Skip to content

Commit 7fa0fcd

Browse files
efd6efd6
authored
crowdstrike: handle UTCTimestamp values in Unix seconds (elastic#13833)
Apparently Crowdstrike will send this field in seconds as well as millis; we have test cases that show the latter already. On the basis that security events are unlikely to be ocurring in the 1970s now, use the heuristic that timestamp values less that 1e10 are seconds and parse on that basis. New test case obtained from a mutation of the existing test case with this field, but with the UTCTimestamp field truncated by three characters.
1 parent 479e076 commit 7fa0fcd

File tree

5 files changed

+111
-1
lines changed

5 files changed

+111
-1
lines changed

‎packages/crowdstrike/changelog.yml

+5
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.66.0"
3+
changes:
4+
- description: Handle `UTCTimestamp` values expressed in Unix seconds.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13833
27
- version: "1.65.1"
38
changes:
49
- description: Adjust alert batch size to 1000 to match the API limit.

‎packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log

+1
Original file line numberDiff line numberDiff line change
@@ -135,3 +135,4 @@
135135
{"ContextBaseFileName":"SenseImdsCollector.exe","event_simpleName":"DnsRequest","ContextTimeStamp":"1738009377.497","ConfigStateHash":"138674525","ContextProcessId":"683613242245","DomainName":"metadata.google.internal","ContextThreadId":"31712204862362","aip":"67.43.156.14","QueryStatus":"9003","InterfaceIndex":"0","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","DnsRequestCount":"1","DualRequest":"1","Entitlements":"15","name":"DnsRequestV5","EventOrigin":"1","id":"3d0ef474-fcc3-4f18-9ad6-7130d8ddb407","EffectiveTransmissionClass":"3","aid":"31e92a267c044d57b1c1e14109079e89","timestamp":"1738009364034","cid":"ffffffff30a3407dae27d0503611022d","RequestType":"28"}
136136
{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"18446744072636268557","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"}
137137
{"AgentLoadFlags":"none","AgentLocalTime":"none","AgentTimeOffset":"63878691745","AgentVersion":"2025.02.1","BiosManufacturer":"none","BiosVersion":"none","ChassisType":"none","City":"Bengaluru","ComputerName":"none","ConfigBuild":"1007.32.20250201.9","ConfigIDBuild":"20250201","Continent":"Asia","Country":"India","FalconGroupingTags":"none","FirstSeen":"1742447937.000","HostHiddenStatus":"visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"none","SensorGroupingTags":"none","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple","SystemProductName":"none","Time":"1743094945.000","Timezone":"Asia/Kolkata","Version":"iOS 18.3.2","aid":"44444444444444444444444444444444","aip":"0.0.0.0","cid":"55555555555555555555555555555555","event_platform":"iOS"}
138+
{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"[email protected]","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134"}

