From a93c8a9d02f2ba7d3da0b5ccf4569b1f48f4a433 Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Fri, 15 Mar 2024 14:32:34 -0400 Subject: [PATCH 01/12] add `owner` and `agent` to device/endpt/resource --- dictionary.json | 10 ++++ objects/agent.json | 100 ++++++++++++++++++++++++++++++++++ objects/device.json | 7 +++ objects/endpoint.json | 3 + objects/network_endpoint.json | 4 ++ objects/policy.json | 5 ++ objects/resource_details.json | 3 + 7 files changed, 132 insertions(+) create mode 100644 objects/agent.json diff --git a/dictionary.json b/dictionary.json index 9ef3a7edc..0f8f2054e 100644 --- a/dictionary.json +++ b/dictionary.json @@ -122,6 +122,11 @@ "is_array": true, "type": "affected_package" }, + "agent": { + "caption": "Agent", + "description": "An Agent (also known as a Sensor) is typically installed on an Operating System (OS) and serves as a specialized software component that can be designed to monitor, detect, collect, archive, or take action. These activities and possible actions are defined by the upstream system controlling the Agent and its intended purpose. For instance, an Agent can include Endpoint Detection & Response (EDR) agents, backup/disaster recovery sensors, Application Performance Monitoring or profiling sensors, and similar software.", + "type": "agent" + }, "alert": { "caption": "Client TLS Alert", "description": "The integer value of TLS alert if present. The alerts are defined in the TLS specification in RFC-2246.", @@ -2538,6 +2543,11 @@ "is_array": true, "type": "malware" }, + "manufacturer": { + "caption": "Manufacturer", + "description": "The manufacturer of a hardware, software, or firmware component. For example: Microsoft.", + "type": "string_t" + }, "manager": { "caption": "Manager", "description": "The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event.", diff --git a/objects/agent.json b/objects/agent.json new file mode 100644 index 000000000..4f3e310c6 --- /dev/null +++ b/objects/agent.json @@ -0,0 +1,100 @@ +{ + "caption": "Agent", + "description": "An Agent (also known as a Sensor) is typically installed on an Operating System (OS) and serves as a specialized software component that can be designed to monitor, detect, collect, archive, or take action. These activities and possible actions are defined by the upstream system controlling the Agent and its intended purpose. For instance, an Agent can include Endpoint Detection & Response (EDR) agents, backup/disaster recovery sensors, Application Performance Monitoring or profiling sensors, and similar software.", + "extends": "object", + "name": "agent", + "attributes": { + "type_id": { + "caption": "Type ID", + "description": "The normalized representation of an agent or sensor. E.g., EDR, vulnerability management, APM, backup & recovery, etc.", + "enum": { + "1": { + "caption": "Endpoint Detection and Response", + "description": "Any EDR sensor or agent. Or any tool that provides similar threat detection, anti-malware, anti-ransomware, or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender for Endpoint, Wazuh." + }, + "2": { + "caption": "Data Loss Prevention", + "description": "Any DLP sensor or agent. Or any tool that provides similar data classification, data loss detection, and/or data loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview, Symantec DLP." + }, + "3": { + "caption": "Backup & Recovery", + "description": "Any agent or sensor that provides backups, archival, or recovery capabilities. E.g., Azure Backup, AWS Backint Agent." + }, + "4": { + "caption": "Performance Monitoring & Obserability", + "description": "Any agent or sensor that provides Application Performance Monitoring (APM), active tracing, profiling, or other observability use cases and optionally forwards the logs. E.g., New Relic Agent, Datadog Agent, Azure Monitor Agent." + }, + "5": { + "caption": "Vulnerability Management", + "description": "Any agent or sensor that provides vulnerability management or scanning capabilities. E.g., Qualys VMDR, Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector Agent." + }, + "6": { + "caption": "Log Forwarding", + "description": "Any agent or sensor that forwards logs to a 3rd party storage system such as a data lake or SIEM. E.g., Splunk Universal Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis Agent." + }, + "7": { + "caption": "Mobile Device Management", + "description": "Any agent or sensor responsible for providing Mobile Device Management (MDM) or Mobile Enterprise Management (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary." + }, + "8": { + "caption": "Configuration