From 15e50d76797d5ec2cd5c48a7815cffc5d8a5bde8 Mon Sep 17 00:00:00 2001 From: hadadata59 <85754157+hadadata59@users.noreply.github.com> Date: Fri, 19 Aug 2022 13:11:43 -0400 Subject: [PATCH 01/14] Create 0033-host-fields.md --- rfcs/text/0033-host-fields.md | 312 ++++++++++++++++++++++++++++++++++ 1 file changed, 312 insertions(+) create mode 100644 rfcs/text/0033-host-fields.md diff --git a/rfcs/text/0033-host-fields.md b/rfcs/text/0033-host-fields.md new file mode 100644 index 0000000000..30dcf6459f --- /dev/null +++ b/rfcs/text/0033-host-fields.md @@ -0,0 +1,312 @@ +# 0000: Host Fields + + +- Stage: **0 (strawperson)** +- Date: **8-12-2022** + + + + + The host fields describe information about the host that is relevant to an event and extends the ECS host field set in several ways: + +- The host field set supports additional host bios fields. +- The host field set supports additional host cpu fields. +- The host field set supports additional fields describing a supplemental details that the host can generate. + + + +## Fields +
Definitions +

+ + +Field Name | Special Instructions | Justification/Use Case +| :--: | :-- | :-- | +| memory | The numeric value is a base value for memory. The two character unit type represents a multiplication factor to determine actual memory.

Normalize to byte value by multiplying base value by unit type as follows
Unit Multiplication Factor
B (2^0) 1
KB (2^10) 1024
MB (2^20) 1,048,576
GB (2^30) 1,073,741,824
TB (2^40) 1,099,511,627,776
| Detects specific baselines of physical configuration for asset management. +| last_logon.time | N/A | Login time tells the last time a user logged into the system, which may provide insights into events occurring on that system.| +| created | N/A | Indicates that device is known to domain.| +| distinguished_name | N/A | The distinguished name indicates ownership of the host. It uniquely identifies the host in an x509 certificate.| +| modified | N/A | Indicates when information has changed for the host in a directory service.| +| bios.manufacturer | Normalization: lower case | This is a string representing the system manufacturer of the host. Useful for supply chain issue detection.| +| bios.release_date | This date will need to be converted to a ECS date format. | The bios release date. Useful for supply chain issue detection.| +| bios.secure_boot_enabled | If disabled set to false; if enabled set to true. | Used to detect misconfiguration in Secure Boot.| +| bios.uuid | N/A | A unique identifier assigned to the computer mother board.| +| bios.version | N/A | Version of the BIOS, this string is created by the BIOS manufacturer. Useful for supply chain issue detection.| +| cpu.architecture | Normalize these entries to the following format:
:
"x64: x64-based PC"
"x64: x86_64"
"x32: x86-based PC" | Detects out of date CPUs.| +| cpu.core.count | N/A | Detects specific baselines of physical configuration for asset management.| +| cpu.count | N/A | Detects specific baselines of physical configuration for asset management.| +| cpu.logical_processor.count | N/A | Detects specific baselines of physical configuration for asset management.| +| cpu.manufacturer | Note that a manufacturer is displayed for each CPU, select the first. Multiple manufacturers are not expected. | Useful for supply chain issue detection.| +| cpu.name | Normalize raw field into lowercase format for easier query | Useful for supply chain issue detection.| +| cpu.speed | Normalize to GHZ, do not round but use 0.28 etc, where required.| Detects specific baselines of physical configuration for asset management.| +

+
+ + - name: memory + level: custom + type: unsigned long + example: 17,179,869,184 + description: > + Physical memory of the host machine in bytes. + + - name: last_logon.time + level: custom + type: date + description: > + The time of the last user logon to the host. The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. + + - name: created + level: custom + type: date + description: > + Date and time of when the device was registered in the domain. + + - name: distinguished_name + level: custom + type: keyword + example: CN=foo, CN=computers, DC=acme, DC=company, DC=edu + normalized: array + description: > + Distinguished name of the host. + + - name: modified + level: custom + type: date + description: > + Date the host's details were last modified. + + - name: bios.manufacturer + level: custom + type: keyword + example: dell inc. + description: > + This is a string representing the system manufacturer of the host. + + - name: bios.release_date + level: custom + type: date + description: > + The bios release date. + + - name: bios.secure_boot_enabled + level: custom + type: boolean + description: > + Indicator that Secure Boot is enabled on the computer. + + - name: bios.uuid + level: custom + type: keyword + example: 4C4C4544-0056-5010-805A-CAC04F475132 + description: > + A unique identifier assigned to the computer mother board. + + - name: bios.version + level: custom + type: keyword + example: 1.6.13 + description: > + Version of the BIOS. This string is created by the BIOS manufacturer. + + - name: cpu.architecture + level: custom + type: keyword + example: "x64: x86_64" + description: > + The CPU architecture and raw string of the CPU provided by the OS. + + - name: cpu.core.count + level: custom + type: integer + example: 10 + description: > + Number of physical cores per CPU on host machine. + + - name: cpu.count + level: custom + type: integer + example: 2 + description: > + Number of CPUs on host machine. + + - name: cpu.logical_processor.count + level: custom + type: integer + example: 40 + description: > + Number of logical processors per CPU on host machine (physical cores multiplied by threads per core). + + - name: cpu.manufacturer + level: custom + type: keyword + example: Intel + description: > + Manufacturer of CPU. + + - name: cpu.name + level: custom + type: keyword + example: intel(r) core(tm) i3-2370m cpu + description: > + The full name of the cpu model. + + - name: cpu.speed + level: custom + type: float + example: 2.21 + description: > + Float type defining the speed of the CPU in GHZ with null and blank values stored as -1.0 and -2.0 respectively. + + + +## Usage + + + ### `memory` + Detects specific baselines of physical configuration for asset management. + + ### `last_logon.time` + Login time tells the last time a user logged into the system, which may provide insights into events occurring on that system. + + ### `created` + Indicates that device is known to domain. + + ### `distinguished_name` + The distinguished name indicates ownership of the host. It uniquely identifies the host in an x509 certificate. + + ### `modified` + Indicates when information has changed for the host in a directory service. + + ### `bios.manufacturer` + This is a string representing the system manufacturer of the host. Useful for supply chain issue detection. + + ### `bios.release_date` + The bios release date. Useful for supply chain issue detection. + + ### `bios.secure_boot_enabled` + Used to detect misconfiguration in Secure Boot. + + ### `bios.uuid` + A unique identifier assigned to the computer mother board. + + ### `bios.version` + Version of the BIOS, this string is created by the BIOS manufacturer. Useful for supply chain issue detection. + + ### `cpu.architecture` + Detects out of date CPUs. + + ### `cpu.core.count`, `cpu.count`, `cpu.logical_processor.count` + Detects specific baselines of physical configuration for asset management. + + ### `cpu.manufacturer`, `cpu.name` + Useful for supply chain issue detection. + + ### `cpu.speed` + Detects specific baselines of physical configuration for asset management. + +## Source data + + +The host fields in this RFC are sourced from the following data feeds: + - Endpoint Detection and Response System Audit Logs & Alerts + - Office 365 Device Audit Logs + - Active Directory Computer Objects + - Windows Event Logs + + + Host & Network Interface Information collects information about host computer configurations, vulnerabilities and compliance from endpoint computers. + + Azure Active Directory (Azure AD) tracks user activity and creates reports that help you understand how your users access and use Azure AD services. The Microsoft Graph API for Azure AD provides a means to access data in the activity reports. + + Active Directory (AD) stores information about objects on the network and makes this information available for administrators and users. AD uses a structured data store as the basis for a logical, hierarchical organization of directory information. This data store, also known as the directory, contains information about AD objects. These objects typically include shared resources such as Users, Computers, Groups, Organizational Units, etc. + + Host Information collects configuration and compliance data from endpoint computers. + + + + + + +## Scope of impact + + + * Ingestion mechanisms + - Custom + * Usage mechanisms (e.g. Kibana applications, detections) + - Kibana + - Custom applications + +## Concerns + + +The term manufacturer is used here while in Elastic Common Schema the appropriate equivalent could be viewed as vendor which may lead to confusion. + + + + +## People + +The following are the people that consulted on the contents of this RFC. + +* @donneesdata | Author, Sponsor + + + + +## References + + + +### RFC Pull Requests + + + +* Stage 0: https://github.com/elastic/ecs/pull/NNN + + From a5ac9ba1f9206cf01b5561f38d01e4c89411b7c4 Mon Sep 17 00:00:00 2001 From: hadadata59 <85754157+hadadata59@users.noreply.github.com> Date: Wed, 31 Aug 2022 15:53:26 -0400 Subject: [PATCH 02/14] 0036-software-fields.md --- rfcs/text/0036-software-fields.md | 312 ++++++++++++++++++++++++++++++ 1 file changed, 312 insertions(+) create mode 100644 rfcs/text/0036-software-fields.md diff --git a/rfcs/text/0036-software-fields.md b/rfcs/text/0036-software-fields.md new file mode 100644 index 0000000000..7812b8af9f --- /dev/null +++ b/rfcs/text/0036-software-fields.md @@ -0,0 +1,312 @@ +# 0000: Software Fields + + +- Stage: **0 (strawperson)** +- Date: **8-12-2022** + + + + + The host fields describe information about the host that is relevant to an event and extends the ECS host field set in several ways: + +- The host field set supports additional host bios fields. +- The host field set supports additional host cpu fields. +- The host field set supports additional fields describing a supplemental details that the host can generate. + + + +## Fields +
Definitions +

+ + +Field Name | Special Instructions | Justification/Use Case +| :--: | :-- | :-- | +| memory | The numeric value is a base value for memory. The two character unit type represents a multiplication factor to determine actual memory.

