Sekoia Endpoint Agent — events and fields reference
This page lists the data source categories, transformed event samples, and extracted ECS fields produced by the Sekoia Endpoint Agent. Use it as a reference when building custom detection rules or hunting in the events page.
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Access tokens |
security identifiers are extracted from several events |
Anti-virus |
Windows Defender events are analyzed, and need to be specifically set up |
Authentication logs |
audit logon events are examined in detail |
DLL monitoring |
information about dlls are extracted from several events |
File monitoring |
information about files are extracted from several events |
Host network interface |
Windows Filtering Platform collects information on processes having network activities |
Loaded DLLs |
Sysmon events provide information on DLL loading |
PowerShell logs |
Windows PowerShell logs are analyzed, and need to be specifically set up |
Process command-line parameters |
Windows Security Auditing logs provide information about process creation |
Process monitoring |
Windows Security Auditing logs are process tracking events |
Process use of network |
Windows Filtering Platform collects information on processes having network activities |
Windows event logs |
events related to Windows Event logs shutdown or restart are analyzed |
Windows Registry |
registry auditing events are examined in detail |
WMI Objects |
Windows WMI Activity events are analyzed, and events related to WMI process too |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": "{\"@timestamp\":\"2023-01-23T09:35:34.99Z\",\"agent\":{\"id\":\"1236c43def406f675318c07468d7b7e0984ba5a406da30251e102b6f2a103b24\",\"version\":\"v0.8.0\"},\"event\":{\"category\":[\"host\"],\"kind\":\"event\",\"reason\":\"Starting Events watcher\",\"provider\":\"SEKOIA-IO-Endpoint\"},\"host\":{\"hostname\":\"example.com\",\"os\":{\"family\":\"linux\"}},\"log\":{\"level\":\"info\",\"logger\":\"SEKOIA-IO-Endpoint\"},\"error\":{\"message\":\"My error\"}}",
"event": {
"category": [
"host"
],
"kind": "event",
"provider": "SEKOIA-IO-Endpoint",
"reason": "Starting Events watcher"
},
"@timestamp": "2023-01-23T09:35:34.990000Z",
"agent": {
"id": "1236c43def406f675318c07468d7b7e0984ba5a406da30251e102b6f2a103b24",
"version": "v0.8.0"
},
"error": {
"message": "My error"
},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"family": "linux"
}
},
"log": {
"level": "info",
"logger": "SEKOIA-IO-Endpoint"
},
"related": {
"hosts": [
"example.com"
]
}
}
{
"message": "{\"user\":{\"target\":{\"name\":\"VM-001$@EXAMPLE.LOCAL\",\"domain\":\"EXAMPLE.LOCAL\"}},\"action\":{\"properties\":{\"EventType\":\"AUDIT_SUCCESS\",\"IpAddress\":\"::ffff:10.0.30.42\",\"IpPort\":\"57111\",\"Keywords\":\"0x8020000000000000\",\"LogonGuid\":\"{345a31bc-e0d8-4d9b-98e7-d7c27a2404f2}\",\"ProviderGuid\":\"{9341bdd5-a0aa-4978-8f7b-36d0c7f5de05}\",\"ServiceName\":\"eXampl-AZRWE-AA00$\",\"ServiceSid\":\"00000000-0000-0000-0000-000000000000\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\",\"Status\":\"0x0\",\"TargetDomainName\":\"EXAMPLE.LOCAL\",\"TargetUserName\":\"user1\",\"TicketEncryptionType\":\"0x12\",\"TicketOptions\":\"0x40810000\",\"TransmittedServices\":\"-\"},\"id\":4769},\"event\":{\"provider\":\"Microsoft-Windows-Security-Auditing\",\"code\":4769},\"agent\":{\"id\":\"d6285cf5d51861d13acbb34971e6b72e8e91fbcfcce44cfc5a9f1d45c8f0510c\",\"version\":\"v1.4.0+a903da97d806b129d8f0c5c7d1c4f71cb36849bd\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"example.com\",\"ip\":[\"fe80::76e9:3115:c5b4:aaaa\",\"10.0.11.1\"]},\"source\":{\"address\":\"10.0.11.11\",\"ip\":\"10.0.11.12\"},\"@timestamp\":\"2024-01-19T13:18:38.703193Z\"}",
"event": {
"code": "4769",
"outcome": "success",
"provider": "Microsoft-Windows-Security-Auditing"
},
"@timestamp": "2024-01-19T13:18:38.703193Z",
"action": {
"id": 4769,
"properties": {
"EventType": "AUDIT_SUCCESS",
"IpAddress": "::ffff:10.0.30.42",
"IpPort": "57111",
"Keywords": "0x8020000000000000",
"LogonGuid": "{345a31bc-e0d8-4d9b-98e7-d7c27a2404f2}",
"ProviderGuid": "{9341bdd5-a0aa-4978-8f7b-36d0c7f5de05}",
"ServiceName": "eXampl-AZRWE-AA00$",
"ServiceSid": "00000000-0000-0000-0000-000000000000",
"Severity": "LOG_ALWAYS",
"SourceName": "Microsoft-Windows-Security-Auditing",
"Status": "0x0",
"TargetDomainName": "EXAMPLE.LOCAL",
"TargetUserName": "user1",
"TicketEncryptionType": "0x12",
"TicketOptions": "0x40810000",
"TransmittedServices": "-"
}
},
"agent": {
"id": "d6285cf5d51861d13acbb34971e6b72e8e91fbcfcce44cfc5a9f1d45c8f0510c",
"version": "v1.4.0+a903da97d806b129d8f0c5c7d1c4f71cb36849bd"
},
"host": {
"hostname": "example.com",
"ip": [
"10.0.11.1",
"fe80::76e9:3115:c5b4:aaaa"
],
"name": "example.com",
"os": {
"type": "windows"
}
},
"related": {
"hosts": [
"example.com"
],
"ip": [
"10.0.11.1",
"10.0.11.12",
"fe80::76e9:3115:c5b4:aaaa"
],
"user": [
"user1"
]
},
"source": {
"address": "10.0.11.11",
"ip": "10.0.11.12"
},
"user": {
"target": {
"domain": "EXAMPLE.LOCAL",
"name": "user1"
}
}
}
{
"message": "{\"user\":{\"id\":\"S-1-5-18\",\"name\":\"user1\",\"domain\":\"EXAMPLE\"},\"action\":{\"properties\":{\"ClientProcessId\":\"10704\",\"ClientProcessStartKey\":\"14918173765668009\",\"EventType\":\"AUDIT_SUCCESS\",\"FQDN\":\"EXPL111.example.org\",\"Keywords\":\"0x8020000000000000\",\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"RpcCallClientLocality\":\"0\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\",\"SubjectDomainName\":\"EXAMPLE\",\"SubjectLogonId\":\"0x3E7\",\"SubjectUserName\":\"user1\",\"SubjectUserSid\":\"S-1-5-18\",\"TaskContent\":\"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-16\\\"?