Management", + "description": "Any agent or sensor that provides configuration management of a device, such as scanning for software, license management, or applying configurations. E.g., AWS Systems Manager Agent, Flexera, ServiceNow MID Server." + }, + "9": { + "caption": "Remote Access", + "description": "Any agent or sensor that provides remote access capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager Agent, Verkada Agent." + } + }, + "requirement": "recommended" + }, + "type": { + "caption": "Type", + "description": "The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source.", + "type": "string_t", + "requirement": "optional" + }, + "uid": { + "caption": "Agent ID", + "description": "The UID of the agent or sensor, sometimes known as a Sensor ID or aid.", + "type": "string_t", + "requirement": "recommended" + }, + "uid_alt": { + "caption": "Alternate Agent ID", + "description": "An alternative or contextual identifier for the agent or sensor, such as a configuration, organization, or license UID.", + "type": "string_t", + "requirement": "optional" + }, + "version": { + "caption": "Alternate Agent ID", + "description": "The semantic version of the agent or sensor, e.g., 7.101.50.0.", + "type": "string_t", + "requirement": "optional" + }, + "manufacturer": { + "caption": "Agent Manufacturer", + "description": "The company or author who created the agent or sensor. For example: Crowdstrike.", + "type": "string_t", + "requirement": "optional" + }, + "name": { + "caption": "Agent Name", + "description": "Organization name for the Autonomous System.", + "requirement": "recommended", + "group": "context" + }, + "policy": { + "caption": "Agent Policies", + "description": "Describes the various policies that may be applied or enforced by an agent or sensor. E.g., Conditional Access, prevention, auto-update, tamper protection, destination configuration, etc.", + "requirement": "optional", + "is_array": true + } + }, + "constraints": { + "at_least_one": [ + "uid", + "name" + ] + } + } + \ No newline at end of file diff --git a/objects/device.json b/objects/device.json index d4120c325..e9cff9c18 100644 --- a/objects/device.json +++ b/objects/device.json @@ -4,6 +4,9 @@ "extends": "endpoint", "name": "device", "attributes": { + "agent": { + "requirement": "optional" + }, "autoscale_uid": { "requirement": "optional" }, @@ -66,6 +69,10 @@ "description": "The time when the device was last known to have been modified.", "requirement": "optional" }, + "owner": { + "description": "The identity of the service or user account that owns the device or was last logged into it.", + "requirement": "recommended" + }, "name": { "description": "The alternate device name, ordinarily as assigned by an administrator.

Note: The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234.

" }, diff --git a/objects/endpoint.json b/objects/endpoint.json index 0aed6b349..67b7b463c 100644 --- a/objects/endpoint.json +++ b/objects/endpoint.json @@ -11,6 +11,9 @@ "$include": [ "profiles/container.json" ], + "agent": { + "requirement": "optional" + }, "domain": { "requirement": "optional" }, diff --git a/objects/network_endpoint.json b/objects/network_endpoint.json index b1089deb5..fbb4b6fcc 100644 --- a/objects/network_endpoint.json +++ b/objects/network_endpoint.json @@ -14,6 +14,10 @@ "description": "The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT).", "requirement": "optional" }, + "owner": { + "description": "The identity of the service or user account that owns the endpoint or was last logged into it.", + "requirement": "optional" + }, "port": { "description": "The port used for communication within the network connection.", "requirement": "recommended" diff --git a/objects/policy.json b/objects/policy.json index cf270b808..0d0d66a0c 100644 --- a/objects/policy.json +++ b/objects/policy.json @@ -21,6 +21,11 @@ "version": { "description": "The policy version number.", "requirement": "recommended" + }, + "is_applied": { + "caption": "Applied", + "description": "A determination if the content of a policy was applied to a target or request, or not.", + "type": "boolean_t" } } } diff --git a/objects/resource_details.json b/objects/resource_details.json index 17f197bac..dfea89724 100644 --- a/objects/resource_details.json +++ b/objects/resource_details.json @@ -4,6 +4,9 @@ "extends": "_resource", "name": "resource_details", "attributes": { + "agent": { + "requirement": "optional" + }, "cloud_partition": { "profile": "cloud", "requirement": "optional" From 0d34e80f9b5c414da37658d82591f1e44058431d Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Fri, 15 Mar 2024 14:45:11 -0400 Subject: [PATCH 02/12] typo fix, updated `CHANGELOG.md` --- CHANGELOG.md | 4 ++++ objects/agent.json | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7a801d045..32c4c99da 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,6 +22,7 @@ Thankyou! --> 1. Added `auth_factor` object. #949 2. Added `data_security` object. #953 3. Added `autonomous_system` object. #978 + 4. Added `agent` object. #987 * #### Platform Extensions ### Improved @@ -44,6 +45,9 @@ Thankyou! --> 2. Added `lat`, `long`, `geohash` attributes to `location` object. #971. 3. Added `risk_score`, `risk_level_id`, `risk_level` to `user` object. Issue #972. 4. Added `app_name`, `app_uid` to `actor` object. Issue #966, PR #979. + 5. Added `owner` to `device`, `endpoint`, and `network_endpoint` object. #987 + 6. Added `is_applied` Boolean attribute to `policy` object. #987 + 7. Added `agent` to `device`, `resource`, and `endpoint`. #987 * #### Platform Extensions ### Bugfixes diff --git a/objects/agent.json b/objects/agent.json index 4f3e310c6..58ebdb0bd 100644 --- a/objects/agent.json +++ b/objects/agent.json @@ -21,7 +21,7 @@ "description": "Any agent or sensor that provides backups, archival, or recovery capabilities. E.g., Azure Backup, AWS Backint Agent." }, "4": { - "caption": "Performance Monitoring & Obserability", + "caption": "Performance Monitoring & Observability", "description": "Any agent or sensor that provides Application Performance Monitoring (APM), active tracing, profiling, or other observability use cases and optionally forwards the logs. E.g., New Relic Agent, Datadog Agent, Azure Monitor Agent." }, "5": { From e266de7f4a68499b2eaa87012646f014dcea8805 Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Fri, 15 Mar 2024 14:51:00 -0400 Subject: [PATCH 03/12] Add `agent_list` and update other objects --- CHANGELOG.md | 4 +++- dictionary.json | 6 ++++++ objects/device.json | 2 +- objects/endpoint.json | 2 +- objects/resource_details.json | 2 +- 5 files changed, 12 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 32c4c99da..01c777bbe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -47,7 +47,9 @@ Thankyou! --> 4. Added `app_name`, `app_uid` to `actor` object. Issue #966, PR #979. 5. Added `owner` to `device`, `endpoint`, and `network_endpoint` object. #987 6. Added `is_applied` Boolean attribute to `policy` object. #987 - 7. Added `agent` to `device`, `resource`, and `endpoint`. #987 + 7. Added `agent_list` as an array of `agent` objects. #987 + 8. Added `manufacturer` generic attribute to `dictionary.json` to use with `agent`. #987 + 9. Added `agent` to `device`, `resource`, and `endpoint`. #987 * #### Platform Extensions ### Bugfixes diff --git a/dictionary.json b/dictionary.json index 0f8f2054e..1b4af84a3 100644 --- a/dictionary.json +++ b/dictionary.json @@ -127,6 +127,12 @@ "description": "An Agent (also known as a Sensor) is typically installed on an Operating System (OS) and serves as a specialized software component that can be designed to monitor, detect, collect, archive, or take action. These activities and possible actions are defined by the upstream system controlling the Agent and its intended purpose. For instance, an Agent can include Endpoint Detection & Response (EDR) agents, backup/disaster recovery sensors, Application Performance Monitoring or profiling sensors, and similar software.", "type": "agent" }, + "agent_list": { + "caption": "Agent List", + "description": "A list of agent objects associated with a device, endpoint, or resource", + "is_array": true, + "type": "agent" + }, "alert": { "caption": "Client TLS Alert", "description": "The integer value of TLS alert if present. The alerts are defined in the TLS specification in RFC-2246.", diff --git a/objects/device.json b/objects/device.json index e9cff9c18..6a38086da 100644 --- a/objects/device.json +++ b/objects/device.json @@ -4,7 +4,7 @@ "extends": "endpoint", "name": "device", "attributes": { - "agent": { + "agent_list": { "requirement": "optional" }, "autoscale_uid": { diff --git a/objects/endpoint.json b/objects/endpoint.json index 67b7b463c..e3257020d 100644 --- a/objects/endpoint.json +++ b/objects/endpoint.json @@ -11,7 +11,7 @@ "$include": [ "profiles/container.json" ], - "agent": { + "agent_list": { "requirement": "optional" }, "domain": { diff --git a/objects/resource_details.json b/objects/resource_details.json index dfea89724..32c486824 100644 --- a/objects/resource_details.json +++ b/objects/resource_details.json @@ -4,7 +4,7 @@ "extends": "_resource", "name": "resource_details", "attributes": { - "agent": { + "agent_list": { "requirement": "optional" }, "cloud_partition": { From 646ae64636d39284eeccb7945272b1f217d94f70 Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Fri, 15 Mar 2024 14:53:16 -0400 Subject: [PATCH 04/12] Missed adding `owner` to `endpoint` --- objects/endpoint.