Normalize to byte value by multiplying base value by unit type as follows
Unit Multiplication Factor
B (2^0) 1
KB (2^10) 1024
MB (2^20) 1,048,576
GB (2^30) 1,073,741,824
TB (2^40) 1,099,511,627,776
| Detects specific baselines of physical configuration for asset management. +| last_logon.time | N/A | Login time tells the last time a user logged into the system, which may provide insights into events occurring on that system.| +| created | N/A | Indicates that device is known to domain.| +| distinguished_name | N/A | The distinguished name indicates ownership of the host. It uniquely identifies the host in an x509 certificate.| +| modified | N/A | Indicates when information has changed for the host in a directory service.| +| bios.manufacturer | Normalization: lower case | This is a string representing the system manufacturer of the host. Useful for supply chain issue detection.| +| bios.release_date | This date will need to be converted to a ECS date format. | The bios release date. Useful for supply chain issue detection.| +| bios.secure_boot_enabled | If disabled set to false; if enabled set to true. | Used to detect misconfiguration in Secure Boot.| +| bios.uuid | N/A | A unique identifier assigned to the computer mother board.| +| bios.version | N/A | Version of the BIOS, this string is created by the BIOS manufacturer. Useful for supply chain issue detection.| +| cpu.architecture | Normalize these entries to the following format:
:
"x64: x64-based PC"
"x64: x86_64"
"x32: x86-based PC" | Detects out of date CPUs.| +| cpu.core.count | N/A | Detects specific baselines of physical configuration for asset management.| +| cpu.count | N/A | Detects specific baselines of physical configuration for asset management.| +| cpu.logical_processor.count | N/A | Detects specific baselines of physical configuration for asset management.| +| cpu.manufacturer | Note that a manufacturer is displayed for each CPU, select the first. Multiple manufacturers are not expected. | Useful for supply chain issue detection.| +| cpu.name | Normalize raw field into lowercase format for easier query | Useful for supply chain issue detection.| +| cpu.speed | Normalize to GHZ, do not round but use 0.28 etc, where required.| Detects specific baselines of physical configuration for asset management.| +

+
+ + - name: memory + level: custom + type: unsigned long + example: 17,179,869,184 + description: > + Physical memory of the host machine in bytes. + + - name: last_logon.time + level: custom + type: date + description: > + The time of the last user logon to the host. The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. + + - name: created + level: custom + type: date + description: > + Date and time of when the device was registered in the domain. + + - name: distinguished_name + level: custom + type: keyword + example: CN=foo, CN=computers, DC=acme, DC=company, DC=edu + normalized: array + description: > + Distinguished name of the host. + + - name: modified + level: custom + type: date + description: > + Date the host's details were last modified. + + - name: bios.manufacturer + level: custom + type: keyword + example: dell inc. + description: > + This is a string representing the system manufacturer of the host. + + - name: bios.release_date + level: custom + type: date + description: > + The bios release date. + + - name: bios.secure_boot_enabled + level: custom + type: boolean + description: > + Indicator that Secure Boot is enabled on the computer. + + - name: bios.uuid + level: custom + type: keyword + example: 4C4C4544-0056-5010-805A-CAC04F475132 + description: > + A unique identifier assigned to the computer mother board. + + - name: bios.version + level: custom + type: keyword + example: 1.6.13 + description: > + Version of the BIOS. This string is created by the BIOS manufacturer. + + - name: cpu.architecture + level: custom + type: keyword + example: "x64: x86_64" + description: > + The CPU architecture and raw string of the CPU provided by the OS. + + - name: cpu.core.count + level: custom + type: integer + example: 10 + description: > + Number of physical cores per CPU on host machine. + + - name: cpu.count + level: custom + type: integer + example: 2 + description: > + Number of CPUs on host machine. + + - name: cpu.logical_processor.count + level: custom + type: integer + example: 40 + description: > + Number of logical processors per CPU on host machine (physical cores multiplied by threads per core). + + - name: cpu.manufacturer + level: custom + type: keyword + example: Intel + description: > + Manufacturer of CPU. + + - name: cpu.name + level: custom + type: keyword + example: intel(r) core(tm) i3-2370m cpu + description: > + The full name of the cpu model. + + - name: cpu.speed + level: custom + type: float + example: 2.21 + description: > + Float type defining the speed of the CPU in GHZ with null and blank values stored as -1.0 and -2.0 respectively. + + + +## Usage + + + ### `memory` + Detects specific baselines of physical configuration for asset management. + + ### `last_logon.time` + Login time tells the last time a user logged into the system, which may provide insights into events occurring on that system. + + ### `created` + Indicates that device is known to domain. + + ### `distinguished_name` + The distinguished name indicates ownership of the host. It uniquely identifies the host in an x509 certificate. + + ### `modified` + Indicates when information has changed for the host in a directory service. + + ### `bios.manufacturer` + This is a string representing the system manufacturer of the host. Useful for supply chain issue detection. + + ### `bios.release_date` + The bios release date. Useful for supply chain issue detection. + + ### `bios.secure_boot_enabled` + Used to detect misconfiguration in Secure Boot. + + ### `bios.uuid` + A unique identifier assigned to the computer mother board. + + ### `bios.version` + Version of the BIOS, this string is created by the BIOS manufacturer. Useful for supply chain issue detection. + + ### `cpu.architecture` + Detects out of date CPUs. + + ### `cpu.core.count`, `cpu.count`, `cpu.logical_processor.count` + Detects specific baselines of physical configuration for asset management. + + ### `cpu.manufacturer`, `cpu.name` + Useful for supply chain issue detection. + + ### `cpu.speed` + Detects specific baselines of physical configuration for asset management. + +## Source data + + +The host fields in this RFC are sourced from the following data feeds: + - Endpoint Detection and Response System Audit Logs & Alerts + - Office 365 Device Audit Logs + - Active Directory Computer Objects + - Windows Event Logs + + + Host & Network Interface Information collects information about host computer configurations, vulnerabilities and compliance from endpoint computers. + + Azure Active Directory (Azure AD) tracks user activity and creates reports that help you understand how your users access and use Azure AD services. The Microsoft Graph API for Azure AD provides a means to access data in the activity reports. + + Active Directory (AD) stores information about objects on the network and makes this information available for administrators and users. AD uses a structured data store as the basis for a logical, hierarchical organization of directory information. This data store, also known as the directory, contains information about AD objects. These objects typically include shared resources such as Users, Computers, Groups, Organizational Units, etc. + + Host Information collects configuration and compliance data from endpoint computers. + + + + + + +## Scope of impact + + + * Ingestion mechanisms + - Custom + * Usage mechanisms (e.g. Kibana applications, detections) + - Kibana + - Custom applications + +## Concerns + + +The term manufacturer is used here while in Elastic Common Schema the appropriate equivalent could be viewed as vendor which may lead to confusion. + + + + +## People + +The following are the people that consulted on the contents of this RFC. + +* @donneesdata | Author, Sponsor + + + + +## References + + + +### RFC Pull Requests + + + +* Stage 0: https://github.com/elastic/ecs/pull/NNN + + From 85fc9f312c97cba3961b02dc1bdc451d8ea22b95 Mon Sep 17 00:00:00 2001 From: hadadata59 <85754157+hadadata59@users.noreply.github.com> Date: Thu, 1 Sep 2022 12:45:43 -0400 Subject: [PATCH 03/14] Update 0036-software-fields.md --- rfcs/text/0036-software-fields.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/rfcs/text/0036-software-fields.md b/rfcs/text/0036-software-fields.md index 7812b8af9f..55165cde8d 100644 --- a/rfcs/text/0036-software-fields.md +++ b/rfcs/text/0036-software-fields.md @@ -53,12 +53,13 @@ Field Name | Special Instructions | Justification/Use Case

- - name: memory + - name: cpe level: custom - type: unsigned long - example: 17,179,869,184 + type: keyword + normalization: array + example: ["cpe:/o:microsoft:windows", "cpe:/a:adobe:acrobat"] description: > - Physical memory of the host machine in bytes. + Software identified by its common platform enumeration (CPE) value. - name: last_logon.time level: custom From a01b25343f5361f2fa4a52aacc5369723985d8eb Mon Sep 17 00:00:00 2001 From: hadadata59 <85754157+hadadata59@users.noreply.github.com> Date: Thu, 1 Sep 2022 16:09:54 -0400 Subject: [PATCH 04/14] Update 0036-software-fields.md --- rfcs/text/0036-software-fields.md | 109 ++++++++++++++---------------- 1 file changed, 49 insertions(+), 60 deletions(-) diff --git a/rfcs/text/0036-software-fields.md b/rfcs/text/0036-software-fields.md index 55165cde8d..74fa585dcc 100644 --- a/rfcs/text/0036-software-fields.md +++ b/rfcs/text/0036-software-fields.md @@ -33,7 +33,7 @@ Stage 1: Describe at a high level how this change affects fields. Include new or --> Field Name | Special Instructions | Justification/Use Case | :--: | :-- | :-- | -| memory | The numeric value is a base value for memory. The two character unit type represents a multiplication factor to determine actual memory.

Normalize to byte value by multiplying base value by unit type as follows
Unit Multiplication Factor
B (2^0) 1
KB (2^10) 1024
MB (2^20) 1,048,576
GB (2^30) 1,073,741,824
TB (2^40) 1,099,511,627,776
| Detects specific baselines of physical configuration for asset management. +| cpe | N/A | Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets.

IT management tools can collect information about installed products, identifying these products using their CPE names, and then use this standardized information to help make fully or partially automated decisions regarding the assets. For example, identifying the presence of XYZ Visualizer Enterprise Suite could trigger a vulnerability management tool to check the system for known vulnerabilities in the software, and also trigger a configuration management tool to verify that the software is configured securely in accordance with the organization's policies. | last_logon.time | N/A | Login time tells the last time a user logged into the system, which may provide insights into events occurring on that system.| | created | N/A | Indicates that device is known to domain.| | distinguished_name | N/A | The distinguished name indicates ownership of the host. It uniquely identifies the host in an x509 certificate.| @@ -61,113 +61,102 @@ Field Name | Special Instructions | Justification/Use Case description: > Software identified by its common platform enumeration (CPE) value. - - name: last_logon.time + - name: name level: custom - type: date + type: keyword + example: skype description: > - The time of the last user logon to the host. The timestamp type represents date and time information using ISO 8601 format and is always in UTC time. + The name of the software. - - name: created + - name: modules.name level: custom - type: date + type: keyword + example: Anti-spyware protection description: > - Date and time of when the device was registered in the domain. + Module name. - - name: distinguished_name + - name: version level: custom type: keyword - example: CN=foo, CN=computers, DC=acme, DC=company, DC=edu - normalized: array + example: 27/1.0.0.2021090243 description: > - Distinguished name of the host. + The software version. - - name: modified + - name: add_on.name level: custom - type: date + type: keyword + example: Wiki description: > - Date the host's details were last modified. + The name of the software add-on/extension that generated the event. - - name: bios.manufacturer + - name: add_on.type level: custom type: keyword - example: dell inc. + example: Bot description: > - This is a string representing the system manufacturer of the host. + The type of the software add-on/extension that generated the event. - - name: bios.release_date + - name: add_on.url.full level: custom - type: date + type: keyword + example: https://example.com/download/my_add_on description: > - The bios release date. + Software installed on the host identified common platform enumeration (CPE) value. - - name: bios.secure_boot_enabled + - name: family level: custom - type: boolean + type: keyword + example: TVD description: > - Indicator that Secure Boot is enabled on the computer. + A vendor provided categorization of the software. - - name: bios.uuid + - name: vendor level: custom type: keyword - example: 4C4C4544-0056-5010-805A-CAC04F475132 + example: google description: > - A unique identifier assigned to the computer mother board. + The vendor or provider of the software. - - name: bios.version + - name: type level: custom type: keyword - example: 1.6.13 + example: exe description: > - Version of the BIOS. This string is created by the BIOS manufacturer. + Software type. - - name: cpu.architecture + - name: state level: custom type: keyword - example: "x64: x86_64" + example: running description: > - The CPU architecture and raw string of the CPU provided by the OS. + Current state of the software. - - name: cpu.core.count + - name: patch.kb level: custom - type: integer - example: 10 - description: > - Number of physical cores per CPU on host machine. - - - name: cpu.count - level: custom - type: integer - example: 2 + type: keyword + example: KB4538461 description: > - Number of CPUs on host machine. + Software patch ID. - - name: cpu.logical_processor.count + - name: install.time level: custom - type: integer - example: 40 + type: date description: > - Number of logical processors per CPU on host machine (physical cores multiplied by threads per core). + Time the software was installed. - - name: cpu.manufacturer + - name: locale level: custom type: keyword - example: Intel + example: Hungarian description: > - Manufacturer of CPU. + The human language used in the application intended for the user to read. - - name: cpu.name + - name: patch.name level: custom type: keyword - example: intel(r) core(tm) i3-2370m cpu - description: > - The full name of the cpu model. - - - name: cpu.speed - level: custom - type: float - example: 2.21 + example: Microsoft.MicrosoftEdge.Stable.97.0.1072.55_neutral_8wekyb3d8bbwe description: > - Float type defining the speed of the CPU in GHZ with null and blank values stored as -1.0 and -2.0 respectively. + The software patch package's full name. - ### `memory` - Detects specific baselines of physical configuration for asset management. + ### `cpe` + Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets. + +IT management tools can collect information about installed products, identifying these products using their CPE names, and then use this standardized information to help make fully or partially automated decisions regarding the assets. For example, identifying the presence of XYZ Visualizer Enterprise Suite could trigger a vulnerability management tool to check the system for known vulnerabilities in the software, and also trigger a configuration management tool to verify that the software is configured securely in accordance with the organization's policies. - ### `last_logon.time` - Login time tells the last time a user logged into the system, which may provide insights into events occurring on that system. + ### `name` + Name of software often useful to cross reference other data sources. - ### `created` - Indicates that device is known to domain. + ### `modules.name` + A module usually represents an application, a language stack, or any other logical collection of packages. Module name should represent the name of the software it ships. - ### `distinguished_name` - The distinguished name indicates ownership of the host. It uniquely identifies the host in an x509 certificate. + ### `version`, `install.time` + Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities. - ### `modified` - Indicates when information has changed for the host in a directory service. + ### `add_on.name`, `add_on.type`, `add_on.url.full` + Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. - ### `bios.manufacturer` - This is a string representing the system manufacturer of the host. Useful for supply chain issue detection. + The type field provides a means of understanding and correlation of events to types. - ### `bios.release_date` - The bios release date. Useful for supply chain issue detection. + The url field provides a means of understanding and correlation of events to the location where the add_on can be download from. - ### `bios.secure_boot_enabled` - Used to detect misconfiguration in Secure Boot. + ### `family` + Software product families have gained much important from the increased usage of software in consumer products. “A software product family is commonly defined to consist of a common architecture, a set of reusable assets used in systematically producing individual products, and the set of products thus produced”. One software product family normally has a very large number of products. The definition indicates that software components are reused on a common architecture because the products belonging to one family have a lot of common features and build upon a common architecture. - ### `bios.uuid` - A unique identifier assigned to the computer mother board. + ### `vendor` + Software vendors can develop a wide range of consumer and business applications for a variety of devices, from computers and tablets, to mobile phones, to automobiles, manufacturing equipment, and more. The applications developed by software vendors can be deployed on premise or, increasingly, are cloud based and can be accessed via the Internet. - ### `bios.version` - Version of the BIOS, this string is created by the BIOS manufacturer. Useful for supply chain issue detection. + ### `type` + Software packages are complete pieces of software that can work on their own, without additions or other necessary parts. Computer software packages control the physical parts of the machine so that these parts know how to work together. Other names for software are apps, programs, applications, program modules, procedures, scripts and source code. Computer software is adapted to the properties of the hardware. What works on one type of computer will not necessarily work on another. Some types of software are installed when a computer is built and are necessary for the computer to function. Other software packages can be purchased separately or downloaded from the Internet and added to the computer at any time. - ### `cpu.architecture` - Detects out of date CPUs. + ### `state` + Software state is information your program manipulates to accomplish some task. It is data or information that gets changed or manipulated throughout the runtime of a program. The "state" of a program at a given time refers to a snapshot of all the data the program is currently looking at or analyzing to get to the next step in it's execution. - ### `cpu.core.count`, `cpu.count`, `cpu.logical_processor.count` - Detects specific baselines of physical configuration for asset management. + ### `patch.kb` + Proper patch management can greatly improve an enterprise’s security by addressing the vulnerabilities in its software and operating systems. Keeping track of the patch ID allows for the administrator to ascertain any issues resulting from a specific patch update. - ### `cpu.manufacturer`, `cpu.name` - Useful for supply chain issue detection. + ### `locale` + Knowing the software.locale makes it easier to translate and understand any instructions associated with the application. - ### `cpu.speed` - Detects specific baselines of physical configuration for asset management. + ### `patch.name` + Good patch documentation including the software patch package's full name is important for letting the administrator easily identify and distinguish patches from each other. ## Source data From 7eab59048d95ffc23411167d5cd0186771d5027e Mon Sep 17 00:00:00 2001 From: hadadata59 <85754157+hadadata59@users.noreply.github.com> Date: Fri, 2 Sep 2022 11:53:19 -0400 Subject: [PATCH 07/14] Create 0037-user-fields.md --- rfcs/text/0037-user-fields.md | 300 ++++++++++++++++++++++++++++++++++ 1 file changed, 300 insertions(+) create mode 100644 rfcs/text/0037-user-fields.md diff --git a/rfcs/text/0037-user-fields.md b/rfcs/text/0037-user-fields.md new file mode 100644 index 0000000000..fea97e42ff --- /dev/null +++ b/rfcs/text/0037-user-fields.md @@ -0,0 +1,300 @@ +# 0000: Software Fields + + +- Stage: **0 (strawperson)** +- Date: **8-12-2022** + + + + + The host fields describe information about the host that is relevant to an event and extends the ECS host field set in several ways: + +- The host field set supports additional host bios fields. +- The host field set supports additional host cpu fields. +- The host field set supports additional fields describing a supplemental details that the host can generate. + + + +## Fields +
Definitions +

+ + +Field Name | Special Instructions | Justification/Use Case +| :--: | :-- | :-- | +| cpe | N/A | Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets.

IT management tools can collect information about installed products, identifying these products using their CPE names, and then use this standardized information to help make fully or partially automated decisions regarding the assets. For example, identifying the presence of XYZ Visualizer Enterprise Suite could trigger a vulnerability management tool to check the system for known vulnerabilities in the software, and also trigger a configuration management tool to verify that the software is configured securely in accordance with the organization's policies. +| name | N/A | Name of software often useful to cross reference other data sources.| +| modules.name | N/A | A module usually represents an application, a language stack, or any other logical collection of packages. Module name should represent the name of the software it ships.| +| version | N/A | Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities.| +| add_on.name | N/A | Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns.| +| add_on.type | Use the AddonType Look up table (https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#addontype) to transform Integer value to Member name. | Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. The type field provides a means of understanding and correlation of events to types. | +| add_on.url.full | N/A | Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. The url field provides a means of understanding and correlation of events to the location where the add_on can be download from.| +| family | N/A | Software product families have gained much important from the increased usage of software in consumer products. “A software product family is commonly defined to consist of a common architecture, a set of reusable assets used in systematically producing individual products, and the set of products thus produced”. One software product family normally has a very large number of products. The definition indicates that software components are reused on a common architecture because the products belonging to one family have a lot of common features and build upon a common architecture.| +| vendor | Normalize this field to lowercase. | Software vendors can develop a wide range of consumer and business applications for a variety of devices, from computers and tablets, to mobile phones, to automobiles, manufacturing equipment, and more. The applications developed by software vendors can be deployed on premise or, increasingly, are cloud based and can be accessed via the Internet.| +| type | Normalization rule: The value must be normalized to lower case. | Software packages are complete pieces of software that can work on their own, without additions or other necessary parts. Computer software packages control the physical parts of the machine so that these parts know how to work together. Other names for software are apps, programs, applications, program modules, procedures, scripts and source code. Computer software is adapted to the properties of the hardware. What works on one type of computer will not necessarily work on another. Some types of software are installed when a computer is built and are necessary for the computer to function. Other software packages can be purchased separately or downloaded from the Internet and added to the computer at any time.| +| state | N/A | Software state is information your program manipulates to accomplish some task. It is data or information that gets changed or manipulated throughout the runtime of a program. The "state" of a program at a given time refers to a snapshot of all the data the program is currently looking at or analyzing to get to the next step in it's execution.| +| patch.kb | Normalization rule: The value must be normalized to lower case. | Proper patch management can greatly improve an enterprise’s security by addressing the vulnerabilities in its software and operating systems. Keeping track of the patch ID allows for the administrator to ascertain any issues resulting from a specific patch update.| +| install.time | N/A | Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities.| +| locale | N/A | Knowing the software.locale makes it easier to translate and understand any instructions associated with the application.| +| patch.name | N/A | Good patch documentation including the software patch package's full name is important for letting the administrator easily identify and distinguish patches from each other.| +

+
+ + - name: cpe + level: custom + type: keyword + normalization: array + example: ["cpe:/o:microsoft:windows", "cpe:/a:adobe:acrobat"] + description: > + Software identified by its common platform enumeration (CPE) value. + + - name: name + level: custom + type: keyword + example: skype + description: > + The name of the software. + + - name: modules.name + level: custom + type: keyword + example: Anti-spyware protection + description: > + Module name. + + - name: version + level: custom + type: keyword + example: 27/1.0.0.2021090243 + description: > + The software version. + + - name: add_on.name + level: custom + type: keyword + example: Wiki + description: > + The name of the software add-on/extension that generated the event. + + - name: add_on.type + level: custom + type: keyword + example: Bot + description: > + The type of the software add-on/extension that generated the event. + + - name: add_on.url.full + level: custom + type: keyword + example: https://example.com/download/my_add_on + description: > + Software installed on the host identified common platform enumeration (CPE) value. + + - name: family + level: custom + type: keyword + example: TVD + description: > + A vendor provided categorization of the software. + + - name: vendor + level: custom + type: keyword + example: google + description: > + The vendor or provider of the software. + + - name: type + level: custom + type: keyword + example: exe + description: > + Software type. + + - name: state + level: custom + type: keyword + example: running + description: > + Current state of the software. + + - name: patch.kb + level: custom + type: keyword + example: KB4538461 + description: > + Software patch ID. + + - name: install.time + level: custom + type: date + description: > + Time the software was installed. + + - name: locale + level: custom + type: keyword + example: Hungarian + description: > + The human language used in the application intended for the user to read. + + - name: patch.name + level: custom + type: keyword + example: Microsoft.MicrosoftEdge.Stable.97.0.1072.55_neutral_8wekyb3d8bbwe + description: > + The software patch package's full name. + + + +## Usage + + + ### `cpe` + Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets. + +IT management tools can collect information about installed products, identifying these products using their CPE names, and then use this standardized information to help make fully or partially automated decisions regarding the assets. For example, identifying the presence of XYZ Visualizer Enterprise Suite could trigger a vulnerability management tool to check the system for known vulnerabilities in the software, and also trigger a configuration management tool to verify that the software is configured securely in accordance with the organization's policies. + + ### `name` + Name of software often useful to cross reference other data sources. + + ### `modules.name` + A module usually represents an application, a language stack, or any other logical collection of packages. Module name should represent the name of the software it ships. + + ### `version`, `install.time` + Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities. + + ### `add_on.name`, `add_on.type`, `add_on.url.full` + Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. + + The type field provides a means of understanding and correlation of events to types. + + The url field provides a means of understanding and correlation of events to the location where the add_on can be download from. + + ### `family` + Software product families have gained much important from the increased usage of software in consumer products. “A software product family is commonly defined to consist of a common architecture, a set of reusable assets used in systematically producing individual products, and the set of products thus produced”. One software product family normally has a very large number of products. The definition indicates that software components are reused on a common architecture because the products belonging to one family have a lot of common features and build upon a common architecture. + + ### `vendor` + Software vendors can develop a wide range of consumer and business applications for a variety of devices, from computers and tablets, to mobile phones, to automobiles, manufacturing equipment, and more. The applications developed by software vendors can be deployed on premise or, increasingly, are cloud based and can be accessed via the Internet. + + ### `type` + Software packages are complete pieces of software that can work on their own, without additions or other necessary parts. Computer software packages control the physical parts of the machine so that these parts know how to work together. Other names for software are apps, programs, applications, program modules, procedures, scripts and source code. Computer software is adapted to the properties of the hardware. What works on one type of computer will not necessarily work on another. Some types of software are installed when a computer is built and are necessary for the computer to function. Other software packages can be purchased separately or downloaded from the Internet and added to the computer at any time. + + ### `state` + Software state is information your program manipulates to accomplish some task. It is data or information that gets changed or manipulated throughout the runtime of a program. The "state" of a program at a given time refers to a snapshot of all the data the program is currently looking at or analyzing to get to the next step in it's execution. + + ### `patch.kb` + Proper patch management can greatly improve an enterprise’s security by addressing the vulnerabilities in its software and operating systems. Keeping track of the patch ID allows for the administrator to ascertain any issues resulting from a specific patch update. + + ### `locale` + Knowing the software.locale makes it easier to translate and understand any instructions associated with the application. + + ### `patch.name` + Good patch documentation including the software patch package's full name is important for letting the administrator easily identify and distinguish patches from each other. + +## Source data + + +The host fields in this RFC are sourced from the following data feeds: + - Endpoint Detection and Response System Audit Logs & Alerts + - Office 365 Device Audit Logs + - Active Directory Computer Objects + - Windows Event Logs + + + Host & Network Interface Information collects information about host computer configurations, vulnerabilities and compliance from endpoint computers. + + Azure Active Directory (Azure AD) tracks user activity and creates reports that help you understand how your users access and use Azure AD services. The Microsoft Graph API for Azure AD provides a means to access data in the activity reports. + + Active Directory (AD) stores information about objects on the network and makes this information available for administrators and users. AD uses a structured data store as the basis for a logical, hierarchical organization of directory information. This data store, also known as the directory, contains information about AD objects. These objects typically include shared resources such as Users, Computers, Groups, Organizational Units, etc. + + Host Information collects configuration and compliance data from endpoint computers. + + + + + + +## Scope of impact + + + * Ingestion mechanisms + - Custom + * Usage mechanisms (e.g. Kibana applications, detections) + - Kibana + - Custom applications + +## Concerns + + +The term manufacturer is used here while in Elastic Common Schema the appropriate equivalent could be viewed as vendor which may lead to confusion. + + + + +## People + +The following are the people that consulted on the contents of this RFC. + +* @donneesdata | Author, Sponsor + + + + +## References + + + +### RFC Pull Requests + + + +* Stage 0: https://github.com/elastic/ecs/pull/NNN + + From e7618617a899666675240ad16c9e5939ea072dbe Mon Sep 17 00:00:00 2001 From: hadadata59 <85754157+hadadata59@users.noreply.github.com> Date: Fri, 2 Sep 2022 12:08:11 -0400 Subject: [PATCH 08/14] Update 0037-user-fields.md --- rfcs/text/0037-user-fields.md | 75 ++++++++++++++++------------------- 1 file changed, 34 insertions(+), 41 deletions(-) diff --git a/rfcs/text/0037-user-fields.md b/rfcs/text/0037-user-fields.md index fea97e42ff..19aab26029 100644 --- a/rfcs/text/0037-user-fields.md +++ b/rfcs/text/0037-user-fields.md @@ -1,4 +1,4 @@ -# 0000: Software Fields +# 0000: User Fields - Stage: **0 (strawperson)** @@ -51,83 +51,76 @@ Field Name | Special Instructions | Justification/Use Case

- - name: cpe + - name: created level: custom - type: keyword - normalization: array - example: ["cpe:/o:microsoft:windows", "cpe:/a:adobe:acrobat"] + type: date description: > - Software identified by its common platform enumeration (CPE) value. + Date the user was created. - - name: name + - name: display_name level: custom type: keyword - example: skype + example: Smith, John description: > - The name of the software. + The identity's display name. Note that this may not always be available or up-to-date. This may be similar to user.full_name. Both fields may contain some representation of a user's account registered formal name. - - name: modules.name + - name: expires level: custom - type: keyword - example: Anti-spyware protection + type: date description: > - Module name. + The date when the account expires. - - name: version + - name: home.directory level: custom type: keyword - example: 27/1.0.0.2021090243 + example: /home/jsmith description: > - The software version. + The home directory for the account. - - name: add_on.name + - name: home.drive level: custom type: keyword - example: Wiki + example: T: description: > - The name of the software add-on/extension that generated the event. + On windows, the drive letter for the home directory of the account. On Linux/Unix the mount point of the home directory. - - name: add_on.type + - name: is_domain level: custom - type: keyword - example: Bot + type: boolean description: > - The type of the software add-on/extension that generated the event. + Whether the user is a domain user or a local user. - - name: add_on.url.full + - name: is_flagged level: custom - type: keyword - example: https://example.com/download/my_add_on + type: boolean description: > - Software installed on the host identified common platform enumeration (CPE) value. + The account is flagged for some suspicious activity. - - name: family + - name: locked_out level: custom - type: keyword - example: TVD + type: date description: > - A vendor provided categorization of the software. + The date and time that this account was locked out. - - name: vendor + - name: password.cleartext level: custom type: keyword - example: google + example: password description: > - The vendor or provider of the software. + The user password in clear text. - - name: type + - name: password.encrypted level: custom type: keyword - example: exe + example: c8fed00eb2e87f1cee8e90ebbe870c190ac3848c description: > - Software type. + The user password encrypted value. - - name: state + - name: password.last_set level: custom - type: keyword - example: running + type: date description: > - Current state of the software. + Date the password was last changed. - name: patch.kb level: custom From ab3da7fafdca2bcd1b825715dc53c6f445d29739 Mon Sep 17 00:00:00 2001 From: hadadata59 <85754157+hadadata59@users.noreply.github.com> Date: Tue, 6 Sep 2022 15:09:48 -0400 Subject: [PATCH 09/14] Update 0033-host-fields.md changed author name --- rfcs/text/0033-host-fields.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rfcs/text/0033-host-fields.md b/rfcs/text/0033-host-fields.md index 30dcf6459f..25c44bef04 100644 --- a/rfcs/text/0033-host-fields.md +++ b/rfcs/text/0033-host-fields.md @@ -281,7 +281,7 @@ Stage 3: Document resolutions for all existing concerns. Any new concerns should The following are the people that consulted on the contents of this RFC. -* @donneesdata | Author, Sponsor +* @hadadata59 | Author, Sponsor - The host fields describe information about the host that is relevant to an event and extends the ECS host field set in several ways: - -- The host field set supports additional host bios fields. -- The host field set supports additional host cpu fields. -- The host field set supports additional fields describing a supplemental details that the host can generate. + The software fields describe information about the software that is relevant to an event and creates an ECS software field set. With the addition of a software field set, ECS users will be able to normalize data related to software specific components. + @@ -217,6 +214,7 @@ The host fields in this RFC are sourced from the following data feeds: - Office 365 Device Audit Logs - Active Directory Computer Objects - Windows Event Logs + - Software Inventory Host & Network Interface Information collects information about host computer configurations, vulnerabilities and compliance from endpoint computers. @@ -256,7 +254,7 @@ The goal here is to research and understand the impact of these changes on users -The term manufacturer is used here while in Elastic Common Schema the appropriate equivalent could be viewed as vendor which may lead to confusion. +There are no current concerns regarding the software field set at this time. @@ -269,7 +267,7 @@ Stage 3: Document resolutions for all existing concerns. Any new concerns should The following are the people that consulted on the contents of this RFC. -* @donneesdata | Author, Sponsor +* @hadadata59 | Author, Sponsor - The host fields describe information about the host that is relevant to an event and extends the ECS host field set in several ways: +The User fields describe information about the user that is relevant to an event. -- The host field set supports additional host bios fields. -- The host field set supports additional host cpu fields. -- The host field set supports additional fields describing a supplemental details that the host can generate. +This RFC extends the ECS user field set in several ways: + +- The user field set supports additonal user identifier and name fields to maintain context for the identifier or name. +- It also defines an authentication field set nested under user.* to describe details of the users authentication attempt relevant to the event. +- Lastly, the user field set supports additional fields describing a users account status and account profile details. @@ -158,6 +160,13 @@ Stage 2: Add or update all remaining field definitions. The list should now be e +### General Use Cases: +- Find all events for a user with a specfic user principal name +- Find events where user authentication failed +- Extract detailed information about a user + +### Specific Use Cases: + ### `cpe` Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets. @@ -207,7 +216,7 @@ Stage 1: Provide a high-level description of example sources of data. This does --> The host fields in this RFC are sourced from the following data feeds: - Endpoint Detection and Response System Audit Logs & Alerts - - Office 365 Device Audit Logs + - Office 365 Signin Logs - Active Directory Computer Objects - Windows Event Logs @@ -249,7 +258,7 @@ The goal here is to research and understand the impact of these changes on users -The term manufacturer is used here while in Elastic Common Schema the appropriate equivalent could be viewed as vendor which may lead to confusion. +There are no current concerns regarding the user fields within this field set. @@ -262,7 +271,7 @@ Stage 3: Document resolutions for all existing concerns. Any new concerns should The following are the people that consulted on the contents of this RFC. -* @donneesdata | Author, Sponsor +* @hadadata59 | Author, Sponsor Field Name | Special Instructions | Justification/Use Case | :--: | :-- | :-- | -| cpe | N/A | Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets.

