收集 Microsoft Windows Sysmon 数据

此文档：

  • 介绍部署架构和安装步骤，以及生成 Microsoft Windows Sysmon 事件的 Chronicle 解析器支持的日志所需的任何配置。如需简要了解 Chronicle 数据注入，请参阅将数据注入到 Chronicle。
  • 包含有关解析器如何将原始日志中的字段映射到 Chronicle Unified Data Model 字段的信息。

本文档中的信息适用于具有 WINDOWS_SYSMON 注入标签的解析器。注入标签标识哪个解析器将原始日志数据标准化为结构化 UDM 格式。

准备工作

下图表示部署架构中推荐的核心组件，用于收集 Microsoft Windows Sysmon 数据并将其发送到 Chronicle。将此信息与您的环境进行比较，以确保已安装这些组件。每个客户部署都与此表示法不同，并且可能更复杂。以下是必须满足的条件：

  • 部署架构中的系统使用世界协调时间 (UTC) 时区进行配置。
  • Sysmon 安装在服务器、端点和网域控制器上。
  • 收集器 Microsoft Windows 服务器接收来自服务器、端点和网域控制器的日志。

  • 部署架构中的 Microsoft Windows 系统：

    • 使用来源发起的订阅来收集多个设备上的事件。
    • 使用 WinRM 服务来管理远程系统。

  • NXLog 安装在收集器 Windows 服务器上，以将日志转发到 Chronicle 转发器。

  • Chronicle 转发器安装在中央 Microsoft Windows 服务器或 Linux 服务器上。

    部署架构

查看支持的设备和版本

Chronicle 解析器支持由以下 Microsoft Windows 服务器版本生成的日志。Microsoft Windows Server 按以下版本发布：Foundation、Essentials、Standard 和 Datacenter。每个版本生成的日志事件架构没有区别。

  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2012

Chronicle 解析器支持以下各项生成的日志：

  • Microsoft Windows 7 及更高版本的客户端系统
  • Sysmon 13.24 版。

Chronicle 解析器支持 NXLog Community 或 Enterprise Edition 收集的日志。

查看支持的日志类型

Chronicle 解析器支持 Microsoft Windows Sysmon 生成的以下日志类型。如需详细了解这些日志类型，请参阅 Microsoft Windows Sysmon 文档。它支持使用英语文本生成的日志，不支持使用非英语生成的日志。

日志类型 说明
Sysmon 日志 Sysmon 通道包含 27 个事件 ID。事件 ID：1 至 26 和 255。
如需了解此日志类型的说明，请参阅 Microsoft Windows Sysmon 事件文档

配置 Microsoft Windows 服务器、端点和网域控制器

  1. 安装并配置服务器、端点和网域控制器。如需了解详情，请参阅 Microsoft Windows Sysmon 配置文档。
  2. 设置收集器 Microsoft Windows 服务器，以解析从多个系统收集的日志。
  3. 设置中央 Microsoft Windows 或 Linux 服务器
  4. 使用世界协调时间 (UTC) 时区配置所有系统。
  5. 配置设备以将日志转发到收集器 Microsoft Windows 服务器。

配置 NXLog 和 Chronicle 转发器

  1. 在收集器 Microsoft Windows 服务器上安装 NXLog。遵循 NXLog 文档，包括有关配置 NXLog 以从 Sysmon 收集日志的信息。

  2. 为 NXLog 创建配置文件。使用 im_msvistalog 输入模块。以下是 NXLog 配置示例。将 <hostname> 和 <port> 值替换为目标中央 Microsoft Windows 或 Linux 服务器的信息。如需了解详情，请参阅有关 om_tcp 模块的 NXLog 文档。

    define ROOT     C:\Program Files (x86)\nxlog
define SYSMON_OUTPUT_DESTINATION_ADDRESS <hostname>
define SYSMON_OUTPUT_DESTINATION_PORT <port>
define CERTDIR  %ROOT%\cert
define CONFDIR  %ROOT%\conf
define LOGDIR   %ROOT%\data
define LOGFILE  %LOGDIR%\nxlog.log
LogFile %LOGFILE%

Moduledir %ROOT%\modules
CacheDir  %ROOT%\data
Pidfile   %ROOT%\data\nxlog.pid
SpoolDir  %ROOT%\data