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/objects/endpoint.json b/objects/endpoint.json index e3257020d..15f6b5dc6 100644 --- a/objects/endpoint.json +++ b/objects/endpoint.json @@ -52,6 +52,10 @@ "description": "The endpoint operating system.", "requirement": "optional" }, + "owner": { + "description": "The identity of the service or user account that owns the endpoint or was last logged into it.", + "requirement": "recommended" + }, "subnet_uid": { "requirement": "optional" }, From 9a636ef5c5f2e5846825956158b36388d5d890ff Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Fri, 15 Mar 2024 14:56:20 -0400 Subject: [PATCH 05/12] Added `is_applied` to `dictionary.json` --- dictionary.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dictionary.json b/dictionary.json index 1b4af84a3..f6fbd635d 100644 --- a/dictionary.json +++ b/dictionary.json @@ -2145,6 +2145,11 @@ "description": "The IP address, in either IPv4 or IPv6 format.", "type": "ip_t" }, + "is_applied": { + "caption": "Applied", + "description": "A determination if a policy, rule, or enforcement action was applied.", + "type": "boolean_t" + }, "is_cleartext": { "caption": "Cleartext Credentials", "description": "Indicates whether the credentials were passed in clear text.

Note: True if the credentials were passed in a clear text protocol such as FTP or TELNET, or if Windows detected that a user's logon password was passed to the authentication package in clear text.

", From f5b260cdddc1dfaefd2f0ce2dbc5001d54a903f5 Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Mon, 18 Mar 2024 10:17:05 -0400 Subject: [PATCH 06/12] fix formatting, typo --- objects/agent.json | 136 ++++++++++++++++++++++----------------------- 1 file changed, 68 insertions(+), 68 deletions(-) diff --git a/objects/agent.json b/objects/agent.json index 58ebdb0bd..868b12f55 100644 --- a/objects/agent.json +++ b/objects/agent.json @@ -5,89 +5,89 @@ "name": "agent", "attributes": { "type_id": { - "caption": "Type ID", - "description": "The normalized representation of an agent or sensor. E.g., EDR, vulnerability management, APM, backup & recovery, etc.", - "enum": { - "1": { - "caption": "Endpoint Detection and Response", - "description": "Any EDR sensor or agent. Or any tool that provides similar threat detection, anti-malware, anti-ransomware, or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender for Endpoint, Wazuh." - }, - "2": { - "caption": "Data Loss Prevention", - "description": "Any DLP sensor or agent. Or any tool that provides similar data classification, data loss detection, and/or data loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview, Symantec DLP." - }, - "3": { - "caption": "Backup & Recovery", - "description": "Any agent or sensor that provides backups, archival, or recovery capabilities. E.g., Azure Backup, AWS Backint Agent." - }, - "4": { - "caption": "Performance Monitoring & Observability", - "description": "Any agent or sensor that provides Application Performance Monitoring (APM), active tracing, profiling, or other observability use cases and optionally forwards the logs. E.g., New Relic Agent, Datadog Agent, Azure Monitor Agent." - }, - "5": { - "caption": "Vulnerability Management", - "description": "Any agent or sensor that provides vulnerability management or scanning capabilities. E.g., Qualys VMDR, Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector Agent." - }, - "6": { - "caption": "Log Forwarding", - "description": "Any agent or sensor that forwards logs to a 3rd party storage system such as a data lake or SIEM. E.g., Splunk Universal Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis Agent." - }, - "7": { - "caption": "Mobile Device Management", - "description": "Any agent or sensor responsible for providing Mobile Device Management (MDM) or Mobile Enterprise Management (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary." - }, - "8": { - "caption": "Configuration Management", - "description": "Any agent or sensor that provides configuration management of a device, such as scanning for software, license management, or applying configurations. E.g., AWS Systems Manager Agent, Flexera, ServiceNow MID Server." - }, - "9": { - "caption": "Remote Access", - "description": "Any agent or sensor