Zeek-Endpoint-Enrichment

The Zeek-Endpoint-Enrichment Zeek package uses an input file named “hosts_data.tsv”, that contains additional information about endpoints or hosts within an environment, to enrich multiple logs with relevant data. Depending on the data available, and the options enabled, this package can enrich the following logs:

  • known_devices

  • known_domains

  • known_hosts

  • known_names

  • conn (optional)

Note

Additional fields will only be created is the relevant data is available.

Input file (hosts_data.tsv)

The input file contains the following information (if it’s available):

  • IP address (required)

  • MAC address

  • Hostname

  • Host Unique ID

  • Customer ID

  • OS version

  • Endpoint status

  • Machine domain

  • Additional description

  • Endpoint information source (required)

The following is a sample input file created by this integration, using tab-separated values.

#fields  ip     mac                hostname  uid                               cid                               os_version    status        machine_domain  desc                 source
192.168.56.103  00-50-56-A3-B1-C2  WEF       ced83f0c26493b638086fdc7b8b2c01d  e29b670f12d342e3bcc7170a288a0xxx  -             managed       -               Exposure Management  CrowdStrike
10.21.0.102     00-50-56-A1-B1-C4  DC        c53fdc3178ba36759c471d6b6655e324  e29b670f12d342e3bcc7170a288a0xxx  -             managed       -               Exposure Management  CrowdStrike
192.168.56.104  00-50-56-A2-B1-C2  WIN10     abb6c27309cf3730bb73e8cfd732d838  e29b670f12d342e3bcc7170a288a0xxx  Windows 10    managed       lab.local       Exposure Management  CrowdStrike
192.168.1.155   92-91-E0-3E-66-A8  ss2oh     9caa11e26d1f371797e73e9b9199d481  e29b670f12d342e3bcc7170a288a0xxx  -             managed       -               Exposure Management  CrowdStrike
192.168.1.120   00-0C-29-AB-75-05  fleet     81f845fe72ae32168aba94707fc8a49f  e29b670f12d342e3bcc7170a288a0xxx  -             managed       -               Exposure Management  CrowdStrike
192.168.12.1    -                  -         613cd0e8a671350e83dec735143db1e0  e29b670f12d342e3bcc7170a288a0xxx  -             unsupported   -               Exposure Management  CrowdStrike
192.168.12.210  -                  -         5f67453d7e833b0f82ac1d7a5788142a  e29b670f12d342e3bcc7170a288a0xxx  -             unmanaged     -               Exposure Management  CrowdStrike
192.168.12.222  -                  -         5abcec34b3443f3cb7fe17c4f7100e02  e29b670f12d342e3bcc7170a288a0xxx  -             unmanaged     -               Exposure Management  CrowdStrike
192.168.12.212  00-50-56-A1-1F-07  skynet    439293445449716808dec735143db1e9  e29b670f12d342e3bcc7170a288a0xxx  Ubuntu 22.04  managed       -               Exposure Management  CrowdStrike

known_hosts log

The known_hosts log will always be enriched (with available data) for local hosts. A typical known_hosts.log will contain “endpoint” data similar to this example:

  {
    _path: known_hosts
    _system_name: Lab-AP200
    _write_ts: 2023-08-22T13:20:59.526107Z
    annotations: [ ]
    conns_closed: 167
    conns_opened: 167
    conns_pending: 0
    duration: 920.0746190547943
    endpoint.uid: 439293445449716808dec735143db1e9
    endpoint.cid: e29b670f12d342e3bcc7170a288a0xxx
    endpoint.os_version: Ubuntu 22.04
    endpoint.source: CrowdStrike
    endpoint.status: managed
    host_ip: 192.168.12.212
    kuid: Kf1THOpT9hJa5
    last_active_interval: 954.522488117218
    last_active_session: KfqhT6kg6fP7k
    long_conns: 0
    ts: 2023-08-22T13:04:54.000617Z
  }

known_devices log

The known_devices entry will only be created if the MAC is available. A typical known_devices.log provides content similar to this example:

  {
    _path: known_devices
    _system_name: Lab-AP200
    _write_ts: 2023-08-22T13:20:59.526107Z
    annotations: [
      CrowdStrike/managed
    ]
    duration: 920.0746190547943
    host_ip: 192.168.12.212
    kuid: Kf1THOpT9hJa5
    last_active_interval: 954.522488117218
    last_active_session: KfqhT6kg6fP7k
    mac: 00:50:56:A1:1F:07
    num_conns: 0
    protocols: [
      CrowdStrike
    ]
    ts: 2023-08-22T13:04:54.000617Z
    vendor_mac: unknown
  }

known_domains log

The known_domains entry will only be created if the “Machine Domain” is available. A typical known_domains.log provides content similar to this example:

  {
    _path: known_domains
    _system_name: Lab-AP200
    _write_ts: 2023-08-22T13:51:39.591783Z
    annotations: [
      CrowdStrike/managed
    ]
    domain: LAB.LOCAL
    duration: 0
    host_ip: 192.168.56.104
    kuid: KfkAPIKyTuYv3
    last_active_interval: 42202.37188410759
    last_active_session: Kf64KcY1eZwM
    num_conns: 1
    protocols: [
      CrowdStrike
    ]
    ts: 2023-08-22T13:47:23.586163Z
  }

known_names log

The known_names entry will only be created if the hostname is available. A typical known_names.log provides content similar to this example:

  {
    _path: known_names
    _system_name: Lab-AP200
    _write_ts: 2023-08-22T13:20:59.526107Z
    annotations: [
      CrowdStrike/managed
    ]
    duration: 920.0746190547943
    host_ip: 192.168.12.212
    hostname: SKYNET
    kuid: Kf1THOpT9hJa5
    last_active_interval: 954.522488117218
    last_active_session: KfqhT6kg6fP7k
    num_conns: 0
    protocols: [
      CrowdStrike
    ]
    ts: 2023-08-22T13:04:54.000617Z
  }

conn log

If enabled, a typical conn.log provides content similar to this example:

Note

Information related to “orig” or “resp” could come from different sources.

  {
    _path: conn
    _system_name: Lagermann-AP200
    _write_ts: 2024-01-02T20:26:10.053352Z
    community_id: 1:1NvB5baKk/lZPT4viHWj2WIhJmU=
    conn_state: SF
    duration: 0.005825996398925781
    history: ShADadFf
    id.orig_h: 192.168.9.92
    id.orig_p: 50600
    id.resp_h: 192.168.10.1
    id.resp_p: 8080
    local_orig: true
    local_resp: true
    missed_bytes: 0
    orig_bytes: 5968
    orig_endpoint_source: Unifi
    orig_endpoint_status: managed
    orig_ip_bytes: 6380
    orig_l2_addr: 80:2a:a8:10:ac:38
    orig_pkts: 10
    proto: tcp
    resp_bytes: 739
    resp_endpoint_uid: 439293445449716808dec735143db1e9
    resp_endpoint_cid: e29b670f12d342e3bcc7170a288a0xxx
    resp_endpoint_source: CrowdStrike
    resp_endpoint_status: unsupported
    resp_ip_bytes: 1071
    resp_l2_addr: f4:92:bf:91:2e:f7
    resp_pkts: 8
    service: http
    ts: 2024-01-02T20:26:05.046747Z
    uid: C2Bnzv2iJGj1VNTbdd
  }