<Extension _json>
    Module      xm_json
</Extension>

<Input windows_sysmon_eventlog>
    Module  im_msvistalog
    <QueryXML>
        <QueryList>
            <Query Id="0">
                <Select Path="Microsoft-Windows-Sysmon/Operational">*</Select>
            </Query>
        </QueryList>
    </QueryXML>
    ReadFromLast  False
    SavePos  False
</Input>

<Output out_chronicle_sysmon>
    Module      om_tcp
    Host        %SYSMON_OUTPUT_DESTINATION_ADDRESS%
    Port        %SYSMON_OUTPUT_DESTINATION_PORT%
    Exec        $EventTime = integer($EventTime) / 1000;
    Exec        $EventReceivedTime = integer($EventReceivedTime) / 1000;
    Exec        to_json();
</Output>

<Route r2>
    Path    windows_sysmon_eventlog => out_chronicle_sysmon
</Route>

  3. 在中央 Microsoft Windows 或 Linux 服务器上安装 Chronicle 转发器。如需了解如何安装和配置转发器，请参阅在 Linux 上安装和配置转发器或在 Microsoft Windows 上安装和配置转发器。

  4. 配置 Chronicle 转发器，以将日志发送到 Chronicle。以下是转发器配置示例。

      - syslog:
      common:
        enabled: true
        data_type: WINDOWS_SYSMON
        Data_hint:
        batch_n_seconds: 10
        batch_n_bytes: 1048576
      tcp_address: 0.0.0.0:10518
      connection_timeout_sec: 60

  5. 启动 NXLog 服务。

字段映射参考信息：设备事件字段到 UDM 字段

本部分介绍解析器如何将原始设备日志字段映射到 Unified Data Model (UDM) 字段。字段映射可能因事件 ID 而异。

常用字段

NXLog 字段 UDM 字段
UtcTime metadata.event_timestamp
类别 security_result.summary 和 metadata.product_event_type
AccountName principal.user.userid
网域 principal.administrative_domain
RecordNumber metadata.product_log_id
HostName principal.hostname
UserID principal.user.windows_sid
SeverityValue security_result.severity
ProcessID observer.process.pid
ProviderGuid observer.asset_id
LogonId principal.network.session_id
ThreadID additional.fields.key 设置为 thread_id，且值存储在 additional.fields.value.string_value 中
通道 additional.fields.key 设置为 channel，且值存储在 additional.fields.value.string_value 中
EventID security_result.rule_name 设置为 EventID: <EventID>

metadata.product_event_type 设置为 <Category> [<EventID>]

事件 ID：1

NXLog 字段 UDM 字段
metadata.event_type set to PROCESS_LAUNCH
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid target.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId target.process.pid
IntegrityLevel The value for the field target.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the target.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the target.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the target.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the target.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the target.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the target.process.integrity_level_rid UDM field is set to 20480
Image target.process.file.full_path
Description metadata.description
CommandLine target.process.command_line
CurrentDirectory additional.fields.key set to current_directory and value stored in additional.fields.value.string_value
User Domain stored in principal.administrative_domain

Username stored in principal.user.userid
Hashes Based on Hash algorithm.
  • MD5 stored in target.process.file.md5
  • SHA256 stored in target.process.file.sha256
  • SHA1 stored in target.process.file.sha1
ParentProcessGuid principal.process.product_specific_process_id set to SYSMON:<ParentProcessGuid>
ParentProcessId principal.process.pid
ParentImage principal.process.file.full_path
ParentCommandLine principal.process.command_line

事件 ID：2

NXLog 字段 UDM 字段
metadata.event_type set to FILE_MODIFICATION
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image principal.process.file.full_path
TargetFilename target.file.full_path
CreationUtcTime target.resource.attribute.labels.key set to CreationUtcTime and value stored in target.resource.attribute.labels.value
PreviousCreationUtcTime target.resource.attribute.labels.key set to PreviousCreationUtcTime and value stored in target.resource.attribute.labels.value

事件 ID：3

NXLog 字段 UDM 字段
metadata.event_type set to NETWORK_CONNECTION

security_result.action set to ALLOW

network.direction set to OUTBOUND
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image principal.process.file.full_path
User Domain stored in principal.administrative_domain

