Logz.io
This Integration is part of the Logz.io Pack.#
Overview#
Fetch & remediate security incidents identified by Logz.io Cloud SIEM This integration was integrated and tested with Logz.io platform.
Logz.io Playbook#
Logz.Io Handle Alert: used to handle alerts retrieved from Logz.io. The playbook will retrieve the related events that generated the alert using the logzio-get-logs-by-event-id command
Use Cases#
Integrate with Logz.io Cloud SIEM to automatically remediate security incidents identified by Logz.io and increase observability into incident details. The integration allows Cortex XSOAR users to automatically remediate incidents identified by Logz.io Cloud SIEM using Cortex XSOAR Playbooks. In addition, users can query Logz.io directly from Cortex XSOAR to investigate open questions or retrieve the logs responsible for triggering security rules.
Configure Logz.io on Cortex XSOAR#
- Navigate to Settings > Integrations > Analytics & SIEM.
- Search for Logz.io.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Fetch incidents.
- Incident type
- API token for Logz.io Security account
- API token for Logz.io Operations account
- Region code of your Logz.io account
- Filter on rule names (Lucene syntax)
- Filter by rule severity
- First fetch time range ({number} {time unit}, e.g., 1 hour, 30 minutes)
- Max. number of incidents fetched per run
- Trust any certificate (not secure)
- Use system proxy settings
- Click Test to validate the URLs, token, and connection.
Commands#
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
- logzio-search-logs
- logzio-get-logs-by-event-id
1. logzio-search-logs#
Returns logs from your Logz.io Operations account by Lucene query
Note: The search time range can span over 2 calender days at most. If you supply a time range greater than that, the search window will be the last 2 calender days within the range you supplied.
Required Permissions#
Your Logz.io account type should be PRO or above.
Base Command#
logzio-search-logs
Input#
| Argument Name | Description | Required |
|---|---|---|
| query | A string specifying the search query, written in Apache Lucene syntax e.g. 'fname:John AND sname:Smith' . | Required |
| size | An integer specifying the maximum number of results to return. | Optional |
| from_time | Specifies the earliest timestamp to be returned by the query. | Optional |
| to_time | Specifies the latest timestamp to be returned by the query. | Optional |
| timeout | Timeout in seconds | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| Logzio.Result | Unknown | An array of search results |
| Logzio.Result.type | string | Log type in the index |
| Logzio.Result.timestamp | date | The log's timestamp |
Command Example#
!logzio-search-logs query="ThreatType:trojan OR input.type:tcp" size="5"
Context Example#
Human Readable Output#
Logs#
| @metadata | @timestamp | AMCoreContentVersion | AccessRequested | Analyzer | AnalyzerContentCreationDate | AnalyzerDATVersion | AnalyzerDetectionMethod | AnalyzerEngineVersion | AnalyzerGTIQuery | AnalyzerHostName | AnalyzerName | AnalyzerVersion | AttackVectorType | BladeName | Cleanable | DetectedUTC | DetectionMessage | DurationBeforeDetection | EPOEvents | EPOevent | EventID | FirstActionStatus | FirstAttemptedAction | GMTTime | NaturalLangDescription | SecondActionStatus | SecondAttemptedAction | Severity | SourceHostName | SourceProcessName | TargetAccessTime | TargetCreateTime | TargetFileName | TargetFileSize | TargetHash | TargetHostName | TargetModifyTime | TargetName | TargetPath | TargetUserName | TaskName | ThreatActionTaken | ThreatCategory | ThreatDetectedOnCreation | ThreatEventID | ThreatHandled | ThreatName | ThreatSeverity | ThreatType | beat_agent | bpsId | domain | ecs | input | log | logzio_codec | tags | tenantGUID | tenantId | tenantNodePath | timestamp | type |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T00:01:04.441+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {"CommonFields": {"AnalyzerDATVersion": "3990.0", "Analyzer": "ENDP_AM_1060", "AnalyzerDetectionMethod": "On-Access Scan", "AnalyzerVersion": "10.6.1", "AnalyzerEngineVersion": "6010.8670", "AnalyzerHostName": "WinSec3", "AnalyzerName": "McAfee Endpoint Security"}, "Event": {"EventID": "1027", "GMTTime": "2020-02-23T15:43:40", "CustomFields": {"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE", "TargetFileSize": "249952", "TargetModifyTime": "2020-02-23T15:43:22Z", "DurationBeforeDetection": "18", "Cleanable": "true", "FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE", "AnalyzerContentCreationDate": "2020-02-22T08:24:00Z", "TargetAccessTime": "2020-02-23T15:43:22Z", "AttackVectorType": "4", "ThreatDetectedOnCreation": "true", "FirstActionStatus": "true", "TargetName": "test.exe", "AMCoreContentVersion": "3990.0", "NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio", "TaskName": "IDS_OAS_TASK_NAME", "TargetHash": "81da244a770c46ace2cf112214f8e75e", "SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL", "TargetCreateTime": "2020-02-23T15:43:21Z", "SecondActionStatus": "false", "BladeName": "IDS_BLADE_NAME_SPB", "AnalyzerGTIQuery": "true", "AccessRequested_obj": {}, "TargetPath": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth"}, "CommonFields": {"ThreatType": "trojan", "TargetHostName": "WinSec3", "DetectedUTC": "2020-02-23T15:43:40Z", "TargetFileName": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe", "SourceHostName": "WinSec3", "ThreatSeverity": "2", "ThreatCategory": "av.detect", "TargetUserName": "WinSec3\Logzio", "SourceProcessName": "C:\Windows\explorer.exe", "ThreatName": "Trojan-FRTB!81DA244A770C", "ThreatEventID": "1027", "ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL", "ThreatHandled": "true"}, "Severity": "3"}} MachineInfo: {"RawMACAddress": "000d3a373482", "UserName": "SYSTEM", "MachineName": "WinSec3", "OSName": "Windows 10 Workstation", "TimeZoneBias": "0", "AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}", "IPAddress": "10.0.1.10"} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {"address": "10.0.1.9:49874"} | plain | beats-5015, _grokparsefailure, _grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T00:01:04.441+0000 | mcafee_epo |
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T02:01:13.778+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {"CommonFields": {"AnalyzerDATVersion": "3990.0", "Analyzer": "ENDP_AM_1060", "AnalyzerDetectionMethod": "On-Access Scan", "AnalyzerVersion": "10.6.1", "AnalyzerEngineVersion": "6010.8670", "AnalyzerHostName": "WinSec3", "AnalyzerName": "McAfee Endpoint Security"}, "Event": {"EventID": "1027", "GMTTime": "2020-02-23T15:43:40", "CustomFields": {"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE", "TargetFileSize": "249952", "TargetModifyTime": "2020-02-23T15:43:22Z", "DurationBeforeDetection": "18", "Cleanable": "true", "FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE", "AnalyzerContentCreationDate": "2020-02-22T08:24:00Z", "TargetAccessTime": "2020-02-23T15:43:22Z", "AttackVectorType": "4", "ThreatDetectedOnCreation": "true", "FirstActionStatus": "true", "TargetName": "test.exe", "AMCoreContentVersion": "3990.0", "NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio", "TaskName": "IDS_OAS_TASK_NAME", "TargetHash": "81da244a770c46ace2cf112214f8e75e", "SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL", "TargetCreateTime": "2020-02-23T15:43:21Z", "SecondActionStatus": "false", "BladeName": "IDS_BLADE_NAME_SPB", "AnalyzerGTIQuery": "true", "AccessRequested_obj": {}, "TargetPath": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth"}, "CommonFields": {"ThreatType": "trojan", "TargetHostName": "WinSec3", "DetectedUTC": "2020-02-23T15:43:40Z", "TargetFileName": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe", "SourceHostName": "WinSec3", "ThreatSeverity": "2", "ThreatCategory": "av.detect", "TargetUserName": "WinSec3\Logzio", "SourceProcessName": "C:\Windows\explorer.exe", "ThreatName": "Trojan-FRTB!81DA244A770C", "ThreatEventID": "1027", "ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL", "ThreatHandled": "true"}, "Severity": "3"}} MachineInfo: {"RawMACAddress": "000d3a373482", "UserName": "SYSTEM", "MachineName": "WinSec3", "OSName": "Windows 10 Workstation", "TimeZoneBias": "0", "AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}", "IPAddress": "10.0.1.10"} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {"address": "10.0.1.9:49874"} | plain | beats-5015, _grokparsefailure, _grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T02:01:13.778+0000 | mcafee_epo |
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T02:16:14.944+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {"CommonFields": {"AnalyzerDATVersion": "3990.0", "Analyzer": "ENDP_AM_1060", "AnalyzerDetectionMethod": "On-Access Scan", "AnalyzerVersion": "10.6.1", "AnalyzerEngineVersion": "6010.8670", "AnalyzerHostName": "WinSec3", "AnalyzerName": "McAfee Endpoint Security"}, "Event": {"EventID": "1027", "GMTTime": "2020-02-23T15:43:40", "CustomFields": {"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE", "TargetFileSize": "249952", "TargetModifyTime": "2020-02-23T15:43:22Z", "DurationBeforeDetection": "18", "Cleanable": "true", "FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE", "AnalyzerContentCreationDate": "2020-02-22T08:24:00Z", "TargetAccessTime": "2020-02-23T15:43:22Z", "AttackVectorType": "4", "ThreatDetectedOnCreation": "true", "FirstActionStatus": "true", "TargetName": "test.exe", "AMCoreContentVersion": "3990.0", "NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio", "TaskName": "IDS_OAS_TASK_NAME", "TargetHash": "81da244a770c46ace2cf112214f8e75e", "SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL", "TargetCreateTime": "2020-02-23T15:43:21Z", "SecondActionStatus": "false", "BladeName": "IDS_BLADE_NAME_SPB", "AnalyzerGTIQuery": "true", "AccessRequested_obj": {}, "TargetPath": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth"}, "CommonFields": {"ThreatType": "trojan", "TargetHostName": "WinSec3", "DetectedUTC": "2020-02-23T15:43:40Z", "TargetFileName": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe", "SourceHostName": "WinSec3", "ThreatSeverity": "2", "ThreatCategory": "av.detect", "TargetUserName": "WinSec3\Logzio", "SourceProcessName": "C:\Windows\explorer.exe", "ThreatName": "Trojan-FRTB!81DA244A770C", "ThreatEventID": "1027", "ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL", "ThreatHandled": "true"}, "Severity": "3"}} MachineInfo: {"RawMACAddress": "000d3a373482", "UserName": "SYSTEM", "MachineName": "WinSec3", "OSName": "Windows 10 Workstation", "TimeZoneBias": "0", "AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}", "IPAddress": "10.0.1.10"} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {"address": "10.0.1.9:49874"} | plain | beats-5015, _grokparsefailure, _grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T02:16:14.944+0000 | mcafee_epo |
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T02:31:16.087+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {"CommonFields": {"AnalyzerDATVersion": "3990.0", "Analyzer": "ENDP_AM_1060", "AnalyzerDetectionMethod": "On-Access Scan", "AnalyzerVersion": "10.6.1", "AnalyzerEngineVersion": "6010.8670", "AnalyzerHostName": "WinSec3", "AnalyzerName": "McAfee Endpoint