Watchlist Hit on Process

This section describes the process watchlist hit.

Process Watchlist – Example

Mar 13 10:00:09 [1037] <warning>  reason=watchlist.hit type=event process_guid=00000c42-0000-172c-01d0-5d6cca2adbb2 segment_id=1488563344023 host='WORKSTATION-8LT' sensor_id=4322 watchlist_id=3 watchlist_name='Netconns to .cn or .ru' timestamp='1426255209.17' start_time='2014-11-13T09:05:02.34Z' group='Default Group' process_md5='b9d6d7e6e5c4fcd8dd7f88ec9d563085' process_sha256=’A31C76B026966D8A01BB929402B17A5C0B35037CF53908770D7F3D1F28F6A7BD’ 
process_name='chrome.exe' process_path='c:\program files (x86)\google\chrome\application\chrome.exe' last_update='2014-11-13T13:49:39.361Z'

Process Watchlist – Default Template

reason=watchlist.hit type=event
process_guid={{doc['id']}}
segment_id={{doc["segment_id"]}}
host='{{doc['hostname']}}'
comms_ip='{{doc['comms_ip']}}'
interface_ip='{{doc['interface_ip']}}'
sensor_id={{doc['sensor_id']}}
watchlist_id={{doc['watchlist_id']}}
watchlist_name='{{doc['watchlist_name']}}'
timestamp='{{doc['event_timestamp']}}'
start_time='{{doc['start']}}'
group='{{doc['group']}}'
process_md5='{{doc['process_md5']}}'
process_sha256='{{doc['process_sha256']}}'
process_name='{{doc['process_name']}}'
process_path='{{doc['path']}}'
last_update='{{doc['last_update']}}'
{% for k in doc %}{% if k.startswith("alliance_") %}
{{k}}='{{doc[k]}}'{% endif %}{% endfor %}

Process Watchlist – Key-Value Pairs

Syslog Label	Solr Doc Reference	Description
reason	No doc reference	Text that describes the entry. The reason label is hard-coded in the syslog template and identifies the type of the event as "watchlist.hit," "feed.hit," or "binaryinfo."
type	No doc reference	Text that identifies the type of data that is returned with the event. For example: event (process events) module (binary modules) host (host-level information only)
process_guid	id	Process doc identifier.
segment_id	segment_id	Process doc segment identifier.
host	hostname	Hostname of the computer on which the process executed.
comms_ip	comms_ip	IP address from which Carbon Black EDR received the event (which could be a NAT or proxy address, if one is configured for the computer on which the process executed; otherwise this is the same as interface_ip).
interface_ip	Interface_ip	IP address of the computer on which the process executed.
sensor_id	sensor_id	Sensor ID of the computer on which the process executed.
watchlist_id	watchlist_id	The ID of the watchlist that matched the hit criteria (-1 is the internal syslog test watchlist ID. When you use the cbsyslog command line tool to test the output of your custom template, -1 is hard-coded to be the watchlist_id attribute, and is displayed in place of the actual watchlist_id when you run the test.)
watchlist_name	watchlist_name	Name of the watchlist that matched the hit criteria.
timestamp	event_timestamp	Epoch time of the watchlist hit event.
start_time	start	Start time of this process, in the computer’s local time.
group	group	Sensor group to which this sensor was assigned at the time of process execution.
process_md5	process_md5	MD5 hash value of the executable backing this process.
process_sha256	process_sha256	SHA-256 hash value of the executable backing this process.
process_name	process_name	Filename of the executable backing this process.
process_path	path	Full path to the executable backing this process.
last_update	last_update	Last activity in this process, in the computer’s local time.
for/if loops	alliance_* ioc_attr	alliance_* identifies and prints all attributes whose names start with "alliance_" in all documents that contain feed hits, including documents reported by watchlist hits. These attributes represent feed hits. ioc_attr identifies and prints additional attributes on IOC values that were matched. Note: for/if loops are not required. They report attributes that do not have predefined sets. You can create customized templates that do not contain them if you do not need to report on alliance_* or ioc_attr attributes.