Skip to content

fix(crowdstrike): keep command lines intact and repair rule conditions and grouping #2744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
osmontero merged 6 commits into from
Sep 25, 2026
Merged

fix(crowdstrike): keep command lines intact and repair rule conditions and grouping #2744

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
57dcb12
fix(crowdstrike): keep command lines as sent
kryonsx Sep 24, 2026
eb9c17c
refactor(crowdstrike): remove three renames that repeat earlier ones
kryonsx Sep 24, 2026
751d8a4
fix(crowdstrike): drop the event_simpleName test from five command-li…
kryonsx Sep 24, 2026
7d7bce7
fix(crowdstrike): group and deduplicate alerts by adversary fields
kryonsx Sep 24, 2026
7663d34
test(crowdstrike): regression for the review corrections
kryonsx Sep 24, 2026
4cc064a
docs(crowdstrike): record the review, its proof and what is deferred
kryonsx Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
200 changes: 200 additions & 0 deletions filters/audits/crowdstrike.md
View file
Open in desktop

Large diffs are not rendered by default.

27 changes: 0 additions & 27 deletions filters/crowdstrike/crowdstrike.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,11 +109,6 @@ pipeline:
- log.event.Attributes.sub_component_3
to: log.eventAttributesSubComponent3

- rename:
from:
- log.event.Attributes.trace_id
to: log.eventAttributesTraceID

- rename:
from:
- log.event.Attributes.user_agent
Expand Down Expand Up @@ -214,11 +209,6 @@ pipeline:
- log.event.Source
to: log.eventSource

- rename:
from:
- log.event.ServiceName
to: log.eventServiceName

- rename:
from:
- log.event.SourceIp
Expand Down Expand Up @@ -264,11 +254,6 @@ pipeline:
- log.metadata.version
to: log.metadataVersion

- rename:
from:
- log.event.Message
to: log.eventMessage

- rename:
from:
- log.event.AgentId
Expand Down Expand Up @@ -617,18 +602,6 @@ pipeline:
# .......................................................................#
# Remove inecesarie caracters
# .......................................................................#
- trim:
function: prefix
substring: '"'
fields:
- log.eventCommandLine

- trim:
function: suffix
substring: '"'
fields:
- log.eventCommandLine

- trim:
function: prefix
substring: '[{'
Expand Down
Loading
Loading