Winlogbeat sending sysmon data to kibana

godfather7 · October 26, 2018, 10:00am

in the kibana dashboard, winlogbeat records the sysmon event and send it to elasticsearch and henceforth to kibana. there are 3 field name on time basis and i am not able to understand the difference between them namely event_data.PreviousCreationUtcTime, event_data.UtcTime and event_data.CreationUtcTime.
Screenshot%20(13)

adrisr · October 29, 2018, 1:15pm

Hi,

The fields below event_data come from the raw Sysmon event and their meaning seems to depend on the event ID.

For these particular fields I've found: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90002

It indicates that a file's creation time has been changed, being:

UtcTime: Time the change occurred
TargetFilename: Name of the file changed
PreviousCreationUtcTime: Previous file creation time.
CreationUtcTime: New file creation time.

godfather7 · October 30, 2018, 11:06am

Hi Adrisr,

Can this data can be manipulated to find out the launch time of a application?

adrisr · October 30, 2018, 2:44pm

For that you have Event ID 1: Process Creation

github.com

Cyb3rWard0g/OSSEM/blob/master/data_dictionaries/windows/sysmon/event-1.md

---
title: Event ID 1 - Process creation
description: The process creation event provides extended information about a newly created process.
log.type: sysmon
sysmon.version: 7.01
sysmon.rule: ProcessCreate
author: Roberto Rodriguez (@Cyb3rWard0g)
date: 04/11/2018
---

# Event ID 1: Process creation

## Description
The process creation event provides extended information about a newly created process. The full command line provides context on the process execution. The ProcessGUID field is a unique value for this process across a domain to make event correlation easier. The hash is a full hash of the file with the algorithms in the HashType field.[Sysmon Source](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation)

## Event Log Illustration

<img src="https://github.com/Cyb3rWard0g/OSSEM/blob/master/resources/images/event-1.png" alt="Event 2 illustration" width="625" height="625">

## Event XML

This file has been truncated. show original

godfather7 · October 31, 2018, 6:18am

Hi,

By launch time i mean how much time it took to open an application and pop up on the screen.
can sysmon and winlogbeat record this kind of data?

adrisr · October 31, 2018, 6:29pm

I'm no expert, but I don't think Sysmon has support for that, as it is rather application-specific.

ssi · November 8, 2018, 11:56am

hey

i dont think sysmon can provide "latency" in relation to process creation etc. here i would go for another sysinternals tool called procmon

if you google promon latency you get some good pointers

again assuming i understand your problem correctly.

godfather7 · November 19, 2018, 6:47am

Hi,

Procmon is giving data regarding the process creation but the duration of process creation is 0.000000 which is not theoretically possible. Is relative duration a correct measure to find out the launching time of the application? if yes, can we create logs of this and send the data to kibana through winlogbeat.

Topic		Replies	Views
Winlogbeat 7.15.1 with sysmon missing fields task and message on Windows Server 2022 Beats winlogbeat	10	1671	December 29, 2021
Sysmon events not getting into the SOC and kibana Kibana	1	225	May 19, 2023
Application usage in desktop using winlogbeat in kibana Beats winlogbeat	2	514	November 27, 2018
No event collected from Sysmon (winlogbeat) Beats winlogbeat	1	353	December 24, 2020
No event collected from Sysmon Elasticsearch elastic-stack-security	1	329	August 5, 2021

Winlogbeat sending sysmon data to kibana

Related topics