>\\r\\n<Task version=\\\"1.2\\\" xmlns=\\\"http://schemas.microsoft.com/windows/2004/02/mit/task\\\">\\r\\n <RegistrationInfo>\\r\\n <Author>EXAMPLE\\\\master</Author>\\r\\n <Description>d\\u00e9ploiement de l'agent SYSMON sur les PC</Description>\\r\\n <URI>\\\\Agent Sysmon</URI>\\r\\n </RegistrationInfo>\\r\\n <Triggers>\\r\\n <TimeTrigger>\\r\\n <StartBoundary>2024-03-27T10:58:36</StartBoundary>\\r\\n <EndBoundary>2024-03-27T10:59:31</EndBoundary>\\r\\n <Enabled>true</Enabled>\\r\\n </TimeTrigger>\\r\\n </Triggers>\\r\\n <Principals>\\r\\n <Principal id=\\\"Author\\\">\\r\\n <RunLevel>HighestAvailable</RunLevel>\\r\\n <UserId>NT AUTHORITY\\\\System</UserId>\\r\\n <LogonType>S4U</LogonType>\\r\\n </Principal>\\r\\n </Principals>\\r\\n <Settings>\\r\\n <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\\r\\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\\r\\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\\r\\n <AllowHardTerminate>false</AllowHardTerminate>\\r\\n <StartWhenAvailable>true</StartWhenAvailable>\\r\\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\\r\\n <IdleSettings>\\r\\n <Duration>PT5M</Duration>\\r\\n <WaitTimeout>PT1H</WaitTimeout>\\r\\n <StopOnIdleEnd>false</StopOnIdleEnd>\\r\\n <RestartOnIdle>false</RestartOnIdle>\\r\\n </IdleSettings>\\r\\n <AllowStartOnDemand>true</AllowStartOnDemand>\\r\\n <Enabled>true</Enabled>\\r\\n <Hidden>false</Hidden>\\r\\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\\r\\n <WakeToRun>false</WakeToRun>\\r\\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\\r\\n <DeleteExpiredTaskAfter>PT0S</DeleteExpiredTaskAfter>\\r\\n <Priority>7</Priority>\\r\\n </Settings>\\r\\n <Actions Context=\\\"Author\\\">\\r\\n <Exec>\\r\\n <Command>\\\\\\\\exm-atl-01\\\\netlogon\\\\agent-sysmon\\\\sysmon.exe</Command>\\r\\n <Arguments>-accepteula -i \\\\\\\\exm-atl-01\\\\netlogon\\\\agent-sysmon\\\\sysmonconfig-export.xml</Arguments>\\r\\n </Exec>\\r\\n </Actions>\\r\\n</Task>\",\"TaskName\":\"\\\\Agent Sysmon\"},\"id\":4698},\"event\":{\"provider\":\"Microsoft-Windows-Security-Auditing\",\"code\":4698},\"agent\":{\"id\":\"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b\",\"version\":\"v1.5.0+909fc425bc21557bcd09cdd599f43eaeab13b9db\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"example.com\",\"ip\":[\"1.2.3.4\"]},\"process\":{\"parent\":{\"pid\":1188}},\"@timestamp\":\"2024-03-27T09:58:31.8443945Z\"}",
"event": {
"code": "4698",
"outcome": "success",
"provider": "Microsoft-Windows-Security-Auditing"
},
"@timestamp": "2024-03-27T09:58:31.844394Z",
"action": {
"id": 4698,
"properties": {
"ClientProcessId": "10704",
"ClientProcessStartKey": "14918173765668009",
"EventType": "AUDIT_SUCCESS",
"FQDN": "EXPL111.example.org",
"Keywords": "0x8020000000000000",
"ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"RpcCallClientLocality": "0",
"Severity": "LOG_ALWAYS",
"SourceName": "Microsoft-Windows-Security-Auditing",
"SubjectDomainName": "EXAMPLE",
"SubjectLogonId": "0x3E7",
"SubjectUserName": "user1",
"SubjectUserSid": "S-1-5-18",
"TaskContent": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo>\r\n <Author>EXAMPLE\\master</Author>\r\n <Description>d\u00e9ploiement de l'agent SYSMON sur les PC</Description>\r\n <URI>\\Agent Sysmon</URI>\r\n </RegistrationInfo>\r\n <Triggers>\r\n <TimeTrigger>\r\n <StartBoundary>2024-03-27T10:58:36</StartBoundary>\r\n <EndBoundary>2024-03-27T10:59:31</EndBoundary>\r\n <Enabled>true</Enabled>\r\n </TimeTrigger>\r\n </Triggers>\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <RunLevel>HighestAvailable</RunLevel>\r\n <UserId>NT AUTHORITY\\System</UserId>\r\n <LogonType>S4U</LogonType>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>false</AllowHardTerminate>\r\n <StartWhenAvailable>true</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <Duration>PT5M</Duration>\r\n <WaitTimeout>PT1H</WaitTimeout>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <DeleteExpiredTaskAfter>PT0S</DeleteExpiredTaskAfter>\r\n <Priority>7</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\\\\exm-atl-01\\netlogon\\agent-sysmon\\sysmon.exe</Command>\r\n <Arguments>-accepteula -i \\\\exm-atl-01\\netlogon\\agent-sysmon\\sysmonconfig-export.xml</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task>",
"TaskContentNew_Args": "-accepteula -i \\\\exm-atl-01\\netlogon\\agent-sysmon\\sysmonconfig-export.xml",
"TaskContentNew_Command": "\\\\exm-atl-01\\netlogon\\agent-sysmon\\sysmon.exe",
"TaskName": "\\Agent Sysmon"
}
},
"agent": {
"id": "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b",
"version": "v1.5.0+909fc425bc21557bcd09cdd599f43eaeab13b9db"
},
"host": {
"hostname": "example.com",
"ip": [
"1.2.3.4"
],
"name": "example.com",
"os": {
"type": "windows"
}
},
"process": {
"parent": {
"pid": 1188
}
},
"related": {
"hosts": [
"example.com"
],
"ip": [
"1.2.3.4"
],
"user": [
"user1"
]
},
"user": {
"domain": "EXAMPLE",
"id": "S-1-5-18",
"name": "user1"
}
}
{
"message": "{\"event\":{\"kind\":\"alert\",\"provider\":\"SEKOIA-IO-Endpoint\",\"category\":[\"host\"]},\"agent\":{\"id\":\"9bd810881cbaaa218b1fe3cb5b9fa34b7d094cb111f74c25d13f3d2452c93b0b\",\"version\":\"v10.2.0\"},\"log\":{\"logger\":\"SEKOIA-IO-Endpoint\"},\"host\":{\"os\":{\"type\":\"linux\"},\"hostname\":\"example.com\"},\"@timestamp\":\"2025-09-23T22:10:44.212937347Z\",\"rule\":{\"uuid\":\"37b6614b-6d80-4a3f-a24d-afb751e891ea\",\"pattern\":\"rule foo\"},\"threat\":{\"indicator\":{\"id\":\"7a5b9cf3-ede3-4824-9bc8-0ae28d5253e6\"}}}",
"event": {
"category": [
"host"
],
"kind": "alert",
"provider": "SEKOIA-IO-Endpoint"
},
"@timestamp": "2025-09-23T22:10:44.212937Z",
"agent": {
"id": "9bd810881cbaaa218b1fe3cb5b9fa34b7d094cb111f74c25d13f3d2452c93b0b",
"version": "v10.2.0"
},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"type": "linux"
}
},
"log": {
"logger": "SEKOIA-IO-Endpoint"
},
"related": {
"hosts": [
"example.com"
]
},
"rule": {
"pattern": "rule foo",
"uuid": "37b6614b-6d80-4a3f-a24d-afb751e891ea"
},
"threat": {
"indicator": {
"id": "7a5b9cf3-ede3-4824-9bc8-0ae28d5253e6"
}
}
}
{
"message": "{ \"action\": { \"properties\": { \"BytesTotal\": 18446744073709551615 } }}",
"action": {
"properties": {
"BytesTotal": 9223372036854775807
}
}
}
{
"message": "{\"@timestamp\":\"2022-06-02T12:23:19.097868Z\",\"agent\":{\"id\":\"c7a2ee33b4ac7c46c28c597d69f4d9ad327ead3601af4375d68bc250eb62e857\",\"version\":\"0.1.0\"},\"action\":{\"id\":22,\"properties\":{\"Image\":\"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\"Keywords\":\"0x8000000000000000\",\"ProcessGuid\":\"{033fb112-653e-6298-8301-000000001000}\",\"ProviderGuid\":\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\",\"RuleName\":\"-\",\"Severity\":\"INFO\",\"SourceName\":\"Microsoft-Windows-Sysmon\",\"User\":\"TEST-PC\\\\test\",\"UtcTime\":\"2022-06-02 12:23:18.607\"}},\"dns\":{\"answers\":[{\"name\":\"scontent.xx.fbcdn.net\",\"type\":\"CNAME\"},{\"data\":\"157.240.21.20\",\"type\":\"A\"},{\"data\":\"185.89.219.11\",\"type\":\"A\"},{\"data\":\"129.134.30.11\",\"type\":\"A\"},{\"data\":\"185.89.218.11\",\"type\":\"A\"},{\"data\":\"129.134.31.11\",\"type\":\"A\"},{\"data\":\"2a03:2880:f1fd:b:face:b00c:0:99\",\"type\":\"AAAA\"},{\"data\":\"2a03:2880:f0fc:b:face:b00c:0:99\",\"type\":\"AAAA\"},{\"data\":\"2a03:2880:f1fc:b:face:b00c:0:99\",\"type\":\"AAAA\"},{\"data\":\"2a03:2880:f0fd:b:face:b00c:0:99\",\"type\":\"AAAA\"}],\"resolved_ip\":[\"157.240.21.20\",\"185.89.219.11\",\"129.134.30.11\",\"185.89.218.11\",\"129.134.31.11\",\"2a03:2880:f1fd:b:face:b00c:0:99\",\"2a03:2880:f0fc:b:face:b00c:0:99\",\"2a03:2880:f1fc:b:face:b00c:0:99\",\"2a03:2880:f0fd:b:face:b00c:0:99\"],\"question\":{\"name\":\"example.com\",\"size_in_char\":20},\"response_code\":\"0\"},\"event\":{\"code\":22,\"provider\":\"Microsoft-Windows-Sysmon\"},\"host\":{\"hostname\":\"example.com\"},\"process\":{\"executable\":\"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\"name\":\"chrome.exe\",\"pid\":6440},\"user\":{\"name\":\"test\",\"domain\":\"example.com\"}}",
