Ensure Consistency Across Ingested Data for Analyzer Development

[raqueltabuyo]

Ensure Consistency Across Ingested Data for Analyzer Development

Description

To support the development of the analyzer, we need consistency in the ingested data across CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint. Specifically, the following fields should be consistently available and mapped to ECS.

Requirements

Ensure all three integrations provide the following fields:

• process.entity_id
• process.parent.entity_id
• process.name
• event.module
• event.kind

Impact

• Without consistency in these fields, entity correlation and attack chain visualization will be incomplete.
• Missing or inconsistent data will affect the accuracy and reliability of the analyzer.

Next Steps

1. Prioritize Microsoft
2. Assess data coverage gaps for each vendor.
3. Align ingestion pipelines to normalize these fields in ECS.
4. Define any necessary transformations or enrichment to standardize missing data.