Username stored in principal.user.userid
Protocol network.ip_protocol
SourceIp principal.ip
SourcePort principal.port
DestinationIp target.ip
DestinationHostname target.hostname
DestinationPort target.port

事件 ID：4

NXLog 字段 UDM 字段
metadata.event_type set to SETTING_MODIFICATION

target.resource.resource_type set to SETTING

target.resource.resource_subtype set to State
UtcTime metadata.event_timestamp
State target.resource.name
Version metadata.product_version

事件 ID：5

NXLog 字段 UDM 字段
metadata.event_type set to PROCESS_TERMINATION
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId target.process.pid
IntegrityLevel The value for the field target.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the target.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the target.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the target.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the target.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the target.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the target.process.integrity_level_rid UDM field is set to 20480
Image target.process.file.full_path

事件 ID：6

NXLog 字段 UDM 字段
metadata.event_type set to PROCESS_MODULE_LOAD
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ImageLoaded principal.process.file.full_path
Hashes The field populated is determined by the Hash algorithm.
  • MD5 stored in target.process.file.md5
  • SHA256 stored in target.process.file.sha256
  • SHA1 stored in target.process.file.sha1
Signed target.resource.attribute.labels.key set to Signed and value set to target.resource.attribute.labels.value
Signature target.resource.attribute.labels.key set to Signature and value stored in target.resource.attribute.labels.value
SignatureStatus target.resource.attribute.labels.key set to SignatureStatus and value stored in target.resource.attribute.labels.value

事件 ID：7

NXLog 字段 UDM 字段
metadata.event_type set to PROCESS_MODULE_LOAD
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image principal.process.file.full_path
ImageLoaded target.process.file.full_path
Description metadata.description
Hashes The field populated is determined by the Hash algorithm.
  • MD5 stored in target.process.file.md5
  • SHA256 stored in target.process.file.sha256
  • SHA1 stored in target.process.file.sha1
Signed target.resource.attribute.labels.key set to Signed and value stored in target.resource.attribute.labels.value
Signature target.resource.attribute.labels.key set to Signature
Signature value in target.resource.attribute.labels.value
SignatureStatus target.resource.attribute.labels.key set to SignatureStatus and value stored in target.resource.attribute.labels.value

事件 ID：8

NXLog 字段 UDM 字段
metadata.event_type set to PROCESS_MODULE_LOAD
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
SourceProcessGuid principal.process.product_specific_process_id set to SYSMON:<SourceProcessGuid>
SourceProcessId principal.process.pid
SourceImage principal.process.file.full_path
TargetProcessGuid target.process.product_specific_process_id set to SYSMON:<TargetProcessGuid>
TargetProcessId target.process.pid
TargetImage target.process.file.full_path

事件 ID：9

NXLog 字段 UDM 字段
metadata.event_type set to FILE_READ

If the Device log field, which is required to validate the FILE_READ UDM event type, is not available, then metadata.event_type is set to GENERIC_EVENT.

RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image principal.process.file.full_path
Device target.file.full_path

事件 ID：10

NXLog 字段 UDM 字段
metadata.event_type set to PROCESS_OPEN

target.resource.resource_subtype set to GrantedAccess
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
SourceProcessGUID principal.process.product_specific_process_id set to SYSMON:<SourceProcessGUID>
SourceProcessId principal.process.pid
SourceImage principal.process.file.full_path
TargetProcessGUID target.process.product_specific_process_id set to SYSMON:<TargetProcessGUID>
TargetProcessId target.process.pid
TargetImage target.process.file.full_path
GrantedAccess target.resource.name

事件 ID：11

NXLog 字段 UDM 字段
metadata.event_type set to FILE_CREATION

target.resource.resource_subtype set to CreationUtcTime
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image principal.process.file.full_path
TargetFilename target.file.full_path
CreationUtcTime target.resource.name

事件 ID：12

NXLog 字段 UDM 字段
If the Message the field contains CreateKey|CreateValue, then metadata.event_type set to REGISTRY_CREATION

If the Message field contains DeleteKey|DeleteValue, then
metadata.event_type set to REGISTRY_DELETION

