Activity Monitoring Metrics
Process Tagging
uberAgent processes a rule set and applies tags accordingly.
Details
- Source type:
uberAgentESA:ActivityMonitoring:ProcessTagging - Used in dashboards: Activity Monitoring Events
- Enabled through configuration setting:
ActivityMonitoring - Related configuration settings:
[ActivityMonitoringRule] - Supported platform: Windows
List of Fields in the Raw Agent Data
| Field | Description | Data type | Unit | Example |
|---|---|---|---|---|
| EventType | Event type. Can be 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25 or 26. See also EventTypeName. |
Number | 4 | |
| ProcName | Process name. | String | svchost.exe | |
| ProcParentName | Parent process name. | String | services.exe | |
| ProcUser | Process user. | String | domain\JohnDoe | |
| ProcLifetimeMs | Process lifetime. | Number | ms | 500 |
| ProcId | Process ID. | Number | 12345 | |
| ProcParentId | Parent process ID. | Number | 67890 | |
| ProcGUID | Process GUID. | String | 4b3e3686-7854-4d98-0023-1e0e617bf2e4 | |
| ProcParentGUID | Parent process GUID. | String | d72ceb7e-7851-02ec-005d-139741c4afd6 | |
| ProcPath | Process path | String | C:\WINDOWS\System32\svchost.exe | |
| ProcCmdline | Process commandline. | String | C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted | |
| ProcTag1 | Rule tag: the tag assigned to events originating from the matching rule. | String | net-connect-suspicious-sources | |
| ProcRiskScore1 | Rule risk score: the risk score assigned to events originating from the matching rule. | Number | 75 | |
| IsElevated | Indicates if the process was started elevated (admin rights). | String | 1 | |
| SessionId | Session ID. | Number | 2 | |
| SessionGUID | Session GUID. | String | 00000000-b242-d759-7a63-d686b0ffd501 | |
| AppId | Application ID. | String | Svc:WdiSystemHost | |
| AppVersion | Application version. | String | 1.0 | |
| IsProtected | Indicates if the process was started protected. | String | 1 | |
| EventCount | The number of identical events that occurred during the interval period. | Number | 42 | |
| RuleAnnotation | JSON of rule annotations like security frameworks. | String | {“mitre_attack”: [“T1086”, “T1059.001”]} |
Additionally, one can enhance the information sent to the back-end by defining a number of generic properties that will be sent along with the fields above. Any field listed under Common Event Properties, Network Event Properties, Image Load Event Properties, or Registry Event Properties can be used as a generic property.
List of Calculated Fields
| Field | Description | Data type | Unit | Example | Where available |
|---|---|---|---|---|---|
| EventTypeName | Names for event types based on the lookup lookup_process_tagging_eventtype. Can be Process.Start, Process.Stop, Image.Load, Net.Connect, Net.Receive, Net.Reconnect, Net.Retransmit, Net.Send, Reg.Key.Create, Reg.Value.Write, Reg.Delete, Reg.Key.Delete, Reg.Value.Delete, Reg.Key.SecurityChange, Reg.Key.Rename,Reg.Key.SetInformation, Reg.Key.Load, Reg.Key.Unload, Reg.Key.Restore, Reg.Key.Save, Reg.Key.Replace, Reg.Any, Dns.Query, Process.CreateRemoteThread, Process.TamperingEvent or Net.Any. |
String | Process.Start | Splunk data model, Splunk SPL | |
| ProcUser | coalesce (ProcUserExpanded, ProcUser). |
String | Domain\JohnDoe | Splunk data model | |
| User | ProcUser. |
String | Domain\JohnDoe | Splunk data model | |
| TimestampMs | _time * 1000. |
Number | ms | 1585913547467 | Splunk data model |
| RuleAnnotation.mitre_attack.id | One or more MITRE ATT&CK® IDs for the event. The source is the field RuleAnnotation. | String | T1086 T1059.001 |
Splunk data model, Splunk SPL |