"event": {
"code": "22",
"provider": "Microsoft-Windows-Sysmon"
},
"@timestamp": "2022-06-02T12:23:19.097868Z",
"action": {
"id": 22,
"properties": {
"Image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"Keywords": "0x8000000000000000",
"ProcessGuid": "{033fb112-653e-6298-8301-000000001000}",
"ProviderGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
"RuleName": "-",
"Severity": "INFO",
"SourceName": "Microsoft-Windows-Sysmon",
"User": "TEST-PC\\test",
"UtcTime": "2022-06-02 12:23:18.607"
}
},
"agent": {
"id": "c7a2ee33b4ac7c46c28c597d69f4d9ad327ead3601af4375d68bc250eb62e857",
"version": "0.1.0"
},
"dns": {
"answers": [
{
"name": "scontent.xx.fbcdn.net",
"type": "CNAME"
},
{
"data": "157.240.21.20",
"type": "A"
},
{
"data": "185.89.219.11",
"type": "A"
},
{
"data": "129.134.30.11",
"type": "A"
},
{
"data": "185.89.218.11",
"type": "A"
},
{
"data": "129.134.31.11",
"type": "A"
},
{
"data": "2a03:2880:f1fd:b:face:b00c:0:99",
"type": "AAAA"
},
{
"data": "2a03:2880:f0fc:b:face:b00c:0:99",
"type": "AAAA"
},
{
"data": "2a03:2880:f1fc:b:face:b00c:0:99",
"type": "AAAA"
},
{
"data": "2a03:2880:f0fd:b:face:b00c:0:99",
"type": "AAAA"
}
],
"question": {
"name": "example.com",
"registered_domain": "example.com",
"size_in_char": 20,
"top_level_domain": "com"
},
"resolved_ip": [
"129.134.30.11",
"129.134.31.11",
"157.240.21.20",
"185.89.218.11",
"185.89.219.11",
"2a03:2880:f0fc:b:face:b00c:0:99",
"2a03:2880:f0fd:b:face:b00c:0:99",
"2a03:2880:f1fc:b:face:b00c:0:99",
"2a03:2880:f1fd:b:face:b00c:0:99"
],
"response_code": "0"
},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"type": "windows"
}
},
"process": {
"executable": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"name": "chrome.exe",
"pid": 6440
},
"related": {
"hosts": [
"example.com"
],
"ip": [
"129.134.30.11",
"129.134.31.11",
"157.240.21.20",
"185.89.218.11",
"185.89.219.11",
"2a03:2880:f0fc:b:face:b00c:0:99",
"2a03:2880:f0fd:b:face:b00c:0:99",
"2a03:2880:f1fc:b:face:b00c:0:99",
"2a03:2880:f1fd:b:face:b00c:0:99"
],
"user": [
"test"
]
},
"user": {
"domain": "example.com",
"name": "test"
}
}
{
"message": "{\"destination\":{\"ip\":\"192.0.2.1\",\"port\":49878},\"dns\":{\"answers\":[{\"data\":\"self-events-data.trafficmanager.net\",\"name\":\"example.com\",\"type\":\"CNAME\",\"ttl\":71}],\"question\":{\"name\":\"example.com\",\"type\":\"Unknown\",\"class\":\"IN\"},\"response_code\":\"No Error\",\"type\":\"answer\",\"resolved_ip\":[\"<nil>\"],\"header_flags\":[\"RD\",\"RA\"],\"op_code\":\"Query\",\"id\":19552},\"event\":{\"action\":\"dns-query-result\",\"provider\":\"SEKOIA-IO-Endpoint\",\"outcome\":\"success\",\"category\":[\"network\"],\"type\":[\"connection\",\"protocol\"],\"code\":22,\"start\":\"2024-12-13T07:06:37.188885Z\",\"end\":\"2024-12-13T07:06:37.188887Z\"},\"agent\":{\"id\":\"d6285cf5d51861d13acbb34971e6b72e8e91fbcfcce44cfc5a9f1d45c8f0510c\",\"version\":\"v1.6.2+16cc9687c5b8fc0a32da4a766fa726a4df90c133\"},\"host\":{\"os\":{\"type\":\"macos\"},\"hostname\":\"EXAMPLE.local\",\"ip\":[\"192.0.2.1\"]},\"network\":{\"transport\":\"udp\"},\"source\":{\"ip\":\"fe80:0011:2233:4455:6677:8899:aabb:ccdd\",\"port\":53},\"timestamp\":\"2024-12-13T07:06:37.188887Z\",\"sekoiaio\":{\"repeat\":{\"count\":1}}}",
"event": {
"action": "dns-query-result",
"category": [
"network"
],
"code": "22",
"end": "2024-12-13T07:06:37.188887Z",
"outcome": "success",
"provider": "SEKOIA-IO-Endpoint",
"start": "2024-12-13T07:06:37.188885Z",
"type": [
"connection",
"protocol"
]
},
"action": {
"outcome": "success"
},
"agent": {
"id": "d6285cf5d51861d13acbb34971e6b72e8e91fbcfcce44cfc5a9f1d45c8f0510c",
"version": "v1.6.2+16cc9687c5b8fc0a32da4a766fa726a4df90c133"
},
"destination": {
"address": "192.0.2.1",
"ip": "192.0.2.1",
"port": 49878
},
"dns": {
"answers": [
{
"data": "self-events-data.trafficmanager.net",
"name": "example.com",
"ttl": 71,
"type": "CNAME"
}
],
"id": "19552",
"op_code": "Query",
"question": {
"class": "IN",
"name": "example.com",
"registered_domain": "example.com",
"top_level_domain": "com",
"type": "Unknown"
},
"response_code": "No Error",
"type": "answer"
},
"host": {
"hostname": "example.local",
"ip": [
"192.0.2.1"
],
"name": "example.local",
"os": {
"type": "macos"
}
},
"network": {
"transport": "udp"
},
"related": {
"hosts": [
"example.com",
"example.local"
],
"ip": [
"192.0.2.1",
"fe80:11:2233:4455:6677:8899:aabb:ccdd"
]
},
"sekoiaio": {
"repeat": {
"count": 1
}
},
"source": {
"address": "fe80:11:2233:4455:6677:8899:aabb:ccdd",
"ip": "fe80:11:2233:4455:6677:8899:aabb:ccdd",
"port": 53
}
}
{
"message": "{\"@timestamp\":\"2022-06-02T12:18:37.6722336Z\",\"agent\":{\"id\":\"c7a2ee33b4ac7c46c28c597d69f4d9ad327ead3601af4375d68bc250eb62e857\",\"version\":\"0.1.0\"},\"event\":{\"action\":\"stats\",\"category\":\"host\",\"kind\":\"metric\",\"type\":\"info\"},\"host\":{\"hostname\":\"example.com\",\"uptime\":17899},\"sekoiaio\":{\"agent\":{\"cpu_usage\":0.26030037,\"memory_usage\":0.14199863},\"host\":{\"cpu_usage\":12.285156,\"memory_total\":16961064960,\"memory_available\":8049606656,\"memory_usage\":52}}}",
"event": {
"action": "stats",
"category": "host",
"kind": "metric",
"type": [
"info"
]
},
"@timestamp": "2022-06-02T12:18:37.672233Z",
"agent": {
"id": "c7a2ee33b4ac7c46c28c597d69f4d9ad327ead3601af4375d68bc250eb62e857",
"version": "0.1.0"
},
"host": {
"hostname": "example.com",
"name": "example.com",
"uptime": 17899
},
"related": {
"hosts": [
"example.com"
]
},
"sekoiaio": {
"agent": {
"cpu_usage": 0.26030037,
"memory_usage": 0.14199863
},
"host": {
"cpu_usage": 12.285156,
"memory_available": 8049606656,
"memory_total": 16961064960,
"memory_usage": 52
}
}
}
{
"message": "{\"@timestamp\":\"2022-06-02T12:18:37.6722336Z\",\"agent\":{\"id\":\"c7a2ee33b4ac7c46c28c597d69f4d9ad327ead3601af4375d68bc250eb62e857\",\"version\":\"0.1.0\"},\"event\":{\"action\":\"stats\",\"category\":\"host\",\"kind\":\"metric\",\"type\":[\"info\"]},\"host\":{\"hostname\":\"example.com\",\"uptime\":17899},\"sekoiaio\":{\"agent\":{\"cpu_usage\":0.26030037,\"memory_usage\":0.14199863},\"host\":{\"cpu_usage\":12.285156,\"memory_total\":16961064960,\"memory_available\":8049606656,\"memory_usage\":52}}}",
