Skip to content

Blog Support Queries#3471

Merged
petebryan merged 20 commits into
masterfrom
Queries_Blog_Support
Nov 18, 2021
Merged

Blog Support Queries#3471
petebryan merged 20 commits into
masterfrom
Queries_Blog_Support

Conversation

@aprakash13
Copy link
Copy Markdown
Contributor

Fixes #

Proposed Changes

@petebryan petebryan merged commit 10b11a0 into master Nov 18, 2021
@oshezaf
Copy link
Copy Markdown
Contributor

oshezaf commented Nov 21, 2021

@aprakash13 , @petebryan : a few rather important comments in this PR:

ActingProcessSHA256

  • The need to add ActingProcessSHA256 to the imFileEvent custom validation raises an issue we have to deal with on the validation side. We do promote normalizing as many fields even if we did not add them to the schema s they are not very common in sources, but don't do good in supporting validation for them.
  • That said, and expectedly for a non-schema field, using ActingProcessSHA256 in analytics presents a challenge: it is not part of the schema since file event sources do not commonly provide hash values for the process executable:
    • If there is a real need to get ActingProcess hash information, it is really recommended to correlate with a process event, probably based on the Acting Process Name. Maybe in this specific case, you want to correlate only with the process event (having the correct Hash for the process probably is much more important than the file names).

GuardDuty

  • In general, built-in tables do not need to have custom validation jsons. I have raised the issue with Amit and Alaa (who is in charge of the AWS connectors). Probably an issue with updating the validation system with the latest built-in schemas.

@shainw shainw deleted the Queries_Blog_Support branch November 25, 2021 01:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants