carbon_black_cloud: fix mapping for process lineage #11686
Conversation
efd6
added
Integration:carbon_black_cloud
efd6
force-pushed
the
11653-carbon_black_cloud
branch
2 times, most recently
from
d1a80b4
to
fa852d3
Compare
efd6
force-pushed
the
11653-carbon_black_cloud
branch
from
fa852d3
to
34060e7
Compare
💚 Build Succeeded
History
cc @efd6 |
|
There was a problem hiding this comment.
Hi @efd6 , thanks for putting this together so quickly. Left a couple of comments based on my understanding of ECS+CBC.
| @@ -252,19 +252,19 @@ processors: | |||
| ignore_missing: true | |||
| - rename: | |||
| field: json.process_cmdline | |||
| target_field: process.command_line | |||
| target_field: process.parent.command_line | |||
There was a problem hiding this comment.
For this and all of the subsequent renames, the remapping is only necessary for procstart event type events. In all of the other event types, the event mapping is correct. Could you make the remapping conditional for each based on the json.type?
I'm not sure if it can be optimized, but similar to:
- rename:
field: json.process_cmdline
target_field: process.command_line
ignore_missing: true
if: ctx.json?.type? == 'endpoint.event.procstart'
- rename:
field: json.process_cmdline
target_field: process.parent.command_line
ignore_missing: true
if: ctx.json?.type? != 'endpoint.event.procstart'
There was a problem hiding this comment.
Oh, I missed that subtlety. I'm not convinced that this change carries it's weight then. I will discuss internally.
| @@ -652,15 +678,15 @@ processors: | |||
| # Mapping for endpoint.event.procstart event type | |||
| - rename: | |||
| field: json.childproc_guid | |||
| target_field: carbon_black_cloud.endpoint_event.childproc.guid | |||
| target_field: carbon_black_cloud.endpoint_event.process.guid | |||
There was a problem hiding this comment.
This one should go to process.entity_id
| ignore_missing: true | ||
| - rename: | ||
| field: json.childproc_username | ||
| target_field: carbon_black_cloud.endpoint_event.childproc.username | ||
| target_field: carbon_black_cloud.endpoint_event.process.username |
There was a problem hiding this comment.
I believe that this one can instead go to process.user.name
Proposed commit message
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots