Versions Compared

Version Old Version 3 New Version Current
Changes made by

Former user

Sharon Traineanu

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: set page status ready to publish

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

The Armor data lake is a centralized repository for storing Armor collected data. With regards to EDR, the data lake contains data for incidents in every environment, including endpoints. This can be a lot of data so narrowing down the scope of information is critical to making sense of it all.

Accessing the Datalake

...

Table of Contents
maxLevel3
minLevel3

Understanding the Datalake

...

The Armor data lake is a centralized repository for storing Armor collected data. With regards to EDR, the data lake contains data for incidents in every environment, including endpoints. This can be a lot of data so narrowing down the scope of information is critical to making sense of it all.

Accessing the Datalake

...

  1. In the Armor Management Portal (AMP), navigate to Security -> Log Search and SSO into ChaosSearch.

    AMP nav menu showing Log SearchImage Added

  2. Create a filter by doing the following:

    1. Click on Add filter.

    2. In Field select index.type.

    3. Select is for Operator.

    4. In the Value field, type

...

    1. endpoint-detections.

...

    2. Click Save.

...

    1. add filter exampleImage Added

  2. Now set the date range to encompass the incident date or dates to show and click Refresh.

...

  1. Refresh button in Log SearchImage Added

Data Presentation

...

Data consists of documents stored in the datalake. Each document contains all the data related to that particular rule and resource. Below are examples of the table and JSON views:

{ "_score": 1, "_type": "doc", "_source": { "process.hash.md5": "5b9533eacd04697f21f80eef3ba91377
Field
Expand
titleTable Example
Code Block
themeMidnight
firstline1
linenumberstrue

FIELD

Value

VALUE

@timestamp

Feb 24, 2021 @ 17:44:24.340

@version

1

_id

753702.0

_index

1024_5595_customer

_score

1

_type

doc

armor_metadata.customer.account_name

Sales Demo_Anywhere_SE

armor_metadata.customer.hostname

C02WC4PPHTD5

armor_metadata.customer.os_name

macOS Catalina

armor_metadata.customer.product_name

AA

armor_metadata.customer.service_provider

Armor Anywhere

armor_metadata.customer.tenant_id

5595

armor_metrics.input_port

5443

armor_metrics.latency.processing

2.54

armor_metrics.processing_chain

["KVN_V4_collector_i-0ff8e8423488756d3|2021-02-24T23:44:24Z","KVN_V4_processor_i-00e1d66f921030cf3|2021-02-24T23:44:26Z"]

cs_partition_key_0

005595

data_type

armor-security-logs

document_size

4,480

event.action

ACTION_CREATE_PROCESS

event.id

c7c956f076f811eb977689669fc3b6cd

event.provider

NGAV

event.timezone

UTC

event.type

endpoint.event.procstart

event_uuid

adca21d5-803a-4063-929d-2298f9efcc7f

external_id

d2e4fdff-8743-4d6b-80fc-3f193d3974e2

host.hostname

C02WC4PPHTD5

host.id

37305327

host.os.name

MAC

hostname

C02WC4PPHTD5

index_type

endpoint-detections

labels.parent_id

1024

logsource.origin

unknown

message_size

1,922

network.direction

unknown

network.type

endpoint.event.procstart

organization.id

N88FDVZL

original_timestamp

Feb 24, 2021 @ 17:44:24.296

process.command_line

jamf policy -randomDelaySeconds 300

process.executable

/usr/local/jamf/bin/jamf

process.guid

N88FDVZL-02393bef-0000c380-00000000-1d70b0551f56e20

process.hash.md5

5b9533eacd04697f21f80eef3ba91377

process.hash.sha256

1984435bf0a3020af49c152776c3ad3a5a5aa6dc30b7b6ea08ab683da4a5d61b

process.parent.command_line

xpcproxy com.jamfsoftware.task.Every 15 Minutes

process.parent.executable

/usr/libexec/xpcproxy

process.parent.guid

N88FDVZL-02393bef-0000c380-00000000-1d70b0551f435a0

process.parent.hash.sha256

87477a57c83ce40d53ae865d806f30d437c0b0eba37db244014319db2fb1a934

process.parent.pid

50048

process.pid

50048

process.reputation

REP_NOT_LISTED

process.

parent.guid

N88FDVZL-02393bef-0000c380-00000000-1d70b0551f435a0

process.parent.hash.sha256

87477a57c83ce40d53ae865d806f30d437c0b0eba37db244014319db2fb1a934

process.parent.pid

50048

process.pid

50048

process.reputation

REP_NOT_LISTED

process.terminated

false

process.username

root

received_timestamp

Feb 24, 2021 @ 17:44:24.340

tags

["customer","confirmed_external_id"]

tenant_id

5595

threat.framework

[]

type

carbon-black

Expand
titleJSON Example

terminated

false

process.username

root

received_timestamp

Feb 24, 2021 @ 17:44:24.340

tags

["customer","confirmed_external_id"]

tenant_id

5595

threat.framework

[]

type

carbon-black

Expand
titleJSON Example
Code Block
{
  "_score": 1,
  "_type": "doc",
  "_source": {
    "process.hash.md5": "5b9533eacd04697f21f80eef3ba91377",
    "document_size": 4480,
    "@timestamp": "2021-02-24T23:44:24.340Z",
    "event.provider": "NGAV",
    "tenant_id": "5595",
    "process.parent.pid": "50048",
    "network.type": "endpoint.event.procstart",
    "armor_metadata.customer.tenant_id": "5595",
    "hostname": "C02WC4PPHTD5",
    "host.os.name": "MAC",
    "documentmessage_size": 44801922,
    "@timestampprocess.parent.executable": "2021-02-24T23:44:24.340Z/usr/libexec/xpcproxy",
    "event.provider_id": "NGAV"753702,
      "tenant_id": "5595"tags": "[\"customer\",\"confirmed_external_id\"]",
    "process.parent.pidarmor_metrics.processing_chain": "50048",
    "network.type": "endpoint.event.procstart"[\"KVN_V4_collector_i-0ff8e8423488756d3|2021-02-24T23:44:24Z\",\"KVN_V4_processor_i-00e1d66f921030cf3|2021-02-24T23:44:26Z\"]",
    "armor_metadata.customer.tenant_id": "5595",
    "hostname": "C02WC4PPHTD5",
    "hostevent.os.nameid": "MACc7c956f076f811eb977689669fc3b6cd",
    "message_size": 1922,
    "process.parent.executablehost.id": "/usr/libexec/xpcproxy37305327",
    "armor_metrics.input_idport": 753702"5443",
    "tagsprocess.reputation": "[\"customer\",\"confirmed_external_id\"]REP_NOT_LISTED",
    "armor_metrics.processing_chain": "[\"KVN_V4_collector_i-0ff8e8423488756d3|original_timestamp": "2021-02-24T23:44:24Z\24.296Z",\"KVN_V4_processor_i-00e1d66f921030cf3|2021-02-24T23:44:26Z\"]
    "logsource.origin": "unknown",
    "armor_metadata.customer.hostnameprocess.terminated": "C02WC4PPHTD5false",
    "eventprocess.idguid": "c7c956f076f811eb977689669fc3b6cdN88FDVZL-02393bef-0000c380-00000000-1d70b0551f56e20",
    "hostevent.idtimezone": "37305327UTC",
    "armor_metrics.input_portprocess.parent.command_line": "5443xpcproxy com.jamfsoftware.task.Every 15 Minutes",
    "process.reputationhash.sha256": "REP_NOT_LISTED1984435bf0a3020af49c152776c3ad3a5a5aa6dc30b7b6ea08ab683da4a5d61b",
    "originalprocess.command_timestampline": "2021-02-24T23:44:24.296Zjamf policy -randomDelaySeconds 300",
    "logsourcenetwork.origindirection": "unknown",
    "process.terminatedreceived_timestamp": "false2021-02-24T23:44:24.340Z",
    "process.parent.guid": "N88FDVZL-02393bef-0000c380-00000000-1d70b0551f56e201d70b0551f435a0",
    "event.timezone": "UTC",
    "process.parent.command_line": "xpcproxy com.jamfsoftware.task.Every 15 Minutesdata_type": "armor-security-logs",
    "processarmor_metadata.hashcustomer.sha256account_name": "1984435bf0a3020af49c152776c3ad3a5a5aa6dc30b7b6ea08ab683da4a5d61bSales Demo_Anywhere_SE",
    "process.commandevent_lineuuid": "jamf policy -randomDelaySeconds 300adca21d5-803a-4063-929d-2298f9efcc7f",
    "networkorganization.directionid": "unknownN88FDVZL",
    "received_timestampprocess.executable": "2021-02-24T23:44:24.340Z/usr/local/jamf/bin/jamf",
    "processlabels.parent.guid_id": "N88FDVZL-02393bef-0000c380-00000000-1d70b0551f435a01024",
    "data_typearmor_metadata.customer.service_provider": "armor-security-logsArmor Anywhere",
    "armor_metadata.customer.account_nameprocess.parent.hash.sha256": "Sales Demo_Anywhere_SE87477a57c83ce40d53ae865d806f30d437c0b0eba37db244014319db2fb1a934",
    "eventexternal_uuidid": "adca21d5d2e4fdff-803a8743-40634d6b-929d-2298f9efcc7f"80fc-3f193d3974e2",
    "armor_metrics.latency.processing": 2.5396230220794678,
    "organizationprocess.idusername": "N88FDVZLroot",
    "process.executablecs_partition_key_0": "/usr/local/jamf/bin/jamf005595",
    "labels.parent_idtype": "1024carbon-black",
    "armor_metadata.customer.serviceproduct_providername": "Armor AnywhereAA",
    "process.parent.hash.sha256event.type": "87477a57c83ce40d53ae865d806f30d437c0b0eba37db244014319db2fb1a934endpoint.event.procstart",
    "external_idarmor_metadata.customer.os_name": "d2e4fdff-8743-4d6b-80fc-3f193d3974e2macOS Catalina",
    "armor_metrics.latency.processing@version": 2.53962302207946781,
    "processhost.usernamehostname": "rootC02WC4PPHTD5",
    "cs_partition_key_0event.action": "005595ACTION_CREATE_PROCESS",
    "typethreat.framework": "carbon-black[]",
    "armor_metadata.customer.product_nameindex_type": "AAendpoint-detections",
    "eventprocess.typepid": "endpoint.event.procstart",50048"
  },
  "armor_metadata.customer.os_name_id": "macOS Catalina753702.0",
   "_index": "@version1024_5595_customer": 1,
    "host.hostname": "C02WC4PPHTD5",
    "event.action": "ACTION_CREATE_PROCESS",
    "threat.framework": "[]",
    "index_type": "endpoint-detections",
    "process.pid": "50048"
  },
  "_id": "753702.0",
  "_index": "1024_5595_customer"
}
}

Helpful Fields for Searching the Datalake

...

Field

Filter By

event.type

This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.

host.hostname

Hostname of the host.

host.os.name

OS fields contain information about the operating system.

Adding a Filter

...

To add additional filters, click on the Add Filter Button.

...

Then set the field to one of the helpful fields above, select the operator, put in the value and hit save.