‎packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json

+89
Original file line numberDiff line numberDiff line change
@@ -11894,6 +11894,95 @@
1189411894
"tags": [
1189511895
"preserve_original_event"
1189611896
]
11897+
},
11898+
{
11899+
"@timestamp": "2020-11-08T17:05:34.000Z",
11900+
"crowdstrike": {
11901+
"AuthenticationId": "317005428",
11902+
"AuthenticationPackage": "Negotiate",
11903+
"ConfigStateHash": "3950066843",
11904+
"EffectiveTransmissionClass": "2",
11905+
"Entitlements": "15",
11906+
"LogoffTime": "2020-11-08T17:05:32.756Z",
11907+
"LogonServer": "srv2",
11908+
"LogonTime": "2020-11-08T17:05:31.666Z",
11909+
"LogonType": "7",
11910+
"PasswordLastSet": "1598119332.510",
11911+
"RemoteAccount": "1",
11912+
"UserFlags": "32",
11913+
"UserLogoffType": "3",
11914+
"UserLogonFlags": "0",
11915+
"cid": "ffffffff30a3407dae27d0503611022d",
11916+
"id": "ffffffff-1111-11eb-8913-0287fd11c79b",
11917+
"name": "UserLogoffV3"
11918+
},
11919+
"device": {
11920+
"id": "ffffffffe0104823bd3de859d5bc8bc7"
11921+
},
11922+
"event": {
11923+
"action": "UserLogoff",
11924+
"category": [
11925+
"authentication"
11926+
],
11927+
"created": "2020-11-08T17:05:34.000Z",
11928+
"id": "ffffffff-1111-11eb-8913-0287fd11c79b|ffffffffe0104823bd3de859d5bc8bc7|ffffffff30a3407dae27d0503611022d",
11929+
"kind": "event",
11930+
"original": "{\"AuthenticationId\":\"317005428\",\"AuthenticationPackage\":\"Negotiate\",\"ConfigBuild\":\"1007.3.0011603.1\",\"ConfigStateHash\":\"3950066843\",\"EffectiveTransmissionClass\":\"2\",\"Entitlements\":\"15\",\"LogoffTime\":\"1604855132.756\",\"LogonDomain\":\"dom1\",\"LogonServer\":\"srv2\",\"LogonTime\":\"1604855131.666\",\"LogonType\":\"7\",\"PasswordLastSet\":\"1598119332.510\",\"RemoteAccount\":\"1\",\"UserFlags\":\"32\",\"UserIsAdmin\":\"0\",\"UserLogoffType\":\"3\",\"UserLogonFlags\":\"0\",\"UserName\":\"user4\",\"UserPrincipal\":\"[email protected]\",\"UserSid\":\"S-1-5-21-606747145-1364589140-725345543-28636\",\"aid\":\"ffffffffe0104823bd3de859d5bc8bc7\",\"aip\":\"67.43.156.13\",\"cid\":\"ffffffff30a3407dae27d0503611022d\",\"event_platform\":\"Win\",\"event_simpleName\":\"UserLogoff\",\"id\":\"ffffffff-1111-11eb-8913-0287fd11c79b\",\"name\":\"UserLogoffV3\",\"UTCTimestamp\":\"1604855134\"}",
11931+
"outcome": "success",
11932+
"type": [
11933+
"end"
11934+
]
11935+
},
11936+
"host": {
11937+
"domain": "dom1",
11938+
"os": {
11939+
"type": "windows"
11940+
}
11941+
},
11942+
"observer": {
11943+
"address": [
11944+
"67.43.156.13"
11945+
],
11946+
"geo": {
11947+
"continent_name": "Asia",
11948+
"country_iso_code": "BT",
11949+
"country_name": "Bhutan",
11950+
"location": {
11951+
"lat": 27.5,
11952+
"lon": 90.5
11953+
}
11954+
},
11955+
"ip": [
11956+
"67.43.156.13"
11957+
],
11958+
"serial_number": "ffffffffe0104823bd3de859d5bc8bc7",
11959+
"version": "1007.3.0011603.1"
11960+
},
11961+
"related": {
11962+
"hash": [
11963+
"3950066843"
11964+
],
11965+
"hosts": [
11966+
"srv2"
11967+
],
11968+
"ip": [
11969+
"67.43.156.13"
11970+
],
11971+
"user": [
11972+
"user4",
11973+
"user.name"
11974+
]
11975+
},
11976+
"tags": [
11977+
"preserve_original_event"
11978+
],
11979+
"user": {
11980+
"domain": "dom2.com",
11981+
"email": "[email protected]",
11982+
"full_name": "user.name",
11983+
"id": "S-1-5-21-606747145-1364589140-725345543-28636",
11984+
"name": "user4"
11985+
}
1189711986
}
1189811987
]
1189911988
}

‎packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml

+15
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,21 @@ processors:
4040
- append:
4141
field: error.message
4242
value: "'{{{ _ingest.on_failure_processor_tag }}}' rename failed with message {{{ _ingest.on_failure_message }}}"
43+
- convert:
44+
field: crowdstrike.UTCTimestamp
45+
target_field: _temp.utc_timestamp
46+
type: long
47+
ignore_failure: true
48+
- date:
49+
tag: date-timestamp-utc
50+
description: Parse timestamp from event.
51+
field: _temp.utc_timestamp
52+
target_field: event.created
53+
formats:
54+
- UNIX
55+
ignore_failure: true
56+
if: >
57+
ctx.event?.created == null && ctx._temp?.utc_timestamp instanceof long && ctx._temp.utc_timestamp < (long)1e10
4358
- date:
4459
tag: date-timestamp-utc
4560
description: Parse timestamp from event.

‎packages/crowdstrike/manifest.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: crowdstrike
22
title: CrowdStrike
3-
version: "1.65.1"
3+
version: "1.66.0"
44
description: Collect logs from Crowdstrike with Elastic Agent.
55
type: integration
66
format_version: "3.3.1"

0 commit comments

Comments
 (0)