[carbon_black_cloud]: Process Start events not mapped correctly

[mike-flowers-airbnb]

Integration Name

VMware Carbon Black Cloud [carbon_black_cloud]

Dataset Name

carbon_black_cloud.endpoint_event

Integration Version

2.6.1

Agent Version

8.15.2

Agent Output Type

elasticsearch

Elasticsearch Version

8.15.1

OS Version and Architecture

Elastic Cloud

Software/API Version

No response

Error Message

No response

Event Original

No response

What did you do?

Default configuration for the integration

What did you see?

When reviewing events with event.action: ACTION_CREATE_PROCESS, the resulting process.*+process.parent.* do not accurately reflect the process being created and it's parent. Instead, the data reflects the parent + grandparent involved in the process creation. See below command line fields that are available for a sample record:

field	value
carbon_black_cloud.endpoint_event.target_cmdline	Google Chrome Helper (Renderer)
process.command_line	Google Chrome --restart --restart
process.parent.command_line	launchd

What did you expect to see?

The expectation here is threefold:

• The "child" event would populate the process.* fields
• The "process" event would populate the process.parent.* fields
• The "parent" event would populate some other field such as carbon_black_cloud.endpoint_event.grandparent

To accomplish this the mapping would need to rename the following:

• process.* -> process.parent.*
• process.parent.* -> carbon_black_cloud.endpoint_event.grandparent.*
• carbon_black_cloud.endpoint_event.childproc.guid -> process.entity_id
• carbon_black_cloud.endpoint_event.childproc.hash.md5 -> process.hash.md5
• carbon_black_cloud.endpoint_event.childproc.hash.sha256 -> process.hash.sha256
• carbon_black_cloud.endpoint_event.childproc.name -> process.executable
• carbon_black_cloud.endpoint_event.childproc.pid -> process.pid
• carbon_black_cloud.endpoint_event.childproc.username -> process.user.name

Anything else?

cc: @btrieger

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

@mike-flowers-airbnb I have prepared #11686. Please take a look to see that it satisfies the requirement. Are you able to point to some documentation for the mapping that CBC uses?

[mike-flowers-airbnb]

@efd6 Appreciate the quick PR. Left some comments on it. For the documentation, this will be the best reference: https://developer.carbonblack.com/reference/carbon-black-cloud/data-forwarder/schema/latest/endpoint.event-1.1.0/#fields

[narph]

@efd6, can you update the ticket with the conclusions on the PR? is the request still relevant?

[efd6]

This is still relevant.

[efd6]

@mike-flowers-airbnb Apologies for the long absence. I've taken another approach with this which I think is more maintainable and which I think more correctly addresses the issue here. If you are still interested, please take a look at the PR at #15772.

[mike-flowers-airbnb]

@efd6 Ahhh, brilliant, that'll work nicely. Thanks much for the follow up!