Otherwise, metadata.event_type set to REGISTRY_MODIFICATION
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image principal.process.file.full_path
TargetObject target.registry.registry_key

事件 ID：13

NXLog 字段 UDM 字段
metadata.event_type set to REGISTRY_MODIFICATION
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image principal.process.file.full_path
TargetObject target.registry.registry_key
Details target.registry.registry_value_data

事件 ID：14

NXLog 字段 UDM 字段
metadata.event_type set to REGISTRY_MODIFICATION
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image principal.process.file.full_path
TargetObject src.registry.registry_key
NewName target.registry.registry_key

事件 ID：15

NXLog 字段 UDM 字段
metadata.event_type set to FILE_CREATION
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image principal.process.file.full_path
TargetFilename target.file.full_path
CreationUtcTime target.resource.attribute.labels.key set to CreationUtcTime and value stored in target.resource.attribute.labels.value
Hash The field populated is determined by the Hash algorithm.
  • If MD5, the value is stored in target.process.file.md5
  • If SHA256 set to the value is stored in target.process.file.sha256
  • If SHA1, the value is stored in target.process.file.sha1

事件 ID：16

NXLog 字段 UDM 字段
metadata.event_type set to SETTING_MODIFICATION
UtcTime metadata.event_timestamp
ProcessID target.process.pid
Configuration The value is stored in target.process.command_line when this field value contains any command line or process

The value is stored in target.process.file.full_path when this field value contains the configuration file path.
ConfigurationFileHash The field populated is determined by the Hash algorithm.
  • If MD5, the value is stored in target.process.file.md5
  • If SHA256 set to the value is stored in target.process.file.sha256
  • If SHA1, the value is stored in target.process.file.sha1

事件 ID：17

NXLog 字段 UDM 字段
metadata.event_type set to PROCESS_UNCATEGORIZED

target.resource.resource_type set to PIPE
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid target.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId target.process.pid
IntegrityLevel The value for the field target.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the target.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the target.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the target.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the target.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the target.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the target.process.integrity_level_rid UDM field is set to 20480
PipeName target.resource.name
Image target.process.file.full_path

事件 ID：18

NXLog 字段 UDM 字段
metadata.event_type set to PROCESS_UNCATEGORIZED

target.resource.resource_type set to PIPE
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid target.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId target.process.pid
IntegrityLevel The value for the field target.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the target.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the target.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the target.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the target.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the target.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the target.process.integrity_level_rid UDM field is set to 20480
PipeName target.resource.name
Image target.process.file.full_path

事件 ID：19

NXLog 字段 UDM 字段
metadata.event_type set to USER_RESOURCE_ACCESS
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
Operation
User The Domain is stored in principal.administrative_domain

The Username is stored in principal.user.userid
EventNamespace target.file.full_path
Name target.application
Query target.resource.name

事件 ID：20

NXLog 字段 UDM 字段
metadata.event_type set to USER_RESOURCE_ACCESS
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
Operation target.resource.attribute.labels.key set to Operation and the value is stored in target.resource.attribute.labels.value
User The domain is stored in principal.administrative_domain

The Username is stored in principal.user.userid
Name target.resource.attribute.labels.key set to Name
Name value in target.resource.attribute.labels.value
Type target.resource.attribute.labels.key set to Type and the value is stored in target.resource.attribute.labels.value
Destination target.resource.name

事件 ID：21

NXLog 字段 UDM 字段
metadata.event_type set to USER_RESOURCE_ACCESS
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
Operation target.resource.attribute.labels.key set to Operation and the value is stored in target.resource.attribute.labels.value
User The domain is stored in principal.administrative_domain

The username is stored in principal.user.userid
Consumer target.resource.attribute.labels.key set to Consumer and the value is stored in target.resource.attribute.labels.value
Filter target.resource.name

事件 ID：22

NXLog 字段 UDM 字段
metadata.event_type set to NETWORK_DNS

network.application_protocol set to DNS
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
QueryName network.dns.questions
QueryStatus Stored in security_result.summary as Query Status: <QueryStatus>
QueryResults Type is saved to network.dns.answers.type with values separated by a semicolon (;)
Data is saved to network.dns.answers.data
Values that do not have type are mapped to network.dns.answers.data.
Image principal.process.file.full_path

事件 ID：23

NXLog 字段 UDM 字段
metadata.event_type set to FILE_DELETION
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
User Domain stored into principal.administrative_domain

Username stored in principal.user.userid
Image principal.process.file.full_path
TargetFilename target.file.full_path
Hashes The field populated is determined by the Hash algorithm.
  • MD5 set to target.process.file.md5
  • SHA256 set to target.process.file.sha256
  • SHA1 set to target.process.file.sha1
IsExecutable Field target.resource.attribute.labels.key set to IsExecutable and the value is stored in target.resource.attribute.labels.value
Archived target.resource.attribute.labels.key set to Archived and the value is stored in target.resource.attribute.labels.value

事件 ID：24

NXLog 字段 UDM 字段
metadata.event_type set to RESOURCE_READ
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid target.process.product_specific_process_id set to SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image target.process.file.full_path

target.resource.name
ClientInfo ip stored in target.ip
hostname stored in target.hostname
user stored in principal.user.userid
Hashes The field populated is determined by the Hash algorithm.
  • If MD5, value stored in target.process.file.md5
  • If SHA256, value stored in target.process.file.sha256
  • If SHA1, value stored in target.process.file.sha1
Archived target.resource.attribute.labels.key set to Archived and value stored in target.resource.attribute.labels.value

事件 ID：25

NXLog 字段 UDM 字段
metadata.event_type set to PROCESS_LAUNCH
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid target.process.product_specific_process_id stored as SYSMON:<ProcessGuid>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
Image target.process.file.full_path

事件 ID：26

NXLog 字段 UDM 字段
metadata.event_type set to FILE_DELETION
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id set to SYSMON:<%{ProcessGuid}>
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
User Domain set to principal.administrative_domain

Username set to principal.user.userid
Image principal.process.file.full_path
TargetFilename target.file.full_path
Hashes Based on Hash algorithm.
MD5 set to target.process.file.md5
SHA256 set to target.process.file.sha256
SHA1 set to target.process.file.sha1
IsExecutable target.resource.attribute.labels.key set to IsExecutable & value in target.resource.attribute.labels.value

事件 ID：29

NXLog 字段 UDM 字段
metadata.event_type set to FILE_CREATION
RuleName security_result.rule_name
UtcTime metadata.event_timestamp
ProcessGuid principal.process.product_specific_process_id is set to SYSMON:<PROCESS_GUID> PROCESS_GUID is the ProcessGuid. The ProcessGuid field is a unique value for this process across a domain to make event correlation easier.
ProcessId principal.process.pid
IntegrityLevel The value for the field principal.process.integrity_level_rid is determined based on the value of the field IntegrityLevel as follows:
  • If the IntegrityLevel log field value matches the regular expression Untrusted, then the principal.process.integrity_level_rid UDM field is set to 0
  • If the IntegrityLevel log field value matches the regular expression Low, then the principal.process.integrity_level_rid UDM field is set to 4096
  • If the IntegrityLevel log field value matches the regular expression Medium, then the principal.process.integrity_level_rid UDM field is set to 8192
  • If the IntegrityLevel log field value matches the regular expression High, then the principal.process.integrity_level_rid UDM field is set to 12288
  • If the IntegrityLevel log field value matches the regular expression System, then the principal.process.integrity_level_rid UDM field is set to 16384
  • If the IntegrityLevel log field value matches the regular expression Protected, then the principal.process.integrity_level_rid UDM field is set to 20480
User Domain is set to principal.administrative_domain

Username is set to principal.user.userid
Image principal.process.file.full_path
TargetFilename target.file.full_path
Hashes Based on the hash algorithm, the following values are set:
  • MD5 is set to target.process.file.md5
  • SHA256 is set to target.process.file.sha256
  • SHA1 is set to target.process.file.sha1

事件 ID：255

NXLog 字段 UDM 字段
metadata.event_type set to SERVICE_UNSPECIFIED

metadata.product_event_type set to Error - [255]

target.application set to Microsoft Sysmon
UtcTime metadata.event_timestamp
ID security_result.summary
Description security_result.description