Merge pull request #1387 from SEKOIA-IO/fix/setinel_one_smart_descrip…

…tions Fix: SentinelOne smart descriptions (317)
SEKOIA-IO · Dec 10, 2024 · 7f908cb · 7f908cb
2 parents 8100245 + 002cfcd
commit 7f908cb
Show file tree

Hide file tree

Showing 2 changed files with 148 additions and 0 deletions.
diff --git a/SentinelOne/cloud_funnel2.0/_meta/smart-descriptions.json b/SentinelOne/cloud_funnel2.0/_meta/smart-descriptions.json
@@ -682,6 +682,58 @@
       }
     ]
   },
+  {
+    "value": "Process {process.command_line} was created by {process.user.name}",
+    "conditions": [
+      {
+        "field": "event.action",
+        "value": "Process Creation"
+      },
+      {
+        "field": "process.user.name"
+      },
+      {
+        "field": "process.command_line"
+      }
+    ],
+    "relationships": [
+      {
+        "source": "process.user.name",
+        "target": "process.parent.command_line",
+        "type": "created"
+      },
+      {
+        "source": "process.parent.command_line",
+        "target": "process.parent.title",
+        "type": "has process title"
+      },
+      {
+        "source": "process.parent.command_line",
+        "target": "process.parent.name",
+        "type": "has name"
+      },
+      {
+        "source": "process.command_line",
+        "target": "process.title",
+        "type": "has title"
+      },
+      {
+        "source": "process.command_line",
+        "target": "process.name",
+        "type": "has name"
+      },
+      {
+        "source": "process.parent.command_line",
+        "target": "process.command_line",
+        "type": "created"
+      },
+      {
+        "source": "process.user.name",
+        "target": "host.name",
+        "type": "logged on"
+      }
+    ]
+  },
   {
     "value": "Process {process.command_line} was created by {user.name}",
     "conditions": [

diff --git a/SentinelOne/cloud_funnel2.0/tests/process_processcreation_2.json b/SentinelOne/cloud_funnel2.0/tests/process_processcreation_2.json
@@ -0,0 +1,96 @@
+{
+  "input": {
+    "message": "{\"tgt.process.displayName\":\"curl\",\"event.category\":\"process\",\"site.id\":\"1967302198659758782\",\"tgt.process.pid\":30273,\"endpoint.os\":\"osx\",\"tgt.process.name\":\"curl\",\"tgt.process.storyline.id\":\"EE9FB66D-9B03-4286-971C-7A20615D157B\",\"tgt.process.signedStatus\":\"signed\",\"tgt.process.isNative64Bit\":false,\"mgmt.id\":\"16205\",\"os.name\":\"OS X\",\"tgt.process.cmdline\":\"curl -H User-Agent: test.nvim v1.10.0 (+https:\\/\\/test.test\\/tttttttt\\/test.nvim) -fsSL -X GET -o \\/Users\\/test.user\\/.local\\/share\\/nvim\\/test\\/registries\\/github\\/test-org\\/test-registry\\/registry.json.zip --connect-timeout 30 https:\\/\\/test.test\\/test-org\\/test-registry\\/releases\\/download\\/2024-12-05-doting-coil\\/registry.json.zip\",\"i.version\":\"preprocess-lib-1.0\",\"process.unique.key\":\"54EDFDFD-139E-4040-A961-59D6F9C33F63\",\"tgt.process.uid\":\"54EDFDFD-139E-4040-A961-59D6F9C33F63\",\"tgt.process.isStorylineRoot\":false,\"mgmt.url\":\"mgm-testing-test.sentinelone.net\",\"agent.version\":\"23.3.1.7037\",\"tgt.process.subsystem\":\"SUBSYSTEM_UNKNOWN\",\"tgt.process.image.sha256\":\"8577dde932584e03da0f0230dbca16a11fa4f57b3f8b91033f99e83b5a85fd42\",\"mgmt.osRevision\":\"14.7.1 (23H222)\",\"meta.event.name\":\"PROCESSCREATION\",\"group.id\":\"EE9FB66D-9B03-4286-971C-7A20615D157B\",\"tgt.process.publisher\":\"<Type=Apple\\/ID=com.apple.curl>\",\"tgt.process.startTime\":1733386731479,\"tgt.process.verifiedStatus\":\"verified\",\"endpoint.type\":\"laptop\",\"tgt.process.image.path\":\"\\/usr\\/bin\\/curl\",\"i.scheme\":\"edr\",\"trace.id\":\"XXXXXXX-XXXXXXXX-XXXXXXX\",\"tgt.process.integrityLevel\":\"INTEGRITY_LEVEL_UNKNOWN\",\"site.name\":\"LEDGER\",\"agent.uuid\":\"xxxx-XXXXXX-XXXXx-xxxxx\",\"tgt.process.image.md5\":\"fe61928bbd84ed16fc4f934307bf2f16\",\"event.time\":1733386731479,\"tgt.process.user\":\"test.user\",\"timestamp\":\"2024-12-05T08:18:51.479Z\",\"account.id\":\"1967302197074311859\",\"dataSource.name\":\"SentinelOne\",\"endpoint.name\":\"LMFR0205\",\"packet.id\":\"949E7E9F-F1E6-4507-830F-E272AAED8F15\",\"tgt.process.sessionId\":0,\"dataSource.vendor\":\"SentinelOne\",\"dataSource.category\":\"security\",\"tgt.process.isRedirectCmdProcessor\":false,\"tgt.process.image.sha1\":\"e817c506298dc8a2dba727562b6efc60dcf4db1a\",\"account.name\":\"24 - LEDGER\",\"event.type\":\"Process Creation\",\"event.id\":\"XXXXXXX-XXXXXXXX-XXXXXXX_77\"}"
+  },
+  "expected": {
+    "message": "{\"tgt.process.displayName\":\"curl\",\"event.category\":\"process\",\"site.id\":\"1967302198659758782\",\"tgt.process.pid\":30273,\"endpoint.os\":\"osx\",\"tgt.process.name\":\"curl\",\"tgt.process.storyline.id\":\"EE9FB66D-9B03-4286-971C-7A20615D157B\",\"tgt.process.signedStatus\":\"signed\",\"tgt.process.isNative64Bit\":false,\"mgmt.id\":\"16205\",\"os.name\":\"OS X\",\"tgt.process.cmdline\":\"curl -H User-Agent: test.nvim v1.10.0 (+https:\\/\\/test.test\\/tttttttt\\/test.nvim) -fsSL -X GET -o \\/Users\\/test.user\\/.local\\/share\\/nvim\\/test\\/registries\\/github\\/test-org\\/test-registry\\/registry.json.zip --connect-timeout 30 https:\\/\\/test.test\\/test-org\\/test-registry\\/releases\\/download\\/2024-12-05-doting-coil\\/registry.json.zip\",\"i.version\":\"preprocess-lib-1.0\",\"process.unique.key\":\"54EDFDFD-139E-4040-A961-59D6F9C33F63\",\"tgt.process.uid\":\"54EDFDFD-139E-4040-A961-59D6F9C33F63\",\"tgt.process.isStorylineRoot\":false,\"mgmt.url\":\"mgm-testing-test.sentinelone.net\",\"agent.version\":\"23.3.1.7037\",\"tgt.process.subsystem\":\"SUBSYSTEM_UNKNOWN\",\"tgt.process.image.sha256\":\"8577dde932584e03da0f0230dbca16a11fa4f57b3f8b91033f99e83b5a85fd42\",\"mgmt.osRevision\":\"14.7.1 (23H222)\",\"meta.event.name\":\"PROCESSCREATION\",\"group.id\":\"EE9FB66D-9B03-4286-971C-7A20615D157B\",\"tgt.process.publisher\":\"<Type=Apple\\/ID=com.apple.curl>\",\"tgt.process.startTime\":1733386731479,\"tgt.process.verifiedStatus\":\"verified\",\"endpoint.type\":\"laptop\",\"tgt.process.image.path\":\"\\/usr\\/bin\\/curl\",\"i.scheme\":\"edr\",\"trace.id\":\"XXXXXXX-XXXXXXXX-XXXXXXX\",\"tgt.process.integrityLevel\":\"INTEGRITY_LEVEL_UNKNOWN\",\"site.name\":\"LEDGER\",\"agent.uuid\":\"xxxx-XXXXXX-XXXXx-xxxxx\",\"tgt.process.image.md5\":\"fe61928bbd84ed16fc4f934307bf2f16\",\"event.time\":1733386731479,\"tgt.process.user\":\"test.user\",\"timestamp\":\"2024-12-05T08:18:51.479Z\",\"account.id\":\"1967302197074311859\",\"dataSource.name\":\"SentinelOne\",\"endpoint.name\":\"LMFR0205\",\"packet.id\":\"949E7E9F-F1E6-4507-830F-E272AAED8F15\",\"tgt.process.sessionId\":0,\"dataSource.vendor\":\"SentinelOne\",\"dataSource.category\":\"security\",\"tgt.process.isRedirectCmdProcessor\":false,\"tgt.process.image.sha1\":\"e817c506298dc8a2dba727562b6efc60dcf4db1a\",\"account.name\":\"24 - LEDGER\",\"event.type\":\"Process Creation\",\"event.id\":\"XXXXXXX-XXXXXXXX-XXXXXXX_77\"}",
