Winlogbeat sending sysmon data to kibana

godfather7 · October 26, 2018, 10:00am

in the kibana dashboard, winlogbeat records the sysmon event and send it to elasticsearch and henceforth to kibana. there are 3 field name on time basis and i am not able to understand the difference between them namely event_data.PreviousCreationUtcTime, event_data.UtcTime and event_data.CreationUtcTime.
Screenshot%20(13)

adrisr · October 29, 2018, 1:15pm

Hi,

The fields below event_data come from the raw Sysmon event and their meaning seems to depend on the event ID.

For these particular fields I've found: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90002

It indicates that a file's creation time has been changed, being:

UtcTime: Time the change occurred
TargetFilename: Name of the file changed
PreviousCreationUtcTime: Previous file creation time.
CreationUtcTime: New file creation time.

godfather7 · October 30, 2018, 11:06am

Hi Adrisr,

Can this data can be manipulated to find out the launch time of a application?

adrisr · October 30, 2018, 2:44pm

For that you have Event ID 1: Process Creation

github.com

Cyb3rWard0g/OSSEM/blob/master/data_dictionaries/windows/sysmon/event-1.md

---
title: Event ID 1 - Process creation
description: The process creation event provides extended information about a newly created process.
log.type: sysmon
sysmon.version: 7.01
sysmon.rule: ProcessCreate
author: Roberto Rodriguez (@Cyb3rWard0g)
date: 04/11/2018
---

# Event ID 1: Process creation

## Description
The process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier. The hash is a full hash of the file with the algorithms in the HashType field.[Sysmon Source](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation)

## Event Log Illustration

<img src="https://github.com/Cyb3rWard0g/OSSEM/blob/master/resources/images/event-1.png" alt="Event 2 illustration" width="625" height="625">

## Event XML

This file has been truncated. show original

godfather7 · October 31, 2018, 6:18am

Hi,

By launch time i mean how much time it took to open an application and pop up on the screen.
can sysmon and winlogbeat record this kind of data?

adrisr · October 31, 2018, 6:29pm

I'm no expert, but I don't think Sysmon has support for that, as it is rather application-specific.

ssi · November 8, 2018, 11:56am

hey

i dont think sysmon can provide "latency" in relation to process creation etc. here i would go for another sysinternals tool called procmon

if you google promon latency you get some good pointers

again assuming i understand your problem correctly.

godfather7 · November 19, 2018, 6:47am

Hi,

Procmon is giving data regarding the process creation but the duration of process creation is 0.000000 which is not theoretically possible. Is relative duration a correct measure to find out the launching time of the application? if yes, can we create logs of this and send the data to kibana through winlogbeat.

system · December 17, 2018, 6:47am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Winlogbeat - Sysmon Module and Even.Code: 1 Missing Beats beats-module , winlogbeat	1	445	October 28, 2021
Processes are not logged in winlogbeat Beats winlogbeat	2	459	August 8, 2020
Droping events based on ip adr from sysmon Beats winlogbeat	8	928	December 7, 2018
How to activate sysmon event ID 3 Kibana	2	664	November 26, 2023
New sysmon event_id 22, DNS Query Beats	4	869	September 14, 2019

Winlogbeat sending sysmon data to kibana

Related topics