IT management tools can collect information about installed products, identifying these products using their CPE names, and then use this standardized information to help make fully or partially automated decisions regarding the assets. For example, identifying the presence of XYZ Visualizer Enterprise Suite could trigger a vulnerability management tool to check the system for known vulnerabilities in the software, and also trigger a configuration management tool to verify that the software is configured securely in accordance with the organization's policies. -| name | N/A | Name of software often useful to cross reference other data sources.| -| modules.name | N/A | A module usually represents an application, a language stack, or any other logical collection of packages. Module name should represent the name of the software it ships.| -| version | N/A | Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities.| -| add_on.name | N/A | Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns.| -| add_on.type | Use the AddonType Look up table (https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#addontype) to transform Integer value to Member name. | Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. The type field provides a means of understanding and correlation of events to types. | -| add_on.url.full | N/A | Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. The url field provides a means of understanding and correlation of events to the location where the add_on can be download from.| -| family | N/A | Software product families have gained much important from the increased usage of software in consumer products. “A software product family is commonly defined to consist of a common architecture, a set of reusable assets used in systematically producing individual products, and the set of products thus produced”. One software product family normally has a very large number of products. The definition indicates that software components are reused on a common architecture because the products belonging to one family have a lot of common features and build upon a common architecture.| -| vendor | Normalize this field to lowercase. | Software vendors can develop a wide range of consumer and business applications for a variety of devices, from computers and tablets, to mobile phones, to automobiles, manufacturing equipment, and more. The applications developed by software vendors can be deployed on premise or, increasingly, are cloud based and can be accessed via the Internet.| -| type | Normalization rule: The value must be normalized to lower case. | Software packages are complete pieces of software that can work on their own, without additions or other necessary parts. Computer software packages control the physical parts of the machine so that these parts know how to work together. Other names for software are apps, programs, applications, program modules, procedures, scripts and source code. Computer software is adapted to the properties of the hardware. What works on one type of computer will not necessarily work on another. Some types of software are installed when a computer is built and are necessary for the computer to function. Other software packages can be purchased separately or downloaded from the Internet and added to the computer at any time.| -| state | N/A | Software state is information your program manipulates to accomplish some task. It is data or information that gets changed or manipulated throughout the runtime of a program. The "state" of a program at a given time refers to a snapshot of all the data the program is currently looking at or analyzing to get to the next step in it's execution.| -| patch.kb | Normalization rule: The value must be normalized to lower case. | Proper patch management can greatly improve an enterprise’s security by addressing the vulnerabilities in its software and operating systems. Keeping track of the patch ID allows for the administrator to ascertain any issues resulting from a specific patch update.| -| install.time | N/A | Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities.| +| created | N/A | Date the user was created. +| display_name | N/A | This field may contain some representation of a user's account registered formal name.| +| expires | Convert raw value user.expires_raw to a ISO time value user.expires. | The date when the account expires. Knowing the date the account expires is helpful in setting reminders for users to request extended access or for the admin to keep track of accounts that need to be deleted upon expiration.| +| home.directory | N/A | A home directory provides a user with his own space in which to store personal files. More importantly, it prevents user files from taking up valuable space in the root directory, which is the top directory — and the one used by system administrators to quickly access important system files.| +| home.drive | N/A | On windows, the drive letter for the home directory of the account. On Linux/Unix the mount point of the home directory.| +| is_domain | N/A | A local user will have the account name prefixed with the machine name. A domain user's account name will be prefixed with its originating domain. If the machine name and the account prefix name don't match, or if the account name prefix matches the local machine, it's generally safe to assume its a local account.| +| is_flagged | N/A | The account is flagged for some suspicious activity.| +| locked_out | Convert raw value user.locked_out_raw to a ISO time value. | The date and time that this account was locked out.| +| password.cleartext | N/A | A clear text password (or Plaintext, or Plain-text) is a way of writing (and sending) a password in a clear, readable format. Such password is not encrypted and can be easily read by other humans and machines.| +| password.encrypted | N/A | Password encryption is essential to store user credentials stored in a database securely. Without password encryption, anyone accessing a user database on a company's servers (including hackers) could easily view any stored passwords.| +| password.last_set | N/A | Knowing the date the password was last changed is useful in regards to making sure corporate password policies are being adhered to.| +| password.expires | N/A | Knowing the date the password will expire is useful in regards to making sure corporate password policies are being adhered to.| +| password.expired | N/A | Knowing the date the password will expire is useful in regards to making sure corporate password policies are being adhered to.| +| sam_account_name | N/A | Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities.| | locale | N/A | Knowing the software.locale makes it easier to translate and understand any instructions associated with the application.| | patch.name | N/A | Good patch documentation including the software patch package's full name is important for letting the administrator easily identify and distinguish patches from each other.|

From b365059d184ca24d425051b35fcd3beb7ec5f4ba Mon Sep 17 00:00:00 2001 From: hadadata59 <85754157+hadadata59@users.noreply.github.com> Date: Fri, 14 Oct 2022 14:19:47 -0400 Subject: [PATCH 13/14] Delete 0036-software-fields.md --- rfcs/text/0036-software-fields.md | 298 ------------------------------ 1 file changed, 298 deletions(-) delete mode 100644 rfcs/text/0036-software-fields.md diff --git a/rfcs/text/0036-software-fields.md b/rfcs/text/0036-software-fields.md deleted file mode 100644 index 1a547f1359..0000000000 --- a/rfcs/text/0036-software-fields.md +++ /dev/null @@ -1,298 +0,0 @@ -# 0000: Software Fields - - -- Stage: **0 (strawperson)** -- Date: **8-12-2022** - - - - - The software fields describe information about the software that is relevant to an event and creates an ECS software field set. With the addition of a software field set, ECS users will be able to normalize data related to software specific components. - - - - -## Fields -
Definitions -

- - -Field Name | Special Instructions | Justification/Use Case -| :--: | :-- | :-- | -| cpe | N/A | Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets.

IT management tools can collect information about installed products, identifying these products using their CPE names, and then use this standardized information to help make fully or partially automated decisions regarding the assets. For example, identifying the presence of XYZ Visualizer Enterprise Suite could trigger a vulnerability management tool to check the system for known vulnerabilities in the software, and also trigger a configuration management tool to verify that the software is configured securely in accordance with the organization's policies. -| name | N/A | Name of software often useful to cross reference other data sources.| -| modules.name | N/A | A module usually represents an application, a language stack, or any other logical collection of packages. Module name should represent the name of the software it ships.| -| version | N/A | Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities.| -| add_on.name | N/A | Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns.| -| add_on.type | Use the AddonType Look up table (https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#addontype) to transform Integer value to Member name. | Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. The type field provides a means of understanding and correlation of events to types. | -| add_on.url.full | N/A | Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. The url field provides a means of understanding and correlation of events to the location where the add_on can be download from.| -| family | N/A | Software product families have gained much important from the increased usage of software in consumer products. “A software product family is commonly defined to consist of a common architecture, a set of reusable assets used in systematically producing individual products, and the set of products thus produced”. One software product family normally has a very large number of products. The definition indicates that software components are reused on a common architecture because the products belonging to one family have a lot of common features and build upon a common architecture.| -| vendor | Normalize this field to lowercase. | Software vendors can develop a wide range of consumer and business applications for a variety of devices, from computers and tablets, to mobile phones, to automobiles, manufacturing equipment, and more. The applications developed by software vendors can be deployed on premise or, increasingly, are cloud based and can be accessed via the Internet.| -| type | Normalization rule: The value must be normalized to lower case. | Software packages are complete pieces of software that can work on their own, without additions or other necessary parts. Computer software packages control the physical parts of the machine so that these parts know how to work together. Other names for software are apps, programs, applications, program modules, procedures, scripts and source code. Computer software is adapted to the properties of the hardware. What works on one type of computer will not necessarily work on another. Some types of software are installed when a computer is built and are necessary for the computer to function. Other software packages can be purchased separately or downloaded from the Internet and added to the computer at any time.| -| state | N/A | Software state is information your program manipulates to accomplish some task. It is data or information that gets changed or manipulated throughout the runtime of a program. The "state" of a program at a given time refers to a snapshot of all the data the program is currently looking at or analyzing to get to the next step in it's execution.| -| patch.kb | Normalization rule: The value must be normalized to lower case. | Proper patch management can greatly improve an enterprise’s security by addressing the vulnerabilities in its software and operating systems. Keeping track of the patch ID allows for the administrator to ascertain any issues resulting from a specific patch update.| -| install.time | N/A | Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities.| -| locale | N/A | Knowing the software.locale makes it easier to translate and understand any instructions associated with the application.| -| patch.name | N/A | Good patch documentation including the software patch package's full name is important for letting the administrator easily identify and distinguish patches from each other.| -

-
- - - name: cpe - level: custom - type: keyword - normalization: array - example: ["cpe:/o:microsoft:windows", "cpe:/a:adobe:acrobat"] - description: > - Software identified by its common platform enumeration (CPE) value. - - - name: name - level: custom - type: keyword - example: skype - description: > - The name of the software. - - - name: modules.name - level: custom - type: keyword - example: Anti-spyware protection - description: > - Module name. - - - name: version - level: custom - type: keyword - example: 27/1.0.0.2021090243 - description: > - The software version. - - - name: add_on.name - level: custom - type: keyword - example: Wiki - description: > - The name of the software add-on/extension that generated the event. - - - name: add_on.type - level: custom - type: keyword - example: Bot - description: > - The type of the software add-on/extension that generated the event. - - - name: add_on.url.full - level: custom - type: keyword - example: https://example.com/download/my_add_on - description: > - Software installed on the host identified common platform enumeration (CPE) value. - - - name: family - level: custom - type: keyword - example: TVD - description: > - A vendor provided categorization of the software. - - - name: vendor - level: custom - type: keyword - example: google - description: > - The vendor or provider of the software. - - - name: type - level: custom - type: keyword - example: exe - description: > - Software type. - - - name: state - level: custom - type: keyword - example: running - description: > - Current state of the software. - - - name: patch.kb - level: custom - type: keyword - example: KB4538461 - description: > - Software patch ID. - - - name: install.time - level: custom - type: date - description: > - Time the software was installed. - - - name: locale - level: custom - type: keyword - example: Hungarian - description: > - The human language used in the application intended for the user to read. - - - name: patch.name - level: custom - type: keyword - example: Microsoft.MicrosoftEdge.Stable.97.0.1072.55_neutral_8wekyb3d8bbwe - description: > - The software patch package's full name. - - - -## Usage - - - ### `cpe` - Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets. - -IT management tools can collect information about installed products, identifying these products using their CPE names, and then use this standardized information to help make fully or partially automated decisions regarding the assets. For example, identifying the presence of XYZ Visualizer Enterprise Suite could trigger a vulnerability management tool to check the system for known vulnerabilities in the software, and also trigger a configuration management tool to verify that the software is configured securely in accordance with the organization's policies. - - ### `name` - Name of software often useful to cross reference other data sources. - - ### `modules.name` - A module usually represents an application, a language stack, or any other logical collection of packages. Module name should represent the name of the software it ships. - - ### `version`, `install.time` - Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities. - - ### `add_on.name`, `add_on.type`, `add_on.url.full` - Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. - - The type field provides a means of understanding and correlation of events to types. - - The url field provides a means of understanding and correlation of events to the location where the add_on can be download from. - - ### `family` - Software product families have gained much important from the increased usage of software in consumer products. “A software product family is commonly defined to consist of a common architecture, a set of reusable assets used in systematically producing individual products, and the set of products thus produced”. One software product family normally has a very large number of products. The definition indicates that software components are reused on a common architecture because the products belonging to one family have a lot of common features and build upon a common architecture. - - ### `vendor` - Software vendors can develop a wide range of consumer and business applications for a variety of devices, from computers and tablets, to mobile phones, to automobiles, manufacturing equipment, and more. The applications developed by software vendors can be deployed on premise or, increasingly, are cloud based and can be accessed via the Internet. - - ### `type` - Software packages are complete pieces of software that can work on their own, without additions or other necessary parts. Computer software packages control the physical parts of the machine so that these parts know how to work together. Other names for software are apps, programs, applications, program modules, procedures, scripts and source code. Computer software is adapted to the properties of the hardware. What works on one type of computer will not necessarily work on another. Some types of software are installed when a computer is built and are necessary for the computer to function. Other software packages can be purchased separately or downloaded from the Internet and added to the computer at any time. - - ### `state` - Software state is information your program manipulates to accomplish some task. It is data or information that gets changed or manipulated throughout the runtime of a program. The "state" of a program at a given time refers to a snapshot of all the data the program is currently looking at or analyzing to get to the next step in it's execution. - - ### `patch.kb` - Proper patch management can greatly improve an enterprise’s security by addressing the vulnerabilities in its software and operating systems. Keeping track of the patch ID allows for the administrator to ascertain any issues resulting from a specific patch update. - - ### `locale` - Knowing the software.locale makes it easier to translate and understand any instructions associated with the application. - - ### `patch.name` - Good patch documentation including the software patch package's full name is important for letting the administrator easily identify and distinguish patches from each other. - -## Source data - - -The host fields in this RFC are sourced from the following data feeds: - - Endpoint Detection and Response System Audit Logs & Alerts - - Office 365 Device Audit Logs - - Active Directory Computer Objects - - Windows Event Logs - - Software Inventory - - - Host & Network Interface Information collects information about host computer configurations, vulnerabilities and compliance from endpoint computers. - - Azure Active Directory (Azure AD) tracks user activity and creates reports that help you understand how your users access and use Azure AD services. The Microsoft Graph API for Azure AD provides a means to access data in the activity reports. - - Active Directory (AD) stores information about objects on the network and makes this information available for administrators and users. AD uses a structured data store as the basis for a logical, hierarchical organization of directory information. This data store, also known as the directory, contains information about AD objects. These objects typically include shared resources such as Users, Computers, Groups, Organizational Units, etc. - - Host Information collects configuration and compliance data from endpoint computers. - - - - - - -## Scope of impact - - - * Ingestion mechanisms - - Custom - * Usage mechanisms (e.g. Kibana applications, detections) - - Kibana - - Custom applications - -## Concerns - - -There are no current concerns regarding the software field set at this time. - - - - -## People - -The following are the people that consulted on the contents of this RFC. - -* @hadadata59 | Author, Sponsor - - - - -## References - - - -### RFC Pull Requests - - - -* Stage 0: https://github.com/elastic/ecs/pull/NNN - - From 7a4df127a3e39ef6a561c2a28b7bcd8966729c9d Mon Sep 17 00:00:00 2001 From: hadadata59 <85754157+hadadata59@users.noreply.github.com> Date: Fri, 14 Oct 2022 14:20:17 -0400 Subject: [PATCH 14/14] Delete 0037-user-fields.md --- rfcs/text/0037-user-fields.md | 303 ---------------------------------- 1 file changed, 303 deletions(-) delete mode 100644 rfcs/text/0037-user-fields.md diff --git a/rfcs/text/0037-user-fields.md b/rfcs/text/0037-user-fields.md deleted file mode 100644 index 99a6ed3fed..0000000000 --- a/rfcs/text/0037-user-fields.md +++ /dev/null @@ -1,303 +0,0 @@ -# 0000: User Fields - - -- Stage: **0 (strawperson)** -- Date: **8-12-2022** - - - - -The User fields describe information about the user that is relevant to an event. - -This RFC extends the ECS user field set in several ways: - -- The user field set supports additonal user identifier and name fields to maintain context for the identifier or name. -- It also defines an authentication field set nested under user.* to describe details of the users authentication attempt relevant to the event. -- Lastly, the user field set supports additional fields describing a users account status and account profile details. - - - -## Fields -
Definitions -

- - -Field Name | Special Instructions | Justification/Use Case -| :--: | :-- | :-- | -| created | N/A | Date the user was created. -| display_name | N/A | This field may contain some representation of a user's account registered formal name.| -| expires | Convert raw value user.expires_raw to a ISO time value user.expires. | The date when the account expires. Knowing the date the account expires is helpful in setting reminders for users to request extended access or for the admin to keep track of accounts that need to be deleted upon expiration.| -| home.directory | N/A | A home directory provides a user with his own space in which to store personal files. More importantly, it prevents user files from taking up valuable space in the root directory, which is the top directory — and the one used by system administrators to quickly access important system files.| -| home.drive | N/A | On windows, the drive letter for the home directory of the account. On Linux/Unix the mount point of the home directory.| -| is_domain | N/A | A local user will have the account name prefixed with the machine name. A domain user's account name will be prefixed with its originating domain. If the machine name and the account prefix name don't match, or if the account name prefix matches the local machine, it's generally safe to assume its a local account.| -| is_flagged | N/A | The account is flagged for some suspicious activity.| -| locked_out | Convert raw value user.locked_out_raw to a ISO time value. | The date and time that this account was locked out.| -| password.cleartext | N/A | A clear text password (or Plaintext, or Plain-text) is a way of writing (and sending) a password in a clear, readable format. Such password is not encrypted and can be easily read by other humans and machines.| -| password.encrypted | N/A | Password encryption is essential to store user credentials stored in a database securely. Without password encryption, anyone accessing a user database on a company's servers (including hackers) could easily view any stored passwords.| -| password.last_set | N/A | Knowing the date the password was last changed is useful in regards to making sure corporate password policies are being adhered to.| -| password.expires | N/A | Knowing the date the password will expire is useful in regards to making sure corporate password policies are being adhered to.| -| password.expired | N/A | Knowing the date the password will expire is useful in regards to making sure corporate password policies are being adhered to.| -| sam_account_name | N/A | Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities.| -| locale | N/A | Knowing the software.locale makes it easier to translate and understand any instructions associated with the application.| -| patch.name | N/A | Good patch documentation including the software patch package's full name is important for letting the administrator easily identify and distinguish patches from each other.| -

-
- - - name: created - level: custom - type: date - description: > - Date the user was created. - - - name: display_name - level: custom - type: keyword - example: Smith, John - description: > - The identity's display name. Note that this may not always be available or up-to-date. This may be similar to user.full_name. Both fields may contain some representation of a user's account registered formal name. - - - name: expires - level: custom - type: date - description: > - The date when the account expires. - - - name: home.directory - level: custom - type: keyword - example: /home/jsmith - description: > - The home directory for the account. - - - name: home.drive - level: custom - type: keyword - example: T: - description: > - On windows, the drive letter for the home directory of the account. On Linux/Unix the mount point of the home directory. - - - name: is_domain - level: custom - type: boolean - description: > - Whether the user is a domain user or a local user. - - - name: is_flagged - level: custom - type: boolean - description: > - The account is flagged for some suspicious activity. - - - name: locked_out - level: custom - type: date - description: > - The date and time that this account was locked out. - - - name: password.cleartext - level: custom - type: keyword - example: password - description: > - The user password in clear text. - - - name: password.encrypted - level: custom - type: keyword - example: c8fed00eb2e87f1cee8e90ebbe870c190ac3848c - description: > - The user password encrypted value. - - - name: password.last_set - level: custom - type: date - description: > - Date the password was last changed. - - - name: patch.kb - level: custom - type: keyword - example: KB4538461 - description: > - Software patch ID. - - - name: install.time - level: custom - type: date - description: > - Time the software was installed. - - - name: locale - level: custom - type: keyword - example: Hungarian - description: > - The human language used in the application intended for the user to read. - - - name: patch.name - level: custom - type: keyword - example: Microsoft.MicrosoftEdge.Stable.97.0.1072.55_neutral_8wekyb3d8bbwe - description: > - The software patch package's full name. - - - -## Usage - - -### General Use Cases: -- Find all events for a user with a specfic user principal name -- Find events where user authentication failed -- Extract detailed information about a user - -### Specific Use Cases: - - ### `cpe` - Common Platform Enumeration (CPE) is a standardized method of describing and identifying classes of applications, operating systems, and hardware devices present among an enterprise's computing assets. - -IT management tools can collect information about installed products, identifying these products using their CPE names, and then use this standardized information to help make fully or partially automated decisions regarding the assets. For example, identifying the presence of XYZ Visualizer Enterprise Suite could trigger a vulnerability management tool to check the system for known vulnerabilities in the software, and also trigger a configuration management tool to verify that the software is configured securely in accordance with the organization's policies. - - ### `name` - Name of software often useful to cross reference other data sources. - - ### `modules.name` - A module usually represents an application, a language stack, or any other logical collection of packages. Module name should represent the name of the software it ships. - - ### `version`, `install.time` - Having the latest software version can prevent security issues and improve compatibility and program features. Software updates are necessary to keep computers, mobile devices and tablets running smoothly -- and they may lower security vulnerabilities. - - ### `add_on.name`, `add_on.type`, `add_on.url.full` - Add-ons are usually third-party software and can affect the performance of your browser or applications and some can even be actively malicious. Keeping track of potentially hazardous add-ons that are impacting performance or acting malicious can allow for quick resolutions in order to minimize security concerns. - - The type field provides a means of understanding and correlation of events to types. - - The url field provides a means of understanding and correlation of events to the location where the add_on can be download from. - - ### `family` - Software product families have gained much important from the increased usage of software in consumer products. “A software product family is commonly defined to consist of a common architecture, a set of reusable assets used in systematically producing individual products, and the set of products thus produced”. One software product family normally has a very large number of products. The definition indicates that software components are reused on a common architecture because the products belonging to one family have a lot of common features and build upon a common architecture. - - ### `vendor` - Software vendors can develop a wide range of consumer and business applications for a variety of devices, from computers and tablets, to mobile phones, to automobiles, manufacturing equipment, and more. The applications developed by software vendors can be deployed on premise or, increasingly, are cloud based and can be accessed via the Internet. - - ### `type` - Software packages are complete pieces of software that can work on their own, without additions or other necessary parts. Computer software packages control the physical parts of the machine so that these parts know how to work together. Other names for software are apps, programs, applications, program modules, procedures, scripts and source code. Computer software is adapted to the properties of the hardware. What works on one type of computer will not necessarily work on another. Some types of software are installed when a computer is built and are necessary for the computer to function. Other software packages can be purchased separately or downloaded from the Internet and added to the computer at any time. - - ### `state` - Software state is information your program manipulates to accomplish some task. It is data or information that gets changed or manipulated throughout the runtime of a program. The "state" of a program at a given time refers to a snapshot of all the data the program is currently looking at or analyzing to get to the next step in it's execution. - - ### `patch.kb` - Proper patch management can greatly improve an enterprise’s security by addressing the vulnerabilities in its software and operating systems. Keeping track of the patch ID allows for the administrator to ascertain any issues resulting from a specific patch update. - - ### `locale` - Knowing the software.locale makes it easier to translate and understand any instructions associated with the application. - - ### `patch.name` - Good patch documentation including the software patch package's full name is important for letting the administrator easily identify and distinguish patches from each other. - -## Source data - - -The host fields in this RFC are sourced from the following data feeds: - - Endpoint Detection and Response System Audit Logs & Alerts - - Office 365 Signin Logs - - Active Directory Computer Objects - - Windows Event Logs - - - Host & Network Interface Information collects information about host computer configurations, vulnerabilities and compliance from endpoint computers. - - Azure Active Directory (Azure AD) tracks user activity and creates reports that help you understand how your users access and use Azure AD services. The Microsoft Graph API for Azure AD provides a means to access data in the activity reports. - - Active Directory (AD) stores information about objects on the network and makes this information available for administrators and users. AD uses a structured data store as the basis for a logical, hierarchical organization of directory information. This data store, also known as the directory, contains information about AD objects. These objects typically include shared resources such as Users, Computers, Groups, Organizational Units, etc. - - Host Information collects configuration and compliance data from endpoint computers. - - - - - - -## Scope of impact - - - * Ingestion mechanisms - - Custom - * Usage mechanisms (e.g. Kibana applications, detections) - - Kibana - - Custom applications - -## Concerns - - -There are no current concerns regarding the user fields within this field set. - - - - -## People - -The following are the people that consulted on the contents of this RFC. - -* @hadadata59 | Author, Sponsor - - - - -## References - - - -### RFC Pull Requests - - - -* Stage 0: https://github.com/elastic/ecs/pull/NNN - -