"event": {
"action": "stats",
"category": "host",
"kind": "metric",
"type": [
"info"
]
},
"@timestamp": "2022-06-02T12:18:37.672233Z",
"agent": {
"id": "c7a2ee33b4ac7c46c28c597d69f4d9ad327ead3601af4375d68bc250eb62e857",
"version": "0.1.0"
},
"host": {
"hostname": "example.com",
"name": "example.com",
"uptime": 17899
},
"related": {
"hosts": [
"example.com"
]
},
"sekoiaio": {
"agent": {
"cpu_usage": 0.26030037,
"memory_usage": 0.14199863
},
"host": {
"cpu_usage": 12.285156,
"memory_available": 8049606656,
"memory_total": 16961064960,
"memory_usage": 52
}
}
}
{
"message": "{\"event\":{\"provider\":\"SEKOIA-IO-Endpoint\",\"code\":1000,\"outcome\":\"success\"}}",
"event": {
"code": "1000",
"outcome": "success",
"provider": "SEKOIA-IO-Endpoint"
},
"action": {
"outcome": "success"
}
}
{
"message": "{\"user\":{\"effective\":{\"group\":{\"id\":\"0\",\"name\":\"root\"},\"id\":\"0\",\"name\":\"root\"},\"id\":\"user1\",\"name\":\"user1\"},\"file\":{\"hash\":{\"md5\":\"68b329da9893e34099c7d8ad5cb9c940\",\"sha1\":\"adc83b19e793491b1c6ea0fd8b46cd9f32e592fc\",\"sha256\":\"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b\"},\"device\":\"00:00\",\"inode\":\"1048671\",\"name\":\"ld.so.preload\",\"owner\":\"root\",\"group\":\"root\",\"directory\":\"/etc\",\"path\":\"/etc/ld.so.preload\",\"mode\":\"0644\",\"created\":\"2026-01-19T12:50:54.116Z\",\"size\":34},\"action\":{\"properties\":{\"a0\":\"ffffffffffffff9c\",\"a1\":\"5590006b7f60\",\"a2\":\"241\",\"a3\":\"1a4\",\"arch\":\"x86_64\",\"exit\":\"3\",\"syscall\":\"openat\",\"tty\":\"pts2\"}},\"event\":{\"action\":\"opened-file\",\"provider\":\"SEKOIA-IO-Endpoint\",\"outcome\":\"success\",\"category\":[\"file\"],\"type\":[\"creation\",\"change\"],\"code\":11},\"agent\":{\"id\":\"ANONYMIZED\",\"version\":\"v1.8.0+8865f7f248fdcadfcc23d83e9a25922a7167f808\"},\"host\":{\"os\":{\"type\":\"linux\"},\"hostname\":\"example.com\",\"ip\":[\"1.1.1.1\",\"fe80::0011:2233:4455:6677\"]},\"process\":{\"parent\":{\"command_line\":\"sudo /tmp/malware\",\"executable\":\"/usr/bin/sudo\",\"pid\":23115},\"command_line\":\"/tmp/malware\",\"executable\":\"/tmp/malware\",\"name\":\"malware\",\"working_directory\":\"/tmp\",\"pid\":23116},\"sekoiaio\":{\"process\":{\"parent_guid\":\"11111111-1111-1111-1111-111111111111\"}},\"@timestamp\":\"2026-01-19T12:50:54.116Z\",\"tags\":[\"rootkit_preload\"]}",
"event": {
"action": "opened-file",
"category": [
"file"
],
"code": "11",
"outcome": "success",
"provider": "SEKOIA-IO-Endpoint",
"type": [
"change",
"creation"
]
},
"@timestamp": "2026-01-19T12:50:54.116000Z",
"action": {
"outcome": "success",
"properties": {
"a0": "ffffffffffffff9c",
"a1": "5590006b7f60",
"a2": "241",
"a3": "1a4",
"arch": "x86_64",
"exit": "3",
"syscall": "openat",
"tty": "pts2"
}
},
"agent": {
"id": "ANONYMIZED",
"version": "v1.8.0+8865f7f248fdcadfcc23d83e9a25922a7167f808"
},
"auditd": {
"data": {
"a1": "5590006b7f60",
"a2": "241",
"a3": "1a4",
"syscall": "openat"
}
},
"file": {
"created": "2026-01-19T12:50:54.116000Z",
"device": "00:00",
"directory": "/etc",
"group": "root",
"hash": {
"md5": "68b329da9893e34099c7d8ad5cb9c940",
"sha1": "adc83b19e793491b1c6ea0fd8b46cd9f32e592fc",
"sha256": "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b"
},
"inode": "1048671",
"mode": "0644",
"name": "ld.so.preload",
"owner": "root",
"path": "/etc/ld.so.preload",
"size": 34
},
"host": {
"hostname": "example.com",
"ip": [
"1.1.1.1",
"fe80::11:2233:4455:6677"
],
"name": "example.com",
"os": {
"type": "linux"
}
},
"process": {
"command_line": "/tmp/malware",
"executable": "/tmp/malware",
"name": "malware",
"parent": {
"command_line": "sudo /tmp/malware",
"executable": "/usr/bin/sudo",
"pid": 23115
},
"pid": 23116,
"working_directory": "/tmp"
},
"related": {
"hash": [
"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b",
"68b329da9893e34099c7d8ad5cb9c940",
"adc83b19e793491b1c6ea0fd8b46cd9f32e592fc"
],
"hosts": [
"example.com"
],
"ip": [
"1.1.1.1",
"fe80::11:2233:4455:6677"
],
"user": [
"root",
"user1"
]
},
"sekoiaio": {
"process": {
"parent_guid": "11111111-1111-1111-1111-111111111111"
}
},
"tags": [
"rootkit_preload"
],
"user": {
"effective": {
"group": {
"id": "0",
"name": "root"
},
"id": "0",
"name": "root"
},
"id": "user1",
"name": "user1"
}
}
{
"message": "{\"user\":{\"id\":\"user1\",\"name\":\"user1\"},\"action\":{\"properties\":{\"hostname\":\"1.1.1.1\",\"id\":\"user1\",\"op\":\"login\",\"terminal\":\"ssh\"}},\"event\":{\"action\":\"logged-in\",\"provider\":\"SEKOIA-IO-Endpoint\",\"outcome\":\"success\",\"category\":[\"authentication\"],\"type\":[\"start\"],\"start\":\"2023-06-23T07:41:09.858Z\",\"end\":\"2023-06-23T07:46:09.858Z\"},\"agent\":{\"id\":\"2c59eed20c79ccd855d4a9c336ae9e0d2311970d30b87e426ff582032eeef137\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"linux\"},\"hostname\":\"example.com\"},\"network\":{\"direction\":\"ingress\"},\"process\":{\"executable\":\"/usr/sbin/sshd\",\"pid\":1750},\"source\":{\"address\":\"1.1.1.1\",\"ip\":\"1.1.1.1\"},\"@timestamp\":\"2023-06-23T07:41:09.858Z\"}",
"event": {
"action": "logged-in",
"category": [
"authentication"
],
"end": "2023-06-23T07:46:09.858000Z",
"outcome": "success",
"provider": "SEKOIA-IO-Endpoint",
"start": "2023-06-23T07:41:09.858000Z",
"type": [
"start"
]
},
"@timestamp": "2023-06-23T07:41:09.858000Z",
"action": {
"outcome": "success",
"properties": {
"hostname": "1.1.1.1",
"id": "user1",
"op": "login",
"terminal": "ssh"
}
},
"agent": {
"id": "2c59eed20c79ccd855d4a9c336ae9e0d2311970d30b87e426ff582032eeef137",
"version": "v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f"
},
"client": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"user": {
"id": "user1",
"name": "user1"
}
},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"type": "linux"
}
},
"network": {
"direction": "ingress"
},
"process": {
"executable": "/usr/sbin/sshd",
"name": "sshd",
"pid": 1750
},
"related": {
"hosts": [
"example.com"
],
"ip": [
"1.1.1.1"
],
"user": [
"user1"
]
},
"sekoiaio": {
"authentication": {
"process": {
"name": "sshd"
}
},
"server": {
"name": "example.com",
"os": {
"type": "linux"
}
}
},
"server": {},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1"
},
"user": {
"id": "user1",
"name": "user1"
}
}
{
"message": "{\"user\":{\"effective\":{\"id\":\"user1\",\"name\":\"user1\"},\"id\":\"user1\",\"name\":\"root\"},\"action\":{\"properties\":{\"old-ses\":\"4294967295\",\"tty\":\"(none)\"}},\"event\":{\"action\":\"changed-login-id-to\",\"provider\":\"SEKOIA-IO-Endpoint\",\"outcome\":\"success\",\"category\":[\"authentication\"],\"type\":[\"start\"]},\"agent\":{\"id\":\"f31fc5ca6f75e383f658d526d9b77273fa45c94e1bcedde5d67b1d05b0e7e6fb\",\"version\":\"v0.6.2+3ed1a7925ff2e6aa758d382bf19c9ea3f1db49c3\"},\"host\":{\"os\":{\"type\":\"linux\"},\"hostname\":\"example.com\"},\"process\":{\"pid\":121806},\"@timestamp\":\"2023-06-23T07:41:09.963Z\"}",
"event": {
"action": "changed-login-id-to",
"category": [
"authentication"
],
"outcome": "success",
"provider": "SEKOIA-IO-Endpoint",
"type": [
"start"
]
},
"@timestamp": "2023-06-23T07:41:09.963000Z",
"action": {
"outcome": "success",
"properties": {
"old-ses": "4294967295",
"tty": "(none)"
}
},
"agent": {
"id": "f31fc5ca6f75e383f658d526d9b77273fa45c94e1bcedde5d67b1d05b0e7e6fb",
"version": "v0.6.2+3ed1a7925ff2e6aa758d382bf19c9ea3f1db49c3"
},
"client": {},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"type": "linux"
}
},
"process": {
"pid": 121806
},
"related": {
"hosts": [
"example.com"
],
"user": [
"root",
"user1"
]
},
"sekoiaio": {
"client": {
"name": "example.com",
"os": {
"type": "linux"
}
},
"server": {
"name": "example.com",
"os": {
"type": "linux"
}
}
},
"server": {},
"user": {
"effective": {
"id": "user1",
"name": "user1"
},
"id": "user1",
"name": "root",
"target": {
"id": "user1",
"name": "user1"
}
}
}
{
"message": "{\"user\":{\"effective\":{\"name\":\"user1\"},\"id\":\"user1\",\"name\":\"root\"},\"action\":{\"properties\":{\"acct\":\"user1\",\"op\":\"login\",\"terminal\":\"sshd\"}},\"event\":{\"action\":\"logged-in\",\"provider\":\"SEKOIA-IO-Endpoint\",\"outcome\":\"failure\",\"category\":[\"authentication\"],\"type\":[\"start\"]},\"agent\":{\"id\":\"9a886b450f79c889a751cb64775e44f60b61dc421130c97cfe37dc214293f390\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"linux\"},\"hostname\":\"example.com\"},\"network\":{\"direction\":\"ingress\"},\"process\":{\"executable\":\"/usr/sbin/sshd\",\"pid\":3799903},\"source\":{\"address\":\"1.1.1.1\",\"ip\":\"1.1.1.1\"},\"@timestamp\":\"2023-06-23T07:41:10.892Z\"}",
"event": {
"action": "logged-in",
"category": [
"authentication"
],
"outcome": "failure",
"provider": "SEKOIA-IO-Endpoint",
"type": [
"start"
]
},
"@timestamp": "2023-06-23T07:41:10.892000Z",
"action": {
"outcome": "failure",
"properties": {
"acct": "user1",
"op": "login",
"terminal": "sshd"
}
},
"agent": {
"id": "9a886b450f79c889a751cb64775e44f60b61dc421130c97cfe37dc214293f390",
"version": "v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f"
},
"client": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"user": {
"id": "user1",
"name": "root"
}
},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"type": "linux"
}
},
"network": {
"direction": "ingress"
},
"process": {
"executable": "/usr/sbin/sshd",
"name": "sshd",
"pid": 3799903
},
"related": {
"hosts": [
"example.com"
],
"ip": [
"1.1.1.1"
],
"user": [
"root",
"user1"
]
},
"sekoiaio": {
"authentication": {
"process": {
"name": "sshd"
}
},
"server": {
"name": "example.com",
"os": {
"type": "linux"
}
}
},
"server": {},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1"
},
"user": {
"effective": {
"name": "user1"
},
"id": "user1",
"name": "root",
"target": {
"name": "user1"
}
}
}
{
"message": "{\"action\":{\"properties\":{\"ApplicationId\":\"\",\"DirectoryTableBase\":\"0x1B3C1E000\",\"ExitStatus\":\"259\",\"Flags\":\"0\",\"ImageFileName\":\"powershell.exe\",\"Keywords\":\"0x0\",\"PackageFullName\":\"\",\"ProviderGuid\":\"{3D6FA8D0-FE05-11D0-9DDA-00C04FD7BA7C}\",\"SessionId\":\"00000000-0000-0000-0000-000000000000\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Kernel-Process\",\"UniqueProcessKey\":\"0xFFFF9C0E86EEA080\",\"UserSID\":\"\\\\\\\\Windows-Desktop\\\\Maurice.Moss\"},\"id\":1,\"name\":\"process-created\"},\"event\":{\"action\":\"process-created\",\"provider\":\"SEKOIA-IO-Endpoint\",\"outcome\":\"success\",\"category\":[\"process\"],\"type\":[\"creation\"],\"code\":1},\"agent\":{\"id\":\"00e6e72665d9b4db937d50043df348d0db6e00bbd778df07cf154c0f01748879\",\"version\":\"v1.4.0+a903da97d806b129d8f0c5c7d1c4f71cb36849bd\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"example.com\",\"ip\":[\"fe80::faea:b73f:ce5:62b3\",\"10.0.0.13\"]},\"process\":{\"parent\":{\"command_line\":\"\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" \",\"executable\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"name\":\"powershell.exe\",\"args\":[\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\"],\"pid\":8088},\"command_line\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" /c \\\"C:\\\\Windows\\\\system32\\\\net.exe view /all\\\"\",\"executable\":\"C:\\\\Windows\\\\system32\\\\cmd.exe\",\"name\":\"cmd.exe\",\"args\":[\"C:\\\\Windows\\\\system32\\\\cmd.exe\",\"/c\",\"C:\\\\Windows\\\\system32\\\\net.exe view /all\"],\"pid\":8432},\"sekoiaio\":{\"process\":{\"guid\":\"6788547a-3faf-5a84-87d9-319fb114f065\",\"parent_guid\":\"c76178fe-d387-5248-a1e5-cb385c842fec\"}},\"@timestamp\":\"2024-01-02T13:51:48.1394289Z\"}",
"event": {
"action": "process-created",
"category": [
"process"
],
"code": "1",
"outcome": "success",
"provider": "SEKOIA-IO-Endpoint",
"type": [
"creation"
]
},
"@timestamp": "2024-01-02T13:51:48.139428Z",
"action": {
"id": 1,
"name": "process-created",
"outcome": "success",
"properties": {
"ApplicationId": "",
"DirectoryTableBase": "0x1B3C1E000",
"ExitStatus": "259",
"Flags": "0",
"ImageFileName": "powershell.exe",
"Keywords": "0x0",
"PackageFullName": "",
"ProviderGuid": "{3D6FA8D0-FE05-11D0-9DDA-00C04FD7BA7C}",
"SessionId": "00000000-0000-0000-0000-000000000000",
"Severity": "LOG_ALWAYS",
"SourceName": "Kernel-Process",
"UniqueProcessKey": "0xFFFF9C0E86EEA080",
"UserSID": "\\\\Windows-Desktop\\Maurice.Moss"
}
},
"agent": {
"id": "00e6e72665d9b4db937d50043df348d0db6e00bbd778df07cf154c0f01748879",
"version": "v1.4.0+a903da97d806b129d8f0c5c7d1c4f71cb36849bd"
},
"host": {
"hostname": "example.com",
"ip": [
"10.0.0.13",
"fe80::faea:b73f:ce5:62b3"
],
"name": "example.com",
"os": {
"type": "windows"
}
},
"process": {
"args": [
"/c",
"C:\\Windows\\system32\\cmd.exe",
"C:\\Windows\\system32\\net.exe view /all"
],
"command_line": "\"C:\\Windows\\system32\\cmd.exe\" /c \"C:\\Windows\\system32\\net.exe view /all\"",
"executable": "C:\\Windows\\system32\\cmd.exe",
"name": "cmd.exe",
"parent": {
"args": [
"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
],
"command_line": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ",
"executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"name": "powershell.exe",
"pid": 8088
},
"pid": 8432
},
"related": {
"hosts": [
"example.com"
],
"ip": [
"10.0.0.13",
"fe80::faea:b73f:ce5:62b3"
]
},
"sekoiaio": {
"process": {
"guid": "6788547a-3faf-5a84-87d9-319fb114f065",
"parent_guid": "c76178fe-d387-5248-a1e5-cb385c842fec"
}
}
}
{
"message": "{\"user\":{\"name\":\"user1\",\"domain\":\"example.com\"},\"action\":{\"properties\":{\"ApplicationId\":\"\",\"DirectoryTableBase\":\"0x1B3DEE000\",\"ExitStatus\":\"259\",\"Flags\":\"0\",\"ImageFileName\":\"cmd.exe\",\"Keywords\":\"0x0\",\"PackageFullName\":\"\",\"ProviderGuid\":\"{3D6FA8D0-FE05-11D0-9DDA-00C04FD7BA7C}\",\"SessionId\":\"00000000-0000-0000-0000-000000000000\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Kernel-Process\",\"UniqueProcessKey\":\"0xFFFF9001AA8C4080\"},\"id\":1,\"name\":\"process-created\"},\"event\":{\"action\":\"process-created\",\"provider\":\"SEKOIA-IO-Endpoint\",\"outcome\":\"success\",\"category\":[\"process\"],\"type\":[\"creation\"],\"code\":1},\"agent\":{\"id\":\"00e6e72665d9b4db937d50043df348d0db6e00bbd778df07cf154c0f01748879\",\"version\":\"v1.5.0+909fc425bc21557bcd09cdd599f43eaeab13b9db\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"example.com\",\"ip\":[\"fe80::faea:b73f:ce5:62b3\",\"10.0.0.13\"]},\"process\":{\"parent\":{\"command_line\":\"\\\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\\\" \",\"executable\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"name\":\"powershell.exe\",\"args\":[\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\"],\"pid\":8088},\"command_line\":\"\\\"C:\\\\Windows\\\\system32\\\\cmd.exe\\\" /c \\\"C:\\\\Windows\\\\system32\\\\net.exe view /all\\\"\",\"executable\":\"C:\\\\Windows\\\\system32\\\\cmd.exe\",\"name\":\"cmd.exe\",\"args\":[\"C:\\\\Windows\\\\system32\\\\cmd.exe\",\"/c\",\"C:\\\\Windows\\\\system32\\\\net.exe view /all\"],\"pid\":8432},\"sekoiaio\":{\"process\":{\"guid\":\"417f3e0f-c982-55f7-91b1-da72e895fb49\",\"parent_guid\":\"b9b6af11-3c85-5050-9128-b95723266e37\"}},\"@timestamp\":\"2024-03-06T07:34:35.5316596Z\"}",
"event": {
"action": "process-created",
"category": [
"process"
],
"code": "1",
"outcome": "success",
"provider": "SEKOIA-IO-Endpoint",
"type": [
"creation"
]
},
"@timestamp": "2024-03-06T07:34:35.531659Z",
"action": {
"id": 1,
"name": "process-created",
"outcome": "success",
"properties": {
"ApplicationId": "",
"DirectoryTableBase": "0x1B3DEE000",
"ExitStatus": "259",
"Flags": "0",
"ImageFileName": "cmd.exe",
"Keywords": "0x0",
"PackageFullName": "",
"ProviderGuid": "{3D6FA8D0-FE05-11D0-9DDA-00C04FD7BA7C}",
"SessionId": "00000000-0000-0000-0000-000000000000",
"Severity": "LOG_ALWAYS",
"SourceName": "Kernel-Process",
"UniqueProcessKey": "0xFFFF9001AA8C4080"
}
},
"agent": {
"id": "00e6e72665d9b4db937d50043df348d0db6e00bbd778df07cf154c0f01748879",
"version": "v1.5.0+909fc425bc21557bcd09cdd599f43eaeab13b9db"
},
"host": {
"hostname": "example.com",
"ip": [
"10.0.0.13",
"fe80::faea:b73f:ce5:62b3"
],
"name": "example.com",
"os": {
"type": "windows"
}
},
"process": {
"args": [
"/c",
"C:\\Windows\\system32\\cmd.exe",
"C:\\Windows\\system32\\net.exe view /all"
],
"command_line": "\"C:\\Windows\\system32\\cmd.exe\" /c \"C:\\Windows\\system32\\net.exe view /all\"",
"executable": "C:\\Windows\\system32\\cmd.exe",
"name": "cmd.exe",
"parent": {
"args": [
"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
],
"command_line": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ",
"executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"name": "powershell.exe",
"pid": 8088
},
"pid": 8432
},
"related": {
"hosts": [
"example.com"
],
"ip": [
"10.0.0.13",
"fe80::faea:b73f:ce5:62b3"
],
"user": [
"user1"
]
},
"sekoiaio": {
"process": {
"guid": "417f3e0f-c982-55f7-91b1-da72e895fb49",
"parent_guid": "b9b6af11-3c85-5050-9128-b95723266e37"
}
},
"user": {
"domain": "example.com",
"name": "user1"
}
}
{
"message": "{\"@timestamp\":\"2022-07-13T17:35:34.7697263Z\",\"agent\":{\"id\":\"d54749e87baf4b60ec7a9e51e16f1ee39f4aeaaf3070da908e0627cd02cf62f7\",\"version\":\"0.1.0\"},\"action\":{\"id\":3,\"properties\":{\"Keywords\":\"0x8000000000000020\",\"ProviderGuid\":\"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}\",\"Severity\":\"INFO\",\"SourceName\":\"Microsoft-Windows-Kernel-Process\",\"StackBase\":\"0xFFFFDF00357DA000\",\"StackLimit\":\"0xFFFFDF00357D4000\",\"StartAddr\":\"0xFFFFF8020AE71320\",\"SubProcessTag\":\"190\",\"TebBase\":\"0x0\",\"UserStackBase\":\"0x0\",\"UserStackLimit\":\"0x0\",\"Win32StartAddr\":\"0xFFFFF8020AE71320\"}},\"event\":{\"action\":\"remote-thread-created\",\"category\":[\"process\"],\"code\":8,\"provider\":\"SEKOIA-IO-Endpoint\",\"type\":\"creation\",\"outcome\":\"success\"},\"host\":{\"hostname\":\"example.com\"},\"process\":{\"command_line\":\"C:\\\\Windows\\\\system32\\\\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain\",\"executable\":\"C:\\\\Windows\\\\system32\\\\svchost.exe\",\"name\":\"svchost.exe\",\"parent\":{\"pid\":656},\"pid\":1356,\"thread\":{\"id\":1480},\"args\":[\"C:\\\\Windows\\\\system32\\\\svchost.exe\",\"-k\",\"LocalSystemNetworkRestricted\",\"-p\",\"-s\",\"SysMain\"]},\"sekoiaio\":{\"process\":{\"guid\":\"1d63ca73-6449-5fa9-8ca0-5ed461943a01\"},\"source_process\":{\"command_line\":\"C:\\\\Windows\\\\system32\\\\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain\",\"executable\":\"C:\\\\Windows\\\\system32\\\\svchost.exe\",\"name\":\"svchost.exe\",\"parent\":{\"pid\":656},\"pid\":1356,\"thread\":{\"id\":1480},\"args\":[\"C:\\\\Windows\\\\system32\\\\svchost.exe\",\"-k\",\"LocalSystemNetworkRestricted\",\"-p\",\"-s\",\"SysMain\"],\"guid\":\"1d63ca73-6449-5fa9-8ca0-5ed461943a01\"},\"target_process\":{\"pid\":4,\"thread\":{\"id\":5096},\"guid\":\"4392d6e4-f852-559f-858c-a4351889e3c4\"}}}",
"event": {
"action": "remote-thread-created",
"category": [
"process"
],
"code": "8",
"outcome": "success",
"provider": "SEKOIA-IO-Endpoint",
"type": [
"creation"
]
},
"@timestamp": "2022-07-13T17:35:34.769726Z",
"action": {
"id": 3,
"outcome": "success",
"properties": {
"Keywords": "0x8000000000000020",
"ProviderGuid": "{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}",
"Severity": "INFO",
"SourceName": "Microsoft-Windows-Kernel-Process",
"StackBase": "0xFFFFDF00357DA000",
"StackLimit": "0xFFFFDF00357D4000",
"StartAddr": "0xFFFFF8020AE71320",
"SubProcessTag": "190",
"TebBase": "0x0",
"UserStackBase": "0x0",
"UserStackLimit": "0x0",