Security"}, "Event": {"EventID": "1027", "GMTTime": "2020-02-23T15:43:40", "CustomFields": {"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE", "TargetFileSize": "249952", "TargetModifyTime": "2020-02-23T15:43:22Z", "DurationBeforeDetection": "18", "Cleanable": "true", "FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE", "AnalyzerContentCreationDate": "2020-02-22T08:24:00Z", "TargetAccessTime": "2020-02-23T15:43:22Z", "AttackVectorType": "4", "ThreatDetectedOnCreation": "true", "FirstActionStatus": "true", "TargetName": "test.exe", "AMCoreContentVersion": "3990.0", "NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio", "TaskName": "IDS_OAS_TASK_NAME", "TargetHash": "81da244a770c46ace2cf112214f8e75e", "SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL", "TargetCreateTime": "2020-02-23T15:43:21Z", "SecondActionStatus": "false", "BladeName": "IDS_BLADE_NAME_SPB", "AnalyzerGTIQuery": "true", "AccessRequested_obj": {}, "TargetPath": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth"}, "CommonFields": {"ThreatType": "trojan", "TargetHostName": "WinSec3", "DetectedUTC": "2020-02-23T15:43:40Z", "TargetFileName": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe", "SourceHostName": "WinSec3", "ThreatSeverity": "2", "ThreatCategory": "av.detect", "TargetUserName": "WinSec3\Logzio", "SourceProcessName": "C:\Windows\explorer.exe", "ThreatName": "Trojan-FRTB!81DA244A770C", "ThreatEventID": "1027", "ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL", "ThreatHandled": "true"}, "Severity": "3"}} MachineInfo: {"RawMACAddress": "000d3a373482", "UserName": "SYSTEM", "MachineName": "WinSec3", "OSName": "Windows 10 Workstation", "TimeZoneBias": "0", "AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}", "IPAddress": "10.0.1.10"} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {"address": "10.0.1.9:49874"} | plain | beats-5015, _grokparsefailure, _grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T02:31:16.087+0000 | mcafee_epo |
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T01:46:12.663+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {"CommonFields": {"AnalyzerDATVersion": "3990.0", "Analyzer": "ENDP_AM_1060", "AnalyzerDetectionMethod": "On-Access Scan", "AnalyzerVersion": "10.6.1", "AnalyzerEngineVersion": "6010.8670", "AnalyzerHostName": "WinSec3", "AnalyzerName": "McAfee Endpoint Security"}, "Event": {"EventID": "1027", "GMTTime": "2020-02-23T15:43:40", "CustomFields": {"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE", "TargetFileSize": "249952", "TargetModifyTime": "2020-02-23T15:43:22Z", "DurationBeforeDetection": "18", "Cleanable": "true", "FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE", "AnalyzerContentCreationDate": "2020-02-22T08:24:00Z", "TargetAccessTime": "2020-02-23T15:43:22Z", "AttackVectorType": "4", "ThreatDetectedOnCreation": "true", "FirstActionStatus": "true", "TargetName": "test.exe", "AMCoreContentVersion": "3990.0", "NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio", "TaskName": "IDS_OAS_TASK_NAME", "TargetHash": "81da244a770c46ace2cf112214f8e75e", "SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL", "TargetCreateTime": "2020-02-23T15:43:21Z", "SecondActionStatus": "false", "BladeName": "IDS_BLADE_NAME_SPB", "AnalyzerGTIQuery": "true", "AccessRequested_obj": {}, "TargetPath": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth"}, "CommonFields": {"ThreatType": "trojan", "TargetHostName": "WinSec3", "DetectedUTC": "2020-02-23T15:43:40Z", "TargetFileName": "C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe", "SourceHostName": "WinSec3", "ThreatSeverity": "2", "ThreatCategory": "av.detect", "TargetUserName": "WinSec3\Logzio", "SourceProcessName": "C:\Windows\explorer.exe", "ThreatName": "Trojan-FRTB!81DA244A770C", "ThreatEventID": "1027", "ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL", "ThreatHandled": "true"}, "Severity": "3"}} MachineInfo: {"RawMACAddress": "000d3a373482", "UserName": "SYSTEM", "MachineName": "WinSec3", "OSName": "Windows 10 Workstation", "TimeZoneBias": "0", "AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}", "IPAddress": "10.0.1.10"} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {"address": "10.0.1.9:49874"} | plain | beats-5015, _grokparsefailure, _grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T01:46:12.663+0000 | mcafee_epo |
2. logzio-get-logs-by-event-id#
Fetches the logs that triggered a security event in Logz.io Cloud SIEM
Base Command#
logzio-get-logs-by-event-id
Input#
| Argument Name | Description | Required |
|---|---|---|
| id | Logz.io Alert Event ID (found under Incident details) | Required |
| size | An integer specifying the maximum number of results to return | Optional |
| timeout | Timeout in seconds | Optional |
Context Output#
| Path | Type | Description |
|---|---|---|
| Logzio.Result | Unknown | An array of search results |
| Logzio.Result.type | string | Log type in the index |
| Logzio.Result.timestamp | date | The log's timestamp |
Command Example#
!logzio-get-logs-by-event-id id=9fb0e6a9-90c0-43ac-8e50-23028d8ea76c size=10
Context Example#
Human Readable Output#
Logs#
| @metadata | @timestamp | beat_agent | ecs | event | log_information | logzio_codec | message | tags | timestamp | type | winlog |
|---|---|---|---|---|---|---|---|---|---|---|---|
| beat: winlogbeat type: _doc version: 7.6.2 | 2020-05-06T08:28:04.640Z | hostname: WinTesting id: 3aa2739f-7d9c-48d1-8d95-9441d5fbffe1 version: 7.6.2 type: winlogbeat ephemeral_id: 2e94ea91-0375-4b60-8766-ee6d3f254832 | version: 1.4.0 | kind: event code: 1116 provider: Microsoft-Windows-Windows Defender created: 2020-05-06T08:28:05.674Z | level: warning | json | Windows Defender Antivirus has detected malware or other potentially unwanted software. For more information please see the following: https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0 Name: Virus:DOS/EICAR_Test_File ID: 2147519003 Severity: Severe Category: Virus Path: containerfile:_C:\Users\test_user\Downloads\eicar_com.zip; file:_C:\Users\test_user\Downloads\eicar_com.zip->eicar.com; webfile:_C:\Users\test_user\Downloads\eicar_com.zip|https://www.eicar.org/download/eicar_com.zip\|pid:7500,ProcessStart:132332202146885957 Detection Origin: Internet Detection Type: Concrete Detection Source: Downloads and attachments User: WinTesting\test_user Process Name: Unknown Signature Version: AV: 1.315.44.0, AS: 1.315.44.0, NIS: 1.315.44.0 Engine Version: AM: 1.1.17000.7, NIS: 1.1.17000.7 | beats-5015, _logzio_codec_json, _jsonparsefailure | 2020-05-06T08:28:04.640Z | wineventlog | channel: Microsoft-Windows-Windows Defender/Operational provider_name: Microsoft-Windows-Windows Defender api: wineventlog computer_name: WinTesting user: {"name": "SYSTEM", "domain": "NT AUTHORITY", "type": "User", "identifier": "S-1-5-18"} provider_guid: {11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78} activity_id: {2baa0795-dcd6-4cf7-b921-d9ad5e9cd6f0} process: {"pid": 3232, "thread": {"id": 4992}} event_data: {"Path": "containerfile:_C:\Users\test_user\Downloads\eicar_com.zip; file:_C:\Users\test_user\Downloads\eicar_com.zip->eicar.com; webfile:_C:\Users\test_user\Downloads\eicar_com.zip|https://www.eicar.org/download/eicar_com.zip\|pid:7500,ProcessStart:132332202146885957", "Action Name": "%%887", "Product Version": "4.18.2004.6", "Severity ID": "5", "Signature Version": "AV: 1.315.44.0, AS: 1.315.44.0, NIS: 1.315.44.0", "Post Clean Status": "0", "Execution Name": "%%812", "Type ID": "0", "Category ID": "42", "Engine Version": "AM: 1.1.17000.7, NIS: 1.1.17000.7", "Threat Name": "Virus:DOS/EICAR_Test_File", "Category Name": "Virus", "Origin ID": "4", "Error Description": "The operation completed successfully. ", "Detection User": "WinTesting\test_user", "Product Name": "%%827", "State": "1", "Detection Time": "2020-05-06T08:28:04.604Z", "Error Code": "0x00000000", "Source Name": "%%819", "FWLink": "https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0", "Threat ID": "2147519003", "Source ID": "4", "Detection ID": "{26C3583A-98B2-4E88-9B8A-0E9BDEBEB9B4}", "Status Code": "1", "Additional Actions ID": "0", "Additional Actions String": "No additional actions required", "Severity Name": "Severe", "Action ID": "9", "Execution ID": "0", "Type Name": "%%822", "Origin Name": "%%847", "Pre Execution Status": "0", "Process Name": "Unknown"} task: opcode: Info event_id: 1116 record_id: 136 event_id_description: Unknown |