Sophos Central 集成

{
    "@timestamp": "2022-11-24T07:07:48.000Z",
    "agent": {
        "ephemeral_id": "f0294025-e37d-4210-bda4-eaf14642e17e",
        "id": "cf659b85-d5b7-4b0d-8b9a-4ea2e187d862",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.7.1"
    },
    "data_stream": {
        "dataset": "sophos_central.alert",
        "namespace": "ep",
        "type": "logs"
    },
    "destination": {
        "ip": "192.168.0.2",
        "port": 789
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "cf659b85-d5b7-4b0d-8b9a-4ea2e187d862",
        "snapshot": false,
        "version": "8.7.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "host"
        ],
        "code": "Event::Endpoint::Threat::PuaCleanupFailed",
        "created": "2022-11-24T07:07:52.094Z",
        "dataset": "sophos_central.alert",
        "id": "8bbd989a-6cab-407f-a586-c5064b94f76a",
        "ingested": "2023-05-24T14:37:54Z",
        "kind": [
            "alert"
        ],
        "original": "{\"created_at\":\"2022-11-24T07:07:52.094Z\",\"customer_id\":\"d1271b33-4e24-4cc3-951a-badc38976ca3\",\"data\":{\"certificates\":[],\"core_remedy_items\":{\"items\":[{\"descriptor\":\"C:\\\\\foo.dll\",\"processPath\":\"\",\"result\":\"SUCCESS\",\"sophosPid\":\"\",\"suspendResult\":\"NOT_APPLICABLE\",\"type\":\"file\"}],\"totalItems\":1},\"created_at\":1669273672085,\"endpoint_id\":\"0320820b-84b4-41ea-95fd-5893fb17e420\",\"endpoint_java_id\":\"0320820b-84b4-41ea-95fd-5893fb17e420\",\"endpoint_platform\":\"windows\",\"endpoint_type\":\"computer\",\"event_service_id\":{\"data\":\"ASctdeo4TVyAZU0SyIzlJg==\",\"type\":3},\"hmpa_exploit\":{\"family_id\":\"aecab125-0118-4828-a2bb-c0815aa5864d\",\"process_name\":\"Lightning:Notepad++\",\"process_path\":\"C:\\\\\Windows\\\\\Virus\",\"process_pid\":\"135510845\",\"process_version\":\"21.13.87\",\"thumbprint\":\"d99d375c1e190e6ccc77d22d51e8f9ed881bbb4af1342f618adf9f78358c6488\",\"type\":\"CryptoGuard\",\"uid\":\"344b9a0b-2271-0e14-0c61-0fa89122c6ad\",\"version\":\"2.13.7\"},\"inserted_at\":1669273672085,\"ips_threat\":{\"detection_type\":1,\"executable_name\":\"Bad Program\",\"executable_path\":\"C:\\\\\Program Files\\\\\Bad Vendor\\\\\Bad Program.exe\",\"executable_pid\":\"2468\",\"executable_version\":\"7.6.5\",\"local_port\":\"123\",\"raw_data\":\"Message       OS-WINDOWS Microsoft Windows SMB remote code execution attempt\\nReference     CVE-2017-0146\\nPacket type   TCP\\nLocal IP:     192.168.0.3\\nLocal Port:   123\\nLocal MAC:    00:50:b6:90:9e:e3\\nRemote IP:    192.168.0.2\\nRemote Port:  789\\nRemote MAC:   00:1C:B3:09:85:15\\nPID:          2468\\nExecutable:   C:\\\\\Program Files\\\\\Bad Vendor\\\\\Bad Program.exe\\nVersion:      7.6.5\\nSigner:       PositiveSSL CA 2\\nSHA-256:      19648CE85F07F4DEC80C4B37266C31A1025DAB5318DFF5C1AB1F65A7E7886B3C\",\"remote_ip\":\"192.168.0.2\",\"remote_port\":\"789\",\"tech_support_id\":\"2019052901.77863414.5\"},\"make_actionable_at\":1674533519751,\"policy_type\":30,\"source_app_id\":\"CORE\",\"source_info\":{\"ip\":\"10.1.39.32\"},\"threat_id\":{\"counter\":5044432,\"date\":1669273672000,\"machineIdentifier\":13006844,\"processIdentifier\":3865,\"time\":1669273672000,\"timeSecond\":1669273672,\"timestamp\":1669273672},\"threat_status\":\"NONE\",\"user_match_id\":{\"counter\":5199272,\"date\":1667463333000,\"machineIdentifier\":14271215,\"processIdentifier\":3997,\"time\":1667463333000,\"timeSecond\":1667463333,\"timestamp\":1667463333},\"user_match_uuid\":{\"data\":\"SltcnDmTSoSky+G00P5iTQ==\",\"type\":3}},\"description\":\"Manual PUA cleanup required: 'PUAqsw3kby31j' at 'C:\\\\\Program Files (x86)\\\\\Trojan Horse\\\\\bin\\\\\eicar.com'\",\"event_service_event_id\":\"8bbd989a-6cab-407f-a586-c5064b94f76a\",\"id\":\"8bbd989a-6cab-407f-a586-c5064b94f76a\",\"location\":\"Lightning-rvda5c291x\",\"severity\":\"medium\",\"source\":\"Domain\\\\\User\",\"threat\":\"PUAqsw3kby31j\",\"threat_cleanable\":false,\"type\":\"Event::Endpoint::Threat::PuaCleanupFailed\",\"when\":\"2022-11-24T07:07:48.000Z\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "message": "Manual PUA cleanup required: 'PUAqsw3kby31j' at 'C:\\Program Files (x86)\\Trojan Horse\\bin\\eicar.com'",