"Win32StartAddr": "0xFFFFF8020AE71320"
}
},
"agent": {
"id": "d54749e87baf4b60ec7a9e51e16f1ee39f4aeaaf3070da908e0627cd02cf62f7",
"version": "0.1.0"
},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"type": "windows"
}
},
"process": {
"args": [
"-k",
"-p",
"-s",
"C:\\Windows\\system32\\svchost.exe",
"LocalSystemNetworkRestricted",
"SysMain"
],
"command_line": "C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain",
"executable": "C:\\Windows\\system32\\svchost.exe",
"name": "svchost.exe",
"parent": {
"pid": 656
},
"pid": 1356,
"thread": {
"id": 1480
}
},
"related": {
"hosts": [
"example.com"
]
},
"sekoiaio": {
"process": {
"guid": "1d63ca73-6449-5fa9-8ca0-5ed461943a01"
},
"source_process": {
"args": [
"-k",
"-p",
"-s",
"C:\\Windows\\system32\\svchost.exe",
"LocalSystemNetworkRestricted",
"SysMain"
],
"command_line": "C:\\Windows\\system32\\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain",
"executable": "C:\\Windows\\system32\\svchost.exe",
"guid": "1d63ca73-6449-5fa9-8ca0-5ed461943a01",
"name": "svchost.exe",
"parent": {
"pid": 656
},
"pid": 1356,
"thread": {
"id": 1480
}
},
"target_process": {
"guid": "4392d6e4-f852-559f-858c-a4351889e3c4",
"pid": 4,
"thread": {
"id": 5096
}
}
}
}
{
"message": "{\"action\":{\"properties\":{\"Keywords\":\"0x0\",\"MessageNumber\":\"1\",\"MessageTotal\":\"1\",\"Path\":\"C:\\\\Packages\\\\Plugins\\\\Microsoft.CPlat.Core.RunCommandWindows\\\\1.1.18\\\\Downloads\\\\script0.ps1\",\"ProviderGuid\":\"{A0128B9C-3827-44AE-A098-5256A14401F8}\",\"ScriptBlockId\":\"9472ba11-b266-49b9-88f9-7650d9f33cb1\",\"ScriptBlockText\":\"cmd.exe /c \\\"C:\\\\Users\\\\john_doe\\\\Documents\\\\agent.exe -install -intake-key INTAKE_KEY\\\"\\r\\nInvoke-WebRequest -Uri 'https://sandboxastra.blob.core.windows.net/samples/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' -OutFile C:\\\\users\\\\john_doe\\\\Desktop/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\\r\\nWrite-Host \\\"Get the main ethernet ID\\\"\\r\\n$netId = Get-NetAdapter -physical | where status -eq 'up' | Select-Object -ExpandProperty \\\"ifIndex\\\" -First 1\\r\\nWrite-Host \\\"Setting up Proxy\\\"\\r\\nSet-ItemProperty -Path 'HKLM:\\\\Software\\\\Policies\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings' -name ProxySettingsPerUser -Value 0\\r\\nSet-ItemProperty -Path 'HKLM:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings' -name ProxyEnable -Value 1\\r\\nSet-ItemProperty -Path 'HKLM:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Internet Settings' -name ProxyServer -Value \\\"1.2.3.4:3128\\\"\\r\\nWrite-Host \\\"Setting up DNS\\\"\\r\\nSet-DnsClientServerAddress -InterfaceIndex $netId -ServerAddresses (\\\"1.2.3.4\\\")\\r\\nWrite-Host \\\"Setting up Default route\\\"\\r\\nNew-NetRoute -InterfaceIndex $netId -DestinationPrefix 0.0.0.0/0 -NextHop (\\\"1.2.3.4\\\") -Confirm:$false\\r\\n\",\"Severity\":\"VERBOSE\",\"SourceName\":\"Microsoft-Windows-PowerShell\"},\"id\":4104},\"event\":{\"provider\":\"Microsoft-Windows-PowerShell\",\"code\":4104},\"agent\":{\"id\":\"815e74f73040cd0edb6a6e82e324069a745857dccca665ed20bd0d552c296fcb\",\"version\":\"v1.7.0+dd1538908ff3c724b54cd254bb75594b78eeae8c\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"example.com\",\"ip\":[\"192.0.2.1\",\"5.6.7.8\"]},\"process\":{\"thread\":{\"id\":8248},\"command_line\":\"powershell -ExecutionPolicy Unrestricted -File script0.ps1\",\"executable\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"name\":\"powershell.exe\",\"args\":[\"powershell\",\"-ExecutionPolicy\",\"Unrestricted\",\"-File\",\"script0.ps1\"],\"pid\":9144},\"sekoiaio\":{\"process\":{\"guid\":\"85eda23a-1190-4a66-bd61-0fbc5bed60d3\"}},\"@timestamp\":\"2025-06-06T11:33:15.7422711Z\"}",
"event": {
"code": "4104",
"provider": "Microsoft-Windows-PowerShell"
},
"@timestamp": "2025-06-06T11:33:15.742271Z",
"action": {
"id": 4104,
"properties": {
"Keywords": "0x0",
"MessageNumber": "1",
"MessageTotal": "1",
"Path": "C:\\Packages\\Plugins\\Microsoft.CPlat.Core.RunCommandWindows\\1.1.18\\Downloads\\script0.ps1",
"ProviderGuid": "{A0128B9C-3827-44AE-A098-5256A14401F8}",
"ScriptBlockId": "9472ba11-b266-49b9-88f9-7650d9f33cb1",
"ScriptBlockText": "cmd.exe /c \"C:\\Users\\john_doe\\Documents\\agent.exe -install -intake-key INTAKE_KEY\"\r\nInvoke-WebRequest -Uri 'https://sandboxastra.blob.core.windows.net/samples/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' -OutFile C:\\users\\john_doe\\Desktop/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\r\nWrite-Host \"Get the main ethernet ID\"\r\n$netId = Get-NetAdapter -physical | where status -eq 'up' | Select-Object -ExpandProperty \"ifIndex\" -First 1\r\nWrite-Host \"Setting up Proxy\"\r\nSet-ItemProperty -Path 'HKLM:\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings' -name ProxySettingsPerUser -Value 0\r\nSet-ItemProperty -Path 'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings' -name ProxyEnable -Value 1\r\nSet-ItemProperty -Path 'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings' -name ProxyServer -Value \"1.2.3.4:3128\"\r\nWrite-Host \"Setting up DNS\"\r\nSet-DnsClientServerAddress -InterfaceIndex $netId -ServerAddresses (\"1.2.3.4\")\r\nWrite-Host \"Setting up Default route\"\r\nNew-NetRoute -InterfaceIndex $netId -DestinationPrefix 0.0.0.0/0 -NextHop (\"1.2.3.4\") -Confirm:$false\r\n",
"Severity": "VERBOSE",
"SourceName": "Microsoft-Windows-PowerShell"
}
},
"agent": {
"id": "815e74f73040cd0edb6a6e82e324069a745857dccca665ed20bd0d552c296fcb",
"version": "v1.7.0+dd1538908ff3c724b54cd254bb75594b78eeae8c"
},
"host": {
"hostname": "example.com",
"ip": [
"192.0.2.1",
"5.6.7.8"
],
"name": "example.com",
"os": {
"type": "windows"
}
},
"process": {
"args": [
"-ExecutionPolicy",
"-File",
"Unrestricted",
"powershell",
"script0.ps1"
],
"command_line": "powershell -ExecutionPolicy Unrestricted -File script0.ps1",
"executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
"name": "powershell.exe",
"pid": 9144,
"thread": {
"id": 8248
}
},
"related": {
"hosts": [
"example.com"
],
"ip": [
"192.0.2.1",
"5.6.7.8"
]
},
"sekoiaio": {
"process": {
"guid": "85eda23a-1190-4a66-bd61-0fbc5bed60d3"
}
}
}
{
