ], + "mac": [ + "02-42-C0-A8-80-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "5.15.49-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "input": { + "type": "filestream" + }, + "log": { + "file": { + "path": "/tmp/service_logs/tychon-arp.log" + }, + "offset": 0 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "tychon-arp-info" + ], + "tychon": { + "arp": { + "destination": { + "hostname": "Request timed out (700 ms)", + "ip": "10.70.4.16", + "mac": "00-09-0F-AA-00-02", + "name": "Request timed out (700 ms)" + }, + "host": { + "biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", + "domain": "", + "hardware": { + "bios": { + "name": "Dell Inc.", + "version": "1.20.1" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 141 Stepping 1" + }, + "manufacturer": "Dell Inc.", + "owner": "james_sudbury@msn.com", + "serial_number": "HYLCKG3" + }, + "hostname": "DESKTOP-AF7CIQM", + "id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", + "ip": [ + "10.154.5.200" + ], + "ipv4": [ + "10.154.5.200" + ], + "ipv6": "fe80::c2c9:f4e0:eb65:2c33", + "mac": [ + "60-E3-2B-4B-40-E2" + ], + "oem": { + "manufacturer": "Dell", + "model": "XPS 17 9710" + }, + "os": { + "build": "22621", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 11 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 594263, + "workgroup": "WORKGROUP" + }, + "network": { + "direction": "external", + "interface": "Ethernet 3", + "state": "dynamic", + "type": "IPv4" + }, + "script": { + "current_duration": "1809.94", + "current_time": "2023-08-16T05:22:37Z", + "name": "Get-TychonArpInfo.ps1", + "start": "2023-08-16T05:22:36Z", + "type": "powershell", + "version": "2.3.53.0" + } + }, + "id": "DESKTOP-AF7CIQM#6#10.70.4.15#10.70.4.16", + "timestamp": "2023-08-16T05:22:36Z" + } +} +``` diff --git a/packages/tychon/elasticsearch/transform/arp/fields/agent.yml b/packages/tychon/elasticsearch/transform/arp/fields/agent.yml new file mode 100644 index 00000000000..0e3ebb4f05c --- /dev/null +++ b/packages/tychon/elasticsearch/transform/arp/fields/agent.yml @@ -0,0 +1,101 @@ +- name: elastic_agent + type: group + fields: + - name: id + description: Elastic Agent Id. + type: keyword + - name: snapshot + description: Elastic Agent snapshot. + type: boolean + - name: version + description: Elastic Agent Version. + type: keyword +- name: script + type: group + fields: + - name: current_duration + description: Scanner Script Duration. + type: long + - name: current_time + description: Current datetime. + type: date + - name: name + description: Scanner Script Name. + type: keyword + - name: start + description: Scanner Start datetime. + type: date + - name: type + description: Scanner Script Type. + type: keyword + - name: version + description: Scanner Script Version. + type: version +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: biossn + description: Host BIOS Serial Number. + type: keyword + - name: ipv4 + description: Host IPv4 addresses. + type: ip + - name: ipv6 + description: Host IPv6 addresses. + type: keyword + - name: workgroup + description: Host Workgroup Network Name. + type: keyword + - name: oem + type: group + fields: + - name: manufacturer + description: Host OEM Manufacturer. + type: keyword + - name: model + description: Host OEM Model. + type: keyword + - name: os + type: group + fields: + - name: build + description: Host OS Build. + type: keyword + - name: description + description: Host OS Description. + type: text + - name: organization + description: Host OS Organization. + type: keyword + - name: hardware + type: group + fields: + - name: bios + type: group + fields: + - name: name + description: Host BIOS Name. + type: keyword + - name: version + description: Host BIOS Version. + type: keyword + - name: cpu + type: group + fields: + - name: caption + description: Host CPU Caption. + type: keyword + - name: manufacturer + description: Host BIOS Manufacturer. + type: keyword + - name: owner + description: Host BIOS Owner. + type: keyword + - name: serial_number + description: Host BIOS Serial Number. + type: keyword diff --git a/packages/tychon/elasticsearch/transform/arp/fields/base-fields.yml b/packages/tychon/elasticsearch/transform/arp/fields/base-fields.yml new file mode 100644 index 00000000000..3524f6c16fc --- /dev/null +++ b/packages/tychon/elasticsearch/transform/arp/fields/base-fields.yml @@ -0,0 +1,17 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module + value: tychon +- name: event.dataset + type: constant_keyword + description: Event dataset + value: tychon.tychon_arp diff --git a/packages/tychon/elasticsearch/transform/arp/fields/beats.yml b/packages/tychon/elasticsearch/transform/arp/fields/beats.yml new file mode 100644 index 00000000000..f69a96ea421 --- /dev/null +++ b/packages/tychon/elasticsearch/transform/arp/fields/beats.yml @@ -0,0 +1,33 @@ +- description: Type of Filebeat input. + name: input.type + type: keyword +- description: Flags for the log file. + name: log.flags + type: keyword +- description: Offset of the entry in the log file. + name: log.offset + type: long +- description: Path to the log file. + name: log.file.path + type: keyword +- description: Source address from which the log event was read / sent from. + name: log.source.address + type: keyword +- description: Referrer for this HTTP request. + name: http.request.referer + type: keyword +- description: Syslog numeric facility of the event. + name: syslog.facility + type: long +- description: Syslog text-based facility of the event. + name: syslog.facility_label + type: keyword +- description: Syslog priority of the event. + name: syslog.priority + type: long +- description: Syslog text-based severity of the event. + name: syslog.severity_label + type: keyword +- description: Name of host parsed from syslog message. + name: hostname + type: keyword diff --git a/packages/tychon/elasticsearch/transform/arp/fields/ecs.yml b/packages/tychon/elasticsearch/transform/arp/fields/ecs.yml new file mode 100644 index 00000000000..cf870d25e7a --- /dev/null +++ b/packages/tychon/elasticsearch/transform/arp/fields/ecs.yml @@ -0,0 +1,66 @@ +- external: ecs + name: '@timestamp' +- external: ecs + name: agent.ephemeral_id +- external: ecs + name: agent.id +- external: ecs + name: agent.name +- external: ecs + name: agent.type +- external: ecs + name: agent.version +- external: ecs + name: destination.ip +- external: ecs + name: destination.mac +- external: ecs + name: ecs.version +- external: ecs + name: event.agent_id_status +- external: ecs + name: event.category +- external: ecs + name: event.kind +- external: ecs + name: event.timezone +- external: ecs + name: host.architecture +- external: ecs + name: host.domain +- external: ecs + name: host.hostname +- external: ecs + name: host.id +- external: ecs + name: host.ip +- external: ecs + name: host.mac +- external: ecs + name: host.name +- external: ecs + name: host.os.family +- external: ecs + name: host.os.kernel +- external: ecs + name: host.os.name +- external: ecs + name: host.os.platform +- external: ecs + name: host.os.type +- external: ecs + name: host.os.version +- external: ecs + name: host.type +- external: ecs + name: host.uptime +- external: ecs + name: network.direction +- external: ecs + name: network.type +- external: ecs + name: tags +- external: ecs + name: error.message +- external: ecs + name: event.ingested diff --git a/packages/tychon/elasticsearch/transform/arp/fields/fields.yml b/packages/tychon/elasticsearch/transform/arp/fields/fields.yml new file mode 100644 index 00000000000..4c810b3645a --- /dev/null +++ b/packages/tychon/elasticsearch/transform/arp/fields/fields.yml @@ -0,0 +1,107 @@ +- name: tychon + type: group + fields: + - name: timestamp + type: date + - name: id + description: TYCHON unique document identifier. + type: keyword + - name: arp + type: group + fields: + - name: destination + type: group + fields: + - name: hostname + type: keyword + - name: ip + type: keyword + - name: mac + type: keyword + - name: name + type: keyword + - name: host + type: group + fields: + - name: biossn + type: keyword + - name: domain + type: keyword + - name: hardware + type: group + fields: + - name: bios.name + type: keyword + - name: bios.version + type: keyword + - name: cpu.caption + type: keyword + - name: manufacturer + type: keyword + - name: owner + type: keyword + - name: serial_number + type: keyword + - name: hostname + type: keyword + - name: id + type: keyword + - name: ip + type: keyword + - name: ipv4 + type: keyword + - name: ipv6 + type: keyword + - name: mac + type: keyword + - name: oem.manufacturer + type: keyword + - name: oem.model + type: keyword + - name: os + type: group + fields: + - name: build + type: keyword + - name: description + type: keyword + - name: family + type: keyword + - name: name + type: keyword + - name: organization + type: keyword + - name: version + type: keyword + - name: type + type: keyword + - name: uptime + type: long + - name: workgroup + type: keyword + - name: network + type: group + fields: + - name: direction + type: keyword + - name: interface + type: keyword + - name: state + type: keyword + - name: type + type: keyword + - name: script + type: group + fields: + - name: current_duration + type: keyword + - name: current_time + type: keyword + - name: name + type: keyword + - name: start + type: keyword + - name: type + type: keyword + - name: version + type: keyword diff --git a/packages/tychon/elasticsearch/transform/arp/manifest.yml b/packages/tychon/elasticsearch/transform/arp/manifest.yml new file mode 100644 index 00000000000..d2b4a81ca3c --- /dev/null +++ b/packages/tychon/elasticsearch/transform/arp/manifest.yml @@ -0,0 +1,12 @@ +start: true +destination_index_template: + mappings: + dynamic: true + _meta: {} + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon/elasticsearch/transform/arp/transform.yml b/packages/tychon/elasticsearch/transform/arp/transform.yml new file mode 100644 index 00000000000..f67a6a29fb6 --- /dev/null +++ b/packages/tychon/elasticsearch/transform/arp/transform.yml @@ -0,0 +1,19 @@ +source: + index: + - logs-tychon.tychon_arp-* +dest: + index: tychon_arp +frequency: 1h +sync: + time: + field: 'event.ingested' + delay: 60s +latest: + unique_key: + - id + sort: '@timestamp' +_meta: + fleet_transform_version: 1.0.3 + run_as_kibana_system: false + managed: true +description: This transformation ensures there is a running configuration of what ARP tables look like on an endpoint from TYCHON. diff --git a/packages/tychon/img/TYCHONScreenShot_1.png b/packages/tychon/img/TYCHONScreenShot_1.png new file mode 100644 index 00000000000..cdd181eb9c2 Binary files /dev/null and b/packages/tychon/img/TYCHONScreenShot_1.png differ diff --git a/packages/tychon/img/TYCHONScreenShot_2.png b/packages/tychon/img/TYCHONScreenShot_2.png new file mode 100644 index 00000000000..dcf2f73ae6d Binary files /dev/null and b/packages/tychon/img/TYCHONScreenShot_2.png differ diff --git a/packages/tychon/img/TychonLogo.svg b/packages/tychon/img/TychonLogo.svg new file mode 100644 index 00000000000..de6b8989cda --- /dev/null +++ b/packages/tychon/img/TychonLogo.svg @@ -0,0 +1,59 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/packages/tychon/img/TychonScreenshot.png b/packages/tychon/img/TychonScreenshot.png new file mode 100644 index 00000000000..9207bbeac58 Binary files /dev/null and b/packages/tychon/img/TychonScreenshot.png differ diff --git a/packages/tychon/img/tychon-color.png b/packages/tychon/img/tychon-color.png new file mode 100644 index 00000000000..0e2c6d9f1d5 Binary files /dev/null and b/packages/tychon/img/tychon-color.png differ diff --git a/packages/tychon/manifest.yml b/packages/tychon/manifest.yml new file mode 100644 index 00000000000..3b86540b031 --- /dev/null +++ b/packages/tychon/manifest.yml @@ -0,0 +1,43 @@ +format_version: 2.0.0 +name: tychon +release: beta +title: "TYCHON Agentless" +version: 0.0.1 +source: + license: "Elastic-2.0" +description: TYCHON Agentless delivers STIG, CVE/IAVA, and Endpoint Protection status without adding new server infrastructure or services to your endpoints. TYCHON datasets fully comply with vulnerability and STIG reporting standards and integrate into Comply-to-Connect for instant zero trust value. +type: integration +categories: + - config_management + - vulnerability_management +conditions: + kibana.version: "^8.8.0" + elastic.subscription: "basic" +screenshots: + - src: /img/TychonScreenshot.png + title: Tychon Vulnerabilities + size: 600x600 + type: image/png + - src: /img/TYCHONScreenShot_1.png + title: Tychon Host Information + size: 600x600 + type: image/png + - src: /img/TYCHONScreenShot_2.png + title: Endpoint Protection + size: 600x600 + type: image/png +icons: + - src: /img/TychonLogo.svg + title: Sample logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: tychon + title: Tychon + description: Tychon + inputs: + - type: filestream + title: Tychon + description: Tychon +owner: + github: elastic/security-external-integrations