    "organization": {
        "id": "d1271b33-4e24-4cc3-951a-badc38976ca3"
    },
    "process": {
        "executable": "Bad Program",
        "name": "Lightning:Notepad++",
        "pid": 135510845
    },
    "related": {
        "hash": [
            "19648CE85F07F4DEC80C4B37266C31A1025DAB5318DFF5C1AB1F65A7E7886B3C"
        ],
        "ip": [
            "10.1.39.32",
            "192.168.0.2"
        ]
    },
    "sophos_central": {
        "alert": {
            "created_at": "2022-11-24T07:07:52.094Z",
            "customer_id": "d1271b33-4e24-4cc3-951a-badc38976ca3",
            "data": {
                "core_remedy": {
                    "items": [
                        {
                            "descriptor": "C:\\foo.dll",
                            "result": "SUCCESS",
                            "suspend_result": "NOT_APPLICABLE",
                            "type": "file"
                        }
                    ],
                    "total_items": 1
                },
                "created_at": "2022-11-24T07:07:52.085Z",
                "endpoint": {
                    "id": "0320820b-84b4-41ea-95fd-5893fb17e420",
                    "java_id": "0320820b-84b4-41ea-95fd-5893fb17e420",
                    "platform": "windows",
                    "type": "computer"
                },
                "event_service_id": {
                    "data": "ASctdeo4TVyAZU0SyIzlJg==",
                    "type": 3
                },
                "hmpa_exploit": {
                    "family_id": "aecab125-0118-4828-a2bb-c0815aa5864d",
                    "process_name": "Lightning:Notepad++",
                    "process_path": "C:\\Windows\\Virus",
                    "process_pid": 135510845,
                    "process_version": "21.13.87",
                    "thumbprint": "d99d375c1e190e6ccc77d22d51e8f9ed881bbb4af1342f618adf9f78358c6488",
                    "type": "CryptoGuard",
                    "uid": "344b9a0b-2271-0e14-0c61-0fa89122c6ad",
                    "version": "2.13.7"
                },
                "inserted_at": "2022-11-24T07:07:52.085Z",
                "ips_threat": {
                    "detection_type": 1,
                    "executable": {
                        "name": "Bad Program",
                        "path": "C:\\Program Files\\Bad Vendor\\Bad Program.exe",
                        "pid": "2468",
                        "version": "7.6.5"
                    },
                    "local_port": 123,
                    "raw_data": {
                        "executable": "C:\\Program Files\\Bad Vendor\\Bad Program.exe",
                        "local": {
                            "ip": "192.168.0.3",
                            "mac": "00-50-B6-90-9E-E3",
                            "port": 123
                        },
                        "message": "OS-WINDOWS Microsoft Windows SMB remote code execution attempt",
                        "original": "Message       OS-WINDOWS Microsoft Windows SMB remote code execution attempt\nReference     CVE-2017-0146\nPacket type   TCP\nLocal IP:     192.168.0.3\nLocal Port:   123\nLocal MAC:    00:50:b6:90:9e:e3\nRemote IP:    192.168.0.2\nRemote Port:  789\nRemote MAC:   00:1C:B3:09:85:15\nPID:          2468\nExecutable:   C:\\Program Files\\Bad Vendor\\Bad Program.exe\nVersion:      7.6.5\nSigner:       PositiveSSL CA 2\nSHA-256:      19648CE85F07F4DEC80C4B37266C31A1025DAB5318DFF5C1AB1F65A7E7886B3C",
                        "packet_type": "TCP",
                        "pid": "2468",
                        "reference": "CVE-2017-0146",
                        "remote": {
                            "ip": "192.168.0.2",
                            "mac": "00-1C-B3-09-85-15",
                            "port": 789
                        },
