Hi
if i have a log that contains 2 process ID , when i create parser can i add both to the same field ?
for example this windows log :
.....New Process ID: 0x72ac New Process Name: C:\Windows\System32\control.exe Token Elevation Type: %%1938 Mandatory Label: S-8-8-8-8 Creator Process ID: 0x3470 Creator Process Name: C:\Windows\System32\cmd.exe.....
i want to add both New Process ID and Creator Process ID to the same field
is it possible ?
in ASP its possible in the "Field Assignment" Tab
(e.g. Syslog, CEF, MEF, API etc.)
but i'm sorry to say that on WMI logs there's nothing to do.
McAfee ESM dosn't let Changes to the WMI Parsing Process.
Best regards.
Hi
yes i know that , the logs are insert with syslog , so this is not a problem
i wrote aprser , but if i add 2 keys to the same field it is write them together , i want to add them sepreatly so i try to click on the PLUS sign next to the field and seprate the keys but after i checked it still only show the first one.
is it possible ? look at the process_name field
Hi
try pressing again on the " + " Icon
insert them in the childrens "Process_name" field
Hi
i try to do what you suggeset , but after i rolled out the policy it is back to parnet and child by itself
did you manage to configure somthinf like that ?
Hi,
no, i didn't have a this issue in the past.
but when looking on the Check point Field Assignment (made by McAfee Team)
i see a lot of Parent & children definitens.
mabey try coping the way they did it.. for example i see in "threat name" field 3 children.
so it means it's possible somehow..
Best regards.
i take a look at the checkpoint field assigmnet , and you are right they are using parent & child , i take some checkpoint logs and insert in the sample cube to see if they are do what i want and it is seem not , they are not insert 2 different values to the same field , i guess they are using parent and child because there is changes in logs between checkpoint versions
Do you want the New Process ID and Creator Process ID to be in the same field?
If so, just put the following in Process_Name
3:1+" "+4:1
You could also do something like the following:
"New: "+3:1+" Creator: "+4:1
@mherr wrote:Do you want the New Process ID and Creator Process ID to be in the same field?
If so, just put the following in Process_Name
3:1+" "+4:1
You could also do something like the following:
"New: "+3:1+" Creator: "+4:1
Hi
I want them to be in the same field but separately, i mean that for 1 log i will have 2 process_id field in the costum types,
the reason i want it is because in this way i can build a correlation rule that group by this field and than i can check if low privilage process create a high privilage (privilage escaltion)
If there is other way i will happy to hear, if it is not explained well, i can write amore detailed explanation
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA