github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 01:13:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution] Add credential_access to allow filter list (#136232)

Browse source 
* add crendential_access to allow filter list

* unit test for credential_access
This commit is contained in:
JD Kurma 2022-07-25 13:04:54 -04:00 • committed by GitHub
parent 2e6a96701d
commit af2557b31a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 81 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
x-pack/plugins/security_solution/server/lib/telemetry/filterlists/endpoint_alerts.ts
View file

@ -42,6 +42,7 @@ const baseAllowlistFields: AllowlistFields = {
// Allow list for event-related fields, which can also be nested under events[]
const allowlistBaseEventFields: AllowlistFields = {
credential_access: true,
dll: {
name: true,
path: true,

80
x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts
View file

@ -33,6 +33,46 @@ describe('TelemetryEventsSender', () => {
const sender = new TelemetryEventsSender(logger);
const input = [
{
credential_access: {
Target: {
process: {
path: 'DeviceHarddiskVolume3WindowsSystem32lsass.exe',
pid: 808,
ppid: 584,
sid: 0,
},
},
handle_type: 'process',
desired_access_numeric: 2097151,
desired_access: [
'DELETE',
'READ_CONTROL',
'SYNCHRONIZE',
'WRITE_DAC',
'WRITE_OWNER',
'STANDARD_RIGHTS_REQUIRED',
'PROCESS_ALL_ACCESS',
],
call_stack: {
entries: [
{
memory_address: 140706712704004,
start_address_allocation_offset: 644100,
module_path: 'DeviceHarddiskVolume3WindowsSystem32\ntdll.dll',
},
{
memory_address: 140706669379902,
start_address_allocation_offset: 180542,
module_path: 'DeviceHarddiskVolume3WindowsSystem32KernelBase.dll',
},
{
memory_address: 140704414232808,
start_address_allocation_offset: 127208,
module_path: 'Unbacked',
},
],
},
},
event: {
kind: 'alert',
id: 'test',
@ -116,6 +156,46 @@ describe('TelemetryEventsSender', () => {
const result = sender.processEvents(input);
expect(result).toStrictEqual([
{
credential_access: {
Target: {
process: {
path: 'DeviceHarddiskVolume3WindowsSystem32lsass.exe',
pid: 808,
ppid: 584,
sid: 0,
},
},
handle_type: 'process',
desired_access_numeric: 2097151,
desired_access: [
'DELETE',
'READ_CONTROL',
'SYNCHRONIZE',
'WRITE_DAC',
'WRITE_OWNER',
'STANDARD_RIGHTS_REQUIRED',
'PROCESS_ALL_ACCESS',
],
call_stack: {
entries: [
{
memory_address: 140706712704004,
start_address_allocation_offset: 644100,
module_path: 'DeviceHarddiskVolume3WindowsSystem32\ntdll.dll',
},
{
memory_address: 140706669379902,
start_address_allocation_offset: 180542,
module_path: 'DeviceHarddiskVolume3WindowsSystem32KernelBase.dll',
},
{
memory_address: 140704414232808,
start_address_allocation_offset: 127208,
module_path: 'Unbacked',
},
],
},
},
event: {
kind: 'alert',
id: 'test',