                        "sha_256": "19648CE85F07F4DEC80C4B37266C31A1025DAB5318DFF5C1AB1F65A7E7886B3C",
                        "signer": "PositiveSSL CA 2",
                        "version": "7.6.5"
                    },
                    "remote": {
                        "ip": "192.168.0.2",
                        "port": 789
                    },
                    "tech_support_id": "2019052901.77863414.5"
                },
                "make_actionable_at": "2023-01-24T04:11:59.751Z",
                "policy_type": 30,
                "source_app_id": "CORE",
                "source_info_ip": "10.1.39.32",
                "threat_id": {
                    "counter": 5044432,
                    "date": "2022-11-24T07:07:52.000Z",
                    "machine_identifier": 13006844,
                    "process_identifier": 3865,
                    "time": "2022-11-24T07:07:52.000Z",
                    "time_sec": "2022-11-24T07:07:52.000Z",
                    "timestamp": "2022-11-24T07:07:52.000Z"
                },
                "threat_status": "NONE",
                "user_match_id": {
                    "counter": 5199272,
                    "date": "2022-11-03T08:15:33.000Z",
                    "machine_identifier": 14271215,
                    "process_identifier": 3997,
                    "time": "2022-11-03T08:15:33.000Z",
                    "time_sec": "2022-11-03T08:15:33.000Z",
                    "timestamp": "2022-11-03T08:15:33.000Z"
                },
                "user_match_uuid": {
                    "data": "SltcnDmTSoSky+G00P5iTQ==",
                    "type": 3
                }
            },
            "description": "Manual PUA cleanup required: 'PUAqsw3kby31j' at 'C:\\Program Files (x86)\\Trojan Horse\\bin\\eicar.com'",
            "event_service_event_id": "8bbd989a-6cab-407f-a586-c5064b94f76a",
            "id": "8bbd989a-6cab-407f-a586-c5064b94f76a",
            "location": "Lightning-rvda5c291x",
            "severity": "medium",
            "source": {
                "domain": {
                    "name": "Domain"
                },
                "original": "Domain\\User",
                "user": {
                    "name": "User"
                }
            },
            "threat": {
                "cleanable": false,
                "value": "PUAqsw3kby31j"
            },
            "type": "Event::Endpoint::Threat::PuaCleanupFailed",
            "when": "2022-11-24T07:07:48.000Z"
        }
    },
    "source": {
        "ip": "10.1.39.32"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "sophos_central-alert"
    ],
    "user": {
        "domain": "Domain",
        "name": "User"
    }
}

{
    "@timestamp": "2022-12-06T12:27:28.094Z",
    "agent": {
        "ephemeral_id": "5347e925-6d9e-4a32-bda5-1785fd44709f",
        "id": "cf659b85-d5b7-4b0d-8b9a-4ea2e187d862",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.7.1"
    },
    "data_stream": {
        "dataset": "sophos_central.event",
        "namespace": "ep",
        "type": "logs"
    },
    "destination": {
        "ip": "81.2.69.192",
        "port": 789
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "cf659b85-d5b7-4b0d-8b9a-4ea2e187d862",
        "snapshot": false,
        "version": "8.7.1"
    },
    "event": {
        "action": "Malicious inbound network traffic blocked from remote computer at 192.168.0.2 (Technical Support reference: 2019052901.77863414.5)",
        "agent_id_status": "verified",
        "category": [
            "host"
        ],
        "created": "2022-12-06T12:27:31.310Z",
        "dataset": "sophos_central.event",
        "id": "3dab71db-32c9-426a-8616-1e0fd5c9aab9",
        "ingested": "2023-05-24T14:38:29Z",
        "kind": [
            "event"
        ],