+    "event": {
+      "action": "Process Creation",
+      "category": [
+        "process"
+      ],
+      "dataset": "cloud-funnel-2.0",
+      "type": [
+        "info"
+      ]
+    },
+    "@timestamp": "2024-12-05T08:18:51.479000Z",
+    "agent": {
+      "version": "23.3.1.7037"
+    },
+    "deepvisibility": {
+      "agent": {
+        "managment_url": "mgm-testing-test.sentinelone.net",
+        "trace_id": "XXXXXXX-XXXXXXXX-XXXXXXX",
+        "uuid": "xxxx-XXXXXX-XXXXx-xxxxx"
+      },
+      "event": {
+        "category": "process",
+        "type": "Process Creation"
+      },
+      "host": {
+        "os": {
+          "revision": "14.7.1 (23H222)"
+        }
+      },
+      "process": {
+        "target": {
+          "command_line": "curl -H User-Agent: test.nvim v1.10.0 (+https://test.test/tttttttt/test.nvim) -fsSL -X GET -o /Users/test.user/.local/share/nvim/test/registries/github/test-org/test-registry/registry.json.zip --connect-timeout 30 https://test.test/test-org/test-registry/releases/download/2024-12-05-doting-coil/registry.json.zip",
+          "executable": "/usr/bin/curl",
+          "hash": {
+            "md5": "fe61928bbd84ed16fc4f934307bf2f16",
+            "sha1": "e817c506298dc8a2dba727562b6efc60dcf4db1a",
+            "sha256": "8577dde932584e03da0f0230dbca16a11fa4f57b3f8b91033f99e83b5a85fd42"
+          },
+          "name": "curl",
+          "storyline_id": "EE9FB66D-9B03-4286-971C-7A20615D157B",
+          "title": "curl",
+          "working_directory": "/usr/bin"
+        }
+      }
+    },
+    "host": {
+      "name": "LMFR0205",
+      "os": {
+        "family": "osx",
+        "name": "OS X"
+      },
+      "type": "laptop"
+    },
+    "observer": {
+      "vendor": "SentinelOne"
+    },
+    "process": {
+      "command_line": "curl -H User-Agent: test.nvim v1.10.0 (+https://test.test/tttttttt/test.nvim) -fsSL -X GET -o /Users/test.user/.local/share/nvim/test/registries/github/test-org/test-registry/registry.json.zip --connect-timeout 30 https://test.test/test-org/test-registry/releases/download/2024-12-05-doting-coil/registry.json.zip",
+      "executable": "/usr/bin/curl",
+      "hash": {
+        "md5": "fe61928bbd84ed16fc4f934307bf2f16",
+        "sha1": "e817c506298dc8a2dba727562b6efc60dcf4db1a",
+        "sha256": "8577dde932584e03da0f0230dbca16a11fa4f57b3f8b91033f99e83b5a85fd42"
+      },
+      "name": "curl",
+      "pid": 30273,
+      "start": "2024-12-05T08:18:51.479000Z",
+      "title": "curl",
+      "user": {
+        "name": "test.user"
+      },
+      "working_directory": "/usr/bin"
+    },
+    "related": {
+      "hash": [
+        "8577dde932584e03da0f0230dbca16a11fa4f57b3f8b91033f99e83b5a85fd42",
+        "e817c506298dc8a2dba727562b6efc60dcf4db1a",
+        "fe61928bbd84ed16fc4f934307bf2f16"
+      ]
+    },
+    "url": {
+      "domain": "test.test",
+      "original": "https://test.test/test-org/test-registry/releases/download/2024-12-05-doting-coil/registry.json.zip",
+      "path": "/test-org/test-registry/releases/download/2024-12-05-doting-coil/registry.json.zip",
+      "port": 443,
+      "scheme": "https",
+      "subdomain": "test"
+    }
+  }
+}