that provides remote access capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager Agent, Verkada Agent." - } + "caption": "Type ID", + "description": "The normalized representation of an agent or sensor. E.g., EDR, vulnerability management, APM, backup & recovery, etc.", + "enum": { + "1": { + "caption": "Endpoint Detection and Response", + "description": "Any EDR sensor or agent. Or any tool that provides similar threat detection, anti-malware, anti-ransomware, or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender for Endpoint, Wazuh." }, - "requirement": "recommended" + "2": { + "caption": "Data Loss Prevention", + "description": "Any DLP sensor or agent. Or any tool that provides similar data classification, data loss detection, and/or data loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview, Symantec DLP." + }, + "3": { + "caption": "Backup & Recovery", + "description": "Any agent or sensor that provides backups, archival, or recovery capabilities. E.g., Azure Backup, AWS Backint Agent." + }, + "4": { + "caption": "Performance Monitoring & Observability", + "description": "Any agent or sensor that provides Application Performance Monitoring (APM), active tracing, profiling, or other observability use cases and optionally forwards the logs. E.g., New Relic Agent, Datadog Agent, Azure Monitor Agent." + }, + "5": { + "caption": "Vulnerability Management", + "description": "Any agent or sensor that provides vulnerability management or scanning capabilities. E.g., Qualys VMDR, Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector Agent." + }, + "6": { + "caption": "Log Forwarding", + "description": "Any agent or sensor that forwards logs to a 3rd party storage system such as a data lake or SIEM. E.g., Splunk Universal Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis Agent." + }, + "7": { + "caption": "Mobile Device Management", + "description": "Any agent or sensor responsible for providing Mobile Device Management (MDM) or Mobile Enterprise Management (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary." + }, + "8": { + "caption": "Configuration Management", + "description": "Any agent or sensor that provides configuration management of a device, such as scanning for software, license management, or applying configurations. E.g., AWS Systems Manager Agent, Flexera, ServiceNow MID Server." + }, + "9": { + "caption": "Remote Access", + "description": "Any agent or sensor that provides remote access capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager Agent, Verkada Agent." + } + }, + "requirement": "recommended" }, "type": { - "caption": "Type", - "description": "The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source.", - "type": "string_t", - "requirement": "optional" + "caption": "Type", + "description": "The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source.", + "type": "string_t", + "requirement": "optional" }, "uid": { - "caption": "Agent ID", - "description": "The UID of the agent or sensor, sometimes known as a Sensor ID or aid.", - "type": "string_t", - "requirement": "recommended" + "caption": "Agent ID", + "description": "The UID of the agent or sensor, sometimes known as a Sensor ID or aid.", + "type": "string_t", + "requirement": "recommended" }, "uid_alt": { - "caption": "Alternate Agent ID", - "description": "An alternative or contextual identifier for the agent or sensor, such as a configuration, organization, or license UID.", - "type": "string_t", - "requirement": "optional" + "caption": "Alternate Agent ID", + "description": "An alternative or contextual identifier for the agent or sensor, such as a configuration, organization, or license UID.", + "type": "string_t", + "requirement": "optional" }, "version": { - "caption": "Alternate Agent ID", - "description": "The semantic version of the agent or sensor, e.g., 7.101.50.0.", - "type": "string_t", - "requirement": "optional" + "caption": "Agent Version", + "description": "The semantic version of the agent or sensor, e.g., 7.101.50.0.", + "type": "string_t", + "requirement": "optional" }, "manufacturer": { - "caption": "Agent Manufacturer", - "description": "The company or author who created the agent or sensor. For example: Crowdstrike.", - "type": "string_t", - "requirement": "optional" + "caption": "Agent Manufacturer", + "description": "The company or author who created the agent or sensor. For example: Crowdstrike.", + "type": "string_t", + "requirement": "optional" }, "name": { - "caption": "Agent Name", - "description": "Organization name for the Autonomous