Zeek-Endpoint-Enrichment¶
The Zeek-Endpoint-Enrichment Zeek package uses an input file named “hosts_data.tsv”, that contains additional information about endpoints or hosts within an environment, to enrich multiple logs with relevant data. Depending on the data available, and the options enabled, this package can enrich the following logs:
known_devices
known_domains
known_hosts
known_names
conn (optional)
Note
Additional fields will only be created is the relevant data is available.
Input file (hosts_data.tsv)¶
The input file contains the following information (if it’s available):
IP address (required)
MAC address
Hostname
Host Unique ID
Customer ID
OS version
Endpoint status
Machine domain
Additional description
Endpoint information source (required)
The following is a sample input file created by this integration, using tab-separated values.
#fields ip mac hostname uid cid os_version status machine_domain desc source
192.168.56.103 00-50-56-A3-B1-C2 WEF ced83f0c26493b638086fdc7b8b2c01d e29b670f12d342e3bcc7170a288a0xxx - managed - Exposure Management CrowdStrike
10.21.0.102 00-50-56-A1-B1-C4 DC c53fdc3178ba36759c471d6b6655e324 e29b670f12d342e3bcc7170a288a0xxx - managed - Exposure Management CrowdStrike
192.168.56.104 00-50-56-A2-B1-C2 WIN10 abb6c27309cf3730bb73e8cfd732d838 e29b670f12d342e3bcc7170a288a0xxx Windows 10 managed lab.local Exposure Management CrowdStrike
192.168.1.155 92-91-E0-3E-66-A8 ss2oh 9caa11e26d1f371797e73e9b9199d481 e29b670f12d342e3bcc7170a288a0xxx - managed - Exposure Management CrowdStrike
192.168.1.120 00-0C-29-AB-75-05 fleet 81f845fe72ae32168aba94707fc8a49f e29b670f12d342e3bcc7170a288a0xxx - managed - Exposure Management CrowdStrike
192.168.12.1 - - 613cd0e8a671350e83dec735143db1e0 e29b670f12d342e3bcc7170a288a0xxx - unsupported - Exposure Management CrowdStrike
192.168.12.210 - - 5f67453d7e833b0f82ac1d7a5788142a e29b670f12d342e3bcc7170a288a0xxx - unmanaged - Exposure Management CrowdStrike
192.168.12.222 - - 5abcec34b3443f3cb7fe17c4f7100e02 e29b670f12d342e3bcc7170a288a0xxx - unmanaged - Exposure Management CrowdStrike
192.168.12.212 00-50-56-A1-1F-07 skynet 439293445449716808dec735143db1e9 e29b670f12d342e3bcc7170a288a0xxx Ubuntu 22.04 managed - Exposure Management CrowdStrike
known_hosts log¶
The known_hosts log will always be enriched (with available data) for local hosts. A typical known_hosts.log will contain “endpoint” data similar to this example:
{
_path: known_hosts
_system_name: Lab-AP200
_write_ts: 2023-08-22T13:20:59.526107Z
annotations: [ ]
conns_closed: 167
conns_opened: 167
conns_pending: 0
duration: 920.0746190547943
endpoint.uid: 439293445449716808dec735143db1e9
endpoint.cid: e29b670f12d342e3bcc7170a288a0xxx
endpoint.os_version: Ubuntu 22.04
endpoint.source: CrowdStrike
endpoint.status: managed
host_ip: 192.168.12.212
kuid: Kf1THOpT9hJa5
last_active_interval: 954.522488117218
last_active_session: KfqhT6kg6fP7k
long_conns: 0
ts: 2023-08-22T13:04:54.000617Z
}
known_devices log¶
The known_devices entry will only be created if the MAC is available. A typical known_devices.log provides content similar to this example:
{
_path: known_devices
_system_name: Lab-AP200
_write_ts: 2023-08-22T13:20:59.526107Z
annotations: [
CrowdStrike/managed
]
duration: 920.0746190547943
host_ip: 192.168.12.212
kuid: Kf1THOpT9hJa5
last_active_interval: 954.522488117218
last_active_session: KfqhT6kg6fP7k
mac: 00:50:56:A1:1F:07
num_conns: 0
protocols: [
CrowdStrike
]
ts: 2023-08-22T13:04:54.000617Z
vendor_mac: unknown
}
known_domains log¶
The known_domains entry will only be created if the “Machine Domain” is available. A typical known_domains.log provides content similar to this example:
{
_path: known_domains
_system_name: Lab-AP200
_write_ts: 2023-08-22T13:51:39.591783Z
annotations: [
CrowdStrike/managed
]
domain: LAB.LOCAL
duration: 0
host_ip: 192.168.56.104
kuid: KfkAPIKyTuYv3
last_active_interval: 42202.37188410759
last_active_session: Kf64KcY1eZwM
num_conns: 1
protocols: [
CrowdStrike
]
ts: 2023-08-22T13:47:23.586163Z
}
known_names log¶
The known_names entry will only be created if the hostname is available. A typical known_names.log provides content similar to this example:
{
_path: known_names
_system_name: Lab-AP200
_write_ts: 2023-08-22T13:20:59.526107Z
annotations: [
CrowdStrike/managed
]
duration: 920.0746190547943
host_ip: 192.168.12.212
hostname: SKYNET
kuid: Kf1THOpT9hJa5
last_active_interval: 954.522488117218
last_active_session: KfqhT6kg6fP7k
num_conns: 0
protocols: [
CrowdStrike
]
ts: 2023-08-22T13:04:54.000617Z
}
conn log¶
If enabled, a typical conn.log provides content similar to this example:
Note
Information related to “orig” or “resp” could come from different sources.
{
_path: conn
_system_name: Lagermann-AP200
_write_ts: 2024-01-02T20:26:10.053352Z
community_id: 1:1NvB5baKk/lZPT4viHWj2WIhJmU=
conn_state: SF
duration: 0.005825996398925781
history: ShADadFf
id.orig_h: 192.168.9.92
id.orig_p: 50600
id.resp_h: 192.168.10.1
id.resp_p: 8080
local_orig: true
local_resp: true
missed_bytes: 0
orig_bytes: 5968
orig_endpoint_source: Unifi
orig_endpoint_status: managed
orig_ip_bytes: 6380
orig_l2_addr: 80:2a:a8:10:ac:38
orig_pkts: 10
proto: tcp
resp_bytes: 739
resp_endpoint_uid: 439293445449716808dec735143db1e9
resp_endpoint_cid: e29b670f12d342e3bcc7170a288a0xxx
resp_endpoint_source: CrowdStrike
resp_endpoint_status: unsupported
resp_ip_bytes: 1071
resp_l2_addr: f4:92:bf:91:2e:f7
resp_pkts: 8
service: http
ts: 2024-01-02T20:26:05.046747Z
uid: C2Bnzv2iJGj1VNTbdd
}