        "original": "{\"created_at\":\"2022-12-06T12:27:31.310Z\",\"customer_id\":\"d1271b33-4e24-4cc3-951a-badc38976ca3\",\"endpoint_id\":\"fb11564b-2882-44ea-ac64-d1bfb041ab49\",\"endpoint_type\":\"computer\",\"group\":\"RUNTIME_DETECTIONS\",\"id\":\"3dab71db-32c9-426a-8616-1e0fd5c9aab9\",\"ips_threat_data\":{\"detectionType\":0,\"executableName\":\"\",\"localPort\":\"123\",\"rawData\":\"Message       OS-WINDOWS Microsoft Windows SMB remote code execution attempt\\nReference     CVE-2017-0146\\nPacket type   TCP\\nLocal IP:     81.2.69.192\\nLocal Port:   123\\nLocal MAC:    00:50:56:81:62:41\\nRemote IP:    81.2.69.192\\nRemote Port:  789\\nRemote MAC:   00:1C:B3:09:85:15\",\"remoteIp\":\"81.2.69.192\",\"remotePort\":\"789\",\"techSupportId\":\"2019052901.77863414.5\"},\"location\":\"Lightning-4naq56bx4j\",\"name\":\"Malicious inbound network traffic blocked from remote computer at 192.168.0.2 (Technical Support reference: 2019052901.77863414.5)\",\"severity\":\"low\",\"source\":\"Lightning-a3i691l7cv\\\\\Lightning\",\"source_info\":{\"ip\":\"81.2.69.192\"},\"threat\":\"IPS/Inbound/7777001\",\"type\":\"Event::Endpoint::Threat::IpsInboundDetection\",\"user_id\":\"638f34e1e5d0a20f3d40cf93\",\"when\":\"2022-12-06T12:27:28.094Z\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "d1271b33-4e24-4cc3-951a-badc38976ca3"
    },
    "related": {
        "ip": [
            "81.2.69.192"
        ]
    },
    "sophos_central": {
        "event": {
            "created_at": "2022-12-06T12:27:31.310Z",
            "customer_id": "d1271b33-4e24-4cc3-951a-badc38976ca3",
            "endpoint": {
                "id": "fb11564b-2882-44ea-ac64-d1bfb041ab49",
                "type": "computer"
            },
            "group": "RUNTIME_DETECTIONS",
            "id": "3dab71db-32c9-426a-8616-1e0fd5c9aab9",
            "ips_threat_data": {
                "detection_type": 0,
                "local_port": 123,
                "raw_data": {
                    "local": {
                        "ip": "81.2.69.192",
                        "mac": "00-50-56-81-62-41",
                        "port": 123
                    },
                    "message": "OS-WINDOWS Microsoft Windows SMB remote code execution attempt",
                    "original": "Message       OS-WINDOWS Microsoft Windows SMB remote code execution attempt\nReference     CVE-2017-0146\nPacket type   TCP\nLocal IP:     81.2.69.192\nLocal Port:   123\nLocal MAC:    00:50:56:81:62:41\nRemote IP:    81.2.69.192\nRemote Port:  789\nRemote MAC:   00:1C:B3:09:85:15",
                    "packet_type": "TCP",
                    "reference": "CVE-2017-0146",
                    "remote": {
                        "ip": "81.2.69.192",
                        "mac": "00-1C-B3-09-85-15",
                        "port": 789
                    }
                },
                "remote": {
                    "ip": "81.2.69.192",
                    "port": 789
                },
                "tech_support_id": "2019052901.77863414.5"
            },
            "location": "Lightning-4naq56bx4j",
            "name": "Malicious inbound network traffic blocked from remote computer at 192.168.0.2 (Technical Support reference: 2019052901.77863414.5)",
            "severity": "low",
            "source": {
                "domain": {
                    "name": "Lightning-a3i691l7cv"
                },
                "original": "Lightning-a3i691l7cv\\Lightning",
                "user": {
                    "name": "Lightning"
                }
            },
            "source_info": {
                "ip": "81.2.69.192"
            },
            "threat": "IPS/Inbound/7777001",
            "type": "Event::Endpoint::Threat::IpsInboundDetection",
            "user_id": "638f34e1e5d0a20f3d40cf93",
            "when": "2022-12-06T12:27:28.094Z"
        }
    },
    "source": {
        "ip": "81.2.69.192",
        "port": 123
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "sophos_central-event"
    ],
    "threat": {
        "feed": {
            "name": "IPS/Inbound/7777001"
        }
    },
    "user": {
        "domain": "Lightning-a3i691l7cv",
        "id": "638f34e1e5d0a20f3d40cf93",
        "name": "Lightning"
    }
}