Skip to content

crowdstrike: handle UTCTimestamp values in Unix seconds #13833

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 12, 2025
Merged

crowdstrike: handle UTCTimestamp values in Unix seconds #13833

merged 1 commit into from
May 12, 2025

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented May 7, 2025

Proposed commit message

crowdstrike: handle UTCTimestamp values in Unix seconds

Apparently Crowdstrike will send this field in seconds as well as
millis; we have test cases that show the latter already. On the basis
that security events are unlikely to be ocurring in the 1970s now, use
the heuristic that timestamp values less that 1e10 are seconds and parse
on that basis.

New test case obtained from a mutation of the existing test case with
this field, but with the UTCTimestamp field truncated by three
characters.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@efd6 efd6 self-assigned this May 7, 2025
@efd6 efd6 added enhancement New feature or request Integration:crowdstrike CrowdStrike Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels May 7, 2025
@efd6 efd6 force-pushed the s5945-crowdstrike branch from 9bebe5f to 84dd9af Compare May 7, 2025 21:25
efd6
efd6 commented May 7, 2025
View reviewed changes
packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log
@@ -135,3 +135,4 @@
{"ContextBaseFileName":"SenseImdsCollector.exe","event_simpleName":"DnsRequest","ContextTimeStamp":"1738009377.497","ConfigStateHash":"138674525","ContextProcessId":"683613242245","DomainName":"metadata.google.internal","ContextThreadId":"31712204862362","aip":"67.43.156.14","QueryStatus":"9003","InterfaceIndex":"0","ConfigBuild":"1007.3.0019011.15","event_platform":"Win","DnsRequestCount":"1","DualRequest":"1","Entitlements":"15","name":"DnsRequestV5","EventOrigin":"1","id":"3d0ef474-fcc3-4f18-9ad6-7130d8ddb407","EffectiveTransmissionClass":"3","aid":"31e92a267c044d57b1c1e14109079e89","timestamp":"1738009364034","cid":"ffffffff30a3407dae27d0503611022d","RequestType":"28"}
{"ProcessCreateFlags":"1024","IntegrityLevel":"8192","ParentProcessId":"434985540832797032","SourceProcessId":"434985540832797032","aip":"89.160.20.120","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-4084637156-299436391-3671333128-115430","event_platform":"Win","TokenType":"2","ProcessEndTime":"","ParentBaseFileName":"EmUser.exe","ImageSubsystem":"2","id":"9686a6b3-1d39-11ed-9370-0660bfa16adf","EffectiveTransmissionClass":"3","SessionId":"1","Tags":"25, 27, 862, 874, 924, 12094627905582, 12094627906234","timestamp":"1660636869410","event_simpleName":"ProcessRollup2","RawProcessId":"18446744072636268557","ConfigStateHash":"518095218","MD5HashData":"e570911fc2ab74ecf0dc59f324318f6e","SHA256HashData":"f470180a4f67ebd944570b3eaf040caa8c0713252c6228e60c413714375ccfe2","ProcessSxsFlags":"64","AuthenticationId":"29530993","ConfigBuild":"1007.3.0015103.1","CommandLine":"\"C:\\Program Files\\nirsoft\\SoundVolumeView.exe\" /SetDefault \"Teradici Virtual Audio Driver\\device\\speakers\\\" all","ParentAuthenticationId":"29530993","TargetProcessId":"434985669758362104","ImageFileName":"\\Device\\HarddiskVolume3\\Program Files\\NirSoft\\SoundVolumeView.exe","SourceThreadId":"434985668331321297","Entitlements":"15","name":"ProcessRollup2V19","ProcessStartTime":"1660636868.576","ProcessParameterFlags":"24577","aid":"50deaa55144543089a1f463b568cdc53","cid":"1301ac65ae144fbb9689a8472f828c2e"}
{"AgentLoadFlags":"none","AgentLocalTime":"none","AgentTimeOffset":"63878691745","AgentVersion":"2025.02.1","BiosManufacturer":"none","BiosVersion":"none","ChassisType":"none","City":"Bengaluru","ComputerName":"none","ConfigBuild":"1007.32.20250201.9","ConfigIDBuild":"20250201","Continent":"Asia","Country":"India","FalconGroupingTags":"none","FirstSeen":"1742447937.000","HostHiddenStatus":"visible","MachineDomain":"none","OU":"none","PointerSize":"none","ProductType":"none","SensorGroupingTags":"none","ServicePackMajor":"none","SiteName":"none","SystemManufacturer":"Apple","SystemProductName":"none","Time":"1743094945.000","Timezone":"Asia/Kolkata","Version":"iOS 18.3.2","aid":"44444444444444444444444444444444","aip":"0.0.0.0","cid":"55555555555555555555555555555555","event_platform":"iOS"}
{"AuthenticationId":"317005428","AuthenticationPackage":"Negotiate","ConfigBuild":"1007.3.0011603.1","ConfigStateHash":"3950066843","EffectiveTransmissionClass":"2","Entitlements":"15","LogoffTime":"1604855132.756","LogonDomain":"dom1","LogonServer":"srv2","LogonTime":"1604855131.666","LogonType":"7","PasswordLastSet":"1598119332.510","RemoteAccount":"1","UserFlags":"32","UserIsAdmin":"0","UserLogoffType":"3","UserLogonFlags":"0","UserName":"user4","UserPrincipal":"[email protected]","UserSid":"S-1-5-21-606747145-1364589140-725345543-28636","aid":"ffffffffe0104823bd3de859d5bc8bc7","aip":"67.43.156.13","cid":"ffffffff30a3407dae27d0503611022d","event_platform":"Win","event_simpleName":"UserLogoff","id":"ffffffff-1111-11eb-8913-0287fd11c79b","name":"UserLogoffV3","UTCTimestamp":"1604855134"}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is from here.

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented May 7, 2025 •
edited
Loading

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@efd6 efd6 marked this pull request as ready for review May 7, 2025 22:55
@efd6 efd6 requested a review from a team as a code owner May 7, 2025 22:55
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@efd6 efd6 force-pushed the s5945-crowdstrike branch from 84dd9af to cbf8626 Compare May 11, 2025 21:55
@efd6
crowdstrike: handle UTCTimestamp values in Unix seconds
e6cbb70 
Apparently Crowdstrike will send this field in seconds as well as
millis; we have test cases that show the latter already. On the basis
that security events are unlikely to be ocurring in the 1970s now, use
the heuristic that timestamp values less that 1e10 are seconds and parse
on that basis.

New test case obtained from a mutation of the existing test case with
this field, but with the UTCTimestamp field truncated by three
characters.
@efd6 efd6 force-pushed the s5945-crowdstrike branch from cbf8626 to e6cbb70 Compare May 12, 2025 07:14
@efd6 efd6 enabled auto-merge (squash) May 12, 2025 07:14
@elastic-sonarqube Elastic SonarQube
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

@elasticmachine
Copy link

💚 Build Succeeded

History

cc @efd6

@efd6 efd6 merged commit 7fa0fcd into elastic:main May 12, 2025
7 checks passed
@elastic-vault-github-plugin-prod
Copy link

Package crowdstrike - 1.66.0 containing this change is available at https://epr.elastic.co/package/crowdstrike/1.66.0/

@efd6 efd6 mentioned this pull request May 29, 2025
Merged
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kcreddy kcreddy kcreddy approved these changes

Assignees

@efd6 efd6

Labels
enhancement New feature or request Integration:crowdstrike CrowdStrike Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@efd6 @elasticmachine @kcreddy