System.", - "requirement": "recommended", - "group": "context" + "caption": "Agent Name", + "description": "Organization name for the Autonomous System.", + "requirement": "recommended", + "group": "context" }, "policy": { - "caption": "Agent Policies", - "description": "Describes the various policies that may be applied or enforced by an agent or sensor. E.g., Conditional Access, prevention, auto-update, tamper protection, destination configuration, etc.", - "requirement": "optional", - "is_array": true + "caption": "Agent Policies", + "description": "Describes the various policies that may be applied or enforced by an agent or sensor. E.g., Conditional Access, prevention, auto-update, tamper protection, destination configuration, etc.", + "requirement": "optional", + "is_array": true } }, "constraints": { From 96caaae9a1c0c50af7de7f454def49c05bc2ef5b Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Mon, 18 Mar 2024 17:25:57 -0400 Subject: [PATCH 07/12] create `policies`, updated `agent` --- CHANGELOG.md | 2 +- dictionary.json | 11 ++++++----- objects/agent.json | 14 ++++---------- 3 files changed, 11 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 01c777bbe..51f18e71f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -48,7 +48,7 @@ Thankyou! --> 5. Added `owner` to `device`, `endpoint`, and `network_endpoint` object. #987 6. Added `is_applied` Boolean attribute to `policy` object. #987 7. Added `agent_list` as an array of `agent` objects. #987 - 8. Added `manufacturer` generic attribute to `dictionary.json` to use with `agent`. #987 + 8. Added `policies` object as an array of `policy` objects. #987 9. Added `agent` to `device`, `resource`, and `endpoint`. #987 * #### Platform Extensions diff --git a/dictionary.json b/dictionary.json index f6fbd635d..61c8c2a5f 100644 --- a/dictionary.json +++ b/dictionary.json @@ -2554,11 +2554,6 @@ "is_array": true, "type": "malware" }, - "manufacturer": { - "caption": "Manufacturer", - "description": "The manufacturer of a hardware, software, or firmware component. For example: Microsoft.", - "type": "string_t" - }, "manager": { "caption": "Manager", "description": "The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event.", @@ -2983,6 +2978,12 @@ "description": "Describes details of a policy. See specific usage.", "type": "policy" }, + "policies": { + "caption": "Policies", + "description": "An array of Policy objects.", + "is_array": true, + "type": "policy" + }, "port": { "caption": "Port", "description": "The TCP/UDP port number associated with a connection. See specific usage.", diff --git a/objects/agent.json b/objects/agent.json index 868b12f55..e63b8b2fe 100644 --- a/objects/agent.json +++ b/objects/agent.json @@ -50,19 +50,16 @@ "type": { "caption": "Type", "description": "The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source.", - "type": "string_t", "requirement": "optional" }, "uid": { "caption": "Agent ID", "description": "The UID of the agent or sensor, sometimes known as a Sensor ID or aid.", - "type": "string_t", "requirement": "recommended" }, "uid_alt": { "caption": "Alternate Agent ID", "description": "An alternative or contextual identifier for the agent or sensor, such as a configuration, organization, or license UID.", - "type": "string_t", "requirement": "optional" }, "version": { @@ -71,8 +68,7 @@ "type": "string_t", "requirement": "optional" }, - "manufacturer": { - "caption": "Agent Manufacturer", + "vendor_name": { "description": "The company or author who created the agent or sensor. For example: Crowdstrike.", "type": "string_t", "requirement": "optional" @@ -80,14 +76,12 @@ "name": { "caption": "Agent Name", "description": "Organization name for the Autonomous System.", - "requirement": "recommended", - "group": "context" + "requirement": "recommended" }, - "policy": { + "policies": { "caption": "Agent Policies", "description": "Describes the various policies that may be applied or enforced by an agent or sensor. E.g., Conditional Access, prevention, auto-update, tamper protection, destination configuration, etc.", - "requirement": "optional", - "is_array": true + "requirement": "optional" } }, "constraints": { From af1f2acc7ffd792ba03daf504c0ebd4f1130ac6f Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Mon, 18 Mar 2024 17:27:22 -0400 Subject: [PATCH 08/12] remove last errant `type` info --- objects/agent.json | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/objects/agent.json b/objects/agent.json index e63b8b2fe..2b98a5a62 100644 --- a/objects/agent.json +++ b/objects/agent.json @@ -48,7 +48,7 @@ "requirement": "recommended" }, "type": { - "caption": "Type", + "caption": "Agent Type", "description": "The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source.", "requirement": "optional" }, @@ -65,12 +65,10 @@ "version": { "caption": "Agent Version", "description": "The semantic version of the agent or sensor, e.g., 7.101.50.0.", - "type": "string_t", "requirement": "optional" }, "vendor_name": { "description": "The company or author who created the agent or sensor. For example: Crowdstrike.", - "type": "string_t", "requirement": "optional" }, "name": { From 37fb8ba043a1f4586dd3116e1710b837dfdb1b8c Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Tue, 19 Mar 2024 09:37:03 -0400 Subject: [PATCH 09/12] remove redundant attributes --- objects/device.json | 7 ------- objects/network_endpoint.json | 4 ---- 2 files changed, 11 deletions(-) diff --git a/objects/device.json b/objects/device.json index 6a38086da..d4120c325 100644 --- a/objects/device.json +++ b/objects/device.json @@ -4,9 +4,6 @@ "extends": "endpoint", "name": "device", "attributes": { - "agent_list": { - "requirement": "optional" - }, "autoscale_uid": { "requirement": "optional" }, @@ -69,10 +66,6 @@ "description": "The time when the device was last known to have been modified.", "requirement": "optional" }, - "owner": { - "description": "The identity of the service or user account that owns the device or was last logged into it.", - "requirement": "recommended" - }, "name": { "description": "The alternate device name, ordinarily as assigned by an administrator.

Note: The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234.

" }, diff --git a/objects/network_endpoint.json b/objects/network_endpoint.json index fbb4b6fcc..b1089deb5 100644 --- a/objects/network_endpoint.json +++ b/objects/network_endpoint.json @@ -14,10 +14,6 @@ "description": "The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT).", "requirement": "optional" }, - "owner": { - "description": "The identity of the service or user account that owns the endpoint or was last logged into it.", - "requirement": "optional" - }, "port": { "description": "The port used for communication within the network connection.", "requirement": "recommended" From 519f7956e226e255c510d90efcfd8652ee16c95d Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Tue, 19 Mar 2024 09:38:10 -0400 Subject: [PATCH 10/12] Update CHANGELOG.md --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 51f18e71f..e705851c4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -45,11 +45,11 @@ Thankyou! --> 2. Added `lat`, `long`, `geohash` attributes to `location` object. #971. 3. Added `risk_score`, `risk_level_id`, `risk_level` to `user` object. Issue #972. 4. Added `app_name`, `app_uid` to `actor` object. Issue #966, PR #979. - 5. Added `owner` to `device`, `endpoint`, and `network_endpoint` object. #987 + 5. Added `owner` to `endpoint` object. #987 6. Added `is_applied` Boolean attribute to `policy` object. #987 7. Added `agent_list` as an array of `agent` objects. #987 8. Added `policies` object as an array of `policy` objects. #987 - 9. Added `agent` to `device`, `resource`, and `endpoint`. #987 + 9. Added `agent_list` to `endpoint` object. #987 * #### Platform Extensions ### Bugfixes From dcdba035b8d8cb20e4711ed339d3ffa728a2e03d Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Tue, 19 Mar 2024 11:51:09 -0400 Subject: [PATCH 11/12] Update agent.json --- objects/agent.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/objects/agent.json b/objects/agent.json index 2b98a5a62..6c7223c6d 100644 --- a/objects/agent.json +++ b/objects/agent.json @@ -73,7 +73,7 @@ }, "name": { "caption": "Agent Name", - "description": "Organization name for the Autonomous System.", + "description": "The name of the agent or sensor. For example: AWS SSM Agent.", "requirement": "recommended" }, "policies": { From f902fef7040a1dbbf19b67c9a2d30b10e309c3a4 Mon Sep 17 00:00:00 2001 From: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> Date: Thu, 28 Mar 2024 10:32:22 -0400 Subject: [PATCH 12/12] Update dictionary.json Signed-off-by: Jonathan Rau <139361268+jonrau-at-queryai@users.noreply.github.com> --- dictionary.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dictionary.json b/dictionary.json index 61c8c2a5f..f7b1774ab 100644 --- a/dictionary.json +++ b/dictionary.json @@ -129,7 +129,7 @@ }, "agent_list": { "caption": "Agent List", - "description": "A list of agent objects associated with a device, endpoint, or resource", + "description": "A list of agent objects associated with a device, endpoint, or resource.", "is_array": true, "type": "agent" },