"message": "{\"action\":{\"properties\":{\"Application\":\"\\\\device\\\\harddisk\\\\windows\\\\system32\\\\test.exe\",\"Direction\":\"%%14593\",\"EventType\":\"AUDIT_SUCCESS\",\"FilterRTID\":\"72760\",\"Keywords\":\"0x8020000000000000\",\"LayerName\":\"%%14611\",\"LayerRTID\":\"48\",\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"RemoteMachineID\":\"S-1-0-0\",\"RemoteUserID\":\"S-1-0-0\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\"},\"id\":5156},\"destination\":{\"address\":\"1.2.3.4\",\"ip\":\"1.2.3.4\",\"port\":1},\"event\":{\"provider\":\"Microsoft-Windows-Security-Auditing\",\"code\":5156},\"agent\":{\"id\":\"72d68eb9bacfe73d21ff765b4e81aaec6934169b947daae740666327bd5f5e8c\",\"version\":\"v1.5.0+909fc425bc21557bcd09cdd599f43eaeab13b9db\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"hostname\",\"ip\":[\"5.6.7.8\"]},\"network\":{\"transport\":\"tcp\"},\"process\":{\"pid\":2184},\"source\":{\"address\":\"5.6.7.8\",\"ip\":\"5.6.7.8\",\"port\":2},\"@timestamp\":\"2024-07-19T14:10:28.962733Z\"}",
"event": {
"code": "5156",
"outcome": "success",
"provider": "Microsoft-Windows-Security-Auditing"
},
"@timestamp": "2024-07-19T14:10:28.962733Z",
"action": {
"id": 5156,
"properties": {
"Application": "\\device\\harddisk\\windows\\system32\\test.exe",
"Direction": "%%14593",
"EventType": "AUDIT_SUCCESS",
"FilterRTID": "72760",
"Keywords": "0x8020000000000000",
"LayerName": "%%14611",
"LayerRTID": "48",
"ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"RemoteMachineID": "S-1-0-0",
"RemoteUserID": "S-1-0-0",
"Severity": "LOG_ALWAYS",
"SourceName": "Microsoft-Windows-Security-Auditing"
}
},
"agent": {
"id": "72d68eb9bacfe73d21ff765b4e81aaec6934169b947daae740666327bd5f5e8c",
"version": "v1.5.0+909fc425bc21557bcd09cdd599f43eaeab13b9db"
},
"destination": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 1
},
"host": {
"hostname": "hostname",
"ip": [
"5.6.7.8"
],
"name": "hostname",
"os": {
"type": "windows"
}
},
"network": {
"transport": "tcp"
},
"process": {
"name": "test.exe",
"pid": 2184
},
"related": {
"hosts": [
"hostname"
],
"ip": [
"1.2.3.4",
"5.6.7.8"
]
},
"source": {
"address": "5.6.7.8",
"ip": "5.6.7.8",
"port": 2
}
}
{
"message": "{\"user\":{\"target\":{\"id\":\"S-1-5-18\",\"name\":\"user1\",\"domain\":\"example.com\"},\"id\":\"S-1-5-18\",\"name\":\"example.com\",\"domain\":\"example.com\"},\"action\":{\"properties\":{\"AuthenticationPackageName\":\"Negotiate\",\"EventType\":\"AUDIT_SUCCESS\",\"ImpersonationLevel\":\"%%1833\",\"IpAddress\":\"-\",\"IpPort\":\"-\",\"KeyLength\":\"0\",\"Keywords\":\"0x8020000000000000\",\"LmPackageName\":\"-\",\"LogonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"LogonProcessName\":\"Advapi \",\"LogonType\":\"5\",\"ProcessName\":\"C:\\\\Windows\\\\System32\\\\services.exe\",\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\",\"SubjectDomainName\":\"example.com\",\"SubjectLogonId\":\"0x3E7\",\"SubjectUserName\":\"user1\",\"SubjectUserSid\":\"S-1-5-18\",\"TargetDomainName\":\"example.com\",\"TargetLogonId\":\"0x3E7\",\"TargetUserName\":\"user1\",\"TargetUserSid\":\"S-1-5-18\",\"TransmittedServices\":\"-\",\"WorkstationName\":\"-\"},\"id\":4624},\"event\":{\"provider\":\"Microsoft-Windows-Security-Auditing\",\"code\":4624,\"outcome\":\"success\"},\"agent\":{\"id\":\"1193b609e262926e284b6076cab8919b8725fa9f576a22c7e0041edeb04f5c76\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"example.com\"},\"process\":{\"executable\":\"C:\\\\Windows\\\\System32\\\\services.exe\",\"name\":\"services.exe\",\"pid\":676},\"@timestamp\":\"2023-06-23T08:15:00.4849617Z\"}",
"event": {
"action": "authentication_service",
"category": [
"authentication"
],
"code": "4624",
"outcome": "success",
"provider": "Microsoft-Windows-Security-Auditing",
"type": [
"start"
]
},
"@timestamp": "2023-06-23T08:15:00.484961Z",
"action": {
"id": 4624,
"outcome": "success",
"properties": {
"AuthenticationPackageName": "Negotiate",
"EventType": "AUDIT_SUCCESS",
"ImpersonationLevel": "%%1833",
"IpAddress": "-",
"IpPort": "-",
"KeyLength": "0",
"Keywords": "0x8020000000000000",
"LmPackageName": "-",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"LogonProcessName": "Advapi ",
"LogonType": "5",
"ProcessName": "C:\\Windows\\System32\\services.exe",
"ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"Severity": "LOG_ALWAYS",
"SourceName": "Microsoft-Windows-Security-Auditing",
"SubjectDomainName": "example.com",
"SubjectLogonId": "0x3E7",
"SubjectUserName": "user1",
"SubjectUserSid": "S-1-5-18",
"TargetDomainName": "example.com",
"TargetLogonId": "0x3E7",
"TargetUserName": "user1",
"TargetUserSid": "S-1-5-18",
"TransmittedServices": "-",
"WorkstationName": "-"
}
},
"agent": {
"id": "1193b609e262926e284b6076cab8919b8725fa9f576a22c7e0041edeb04f5c76",
"version": "v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f"
},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"type": "windows"
}
},
"process": {
"executable": "C:\\Windows\\System32\\services.exe",
"name": "services.exe",
"pid": 676
},
"related": {
"hosts": [
"example.com"
],
"user": [
"example.com",
"user1"
]
},
"sekoiaio": {
"authentication": {
"process": {
"name": "Advapi "
}
},
"client": {
"name": "example.com",
"os": {
"type": "windows"
}
},
"server": {
"name": "example.com",
"os": {
"type": "windows"
}
}
},
"user": {
"domain": "example.com",
"id": "S-1-5-18",
"name": "user1",
"target": {
"domain": "example.com",
"id": "S-1-5-18",
"name": "user1"
}
}
}
{
"message": "{\"user\":{\"target\":{\"id\":\"S-1-0-0\",\"name\":\"example.com\",\"domain\":\"example.com\"},\"id\":\"S-1-0-0\"},\"action\":{\"properties\":{\"AuthenticationPackageName\":\"NTLM\",\"EventType\":\"AUDIT_FAILURE\",\"FailureReason\":\"%%2313\",\"IpAddress\":\"1.1.1.1\",\"IpPort\":\"0\",\"KeyLength\":\"0\",\"Keywords\":\"0x8010000000000000\",\"LmPackageName\":\"-\",\"LogonProcessName\":\"NtLmSsp \",\"LogonType\":\"3\",\"ProcessName\":\"-\",\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\",\"Status\":\"0xC000006D\",\"SubStatus\":\"0xC0000064\",\"SubjectDomainName\":\"-\",\"SubjectLogonId\":\"0x0\",\"SubjectUserName\":\"-\",\"SubjectUserSid\":\"S-1-0-0\",\"TargetDomainName\":\"example.com\",\"TargetUserName\":\"user1\",\"TargetUserSid\":\"S-1-0-0\",\"TransmittedServices\":\"-\",\"WorkstationName\":\"WIN-FOO\"},\"id\":4625},\"event\":{\"provider\":\"Microsoft-Windows-Security-Auditing\",\"code\":4625,\"outcome\":\"failure\"},\"agent\":{\"id\":\"dd4e2378f7208b8b8557a9b7a725b6d551887b868c72b8cb91668d56eca10c6f\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"example.com\"},\"source\":{\"address\":\"1.1.1.1\",\"ip\":\"1.1.1.1\"},\"@timestamp\":\"2023-06-23T08:13:49.4015618Z\"}",
"event": {
"action": "authentication_network",
"category": [
"authentication"
],
"code": "4625",
"outcome": "failure",
"provider": "Microsoft-Windows-Security-Auditing",
"reason": "user_not_exist",
"type": [
"start"
]
},
"@timestamp": "2023-06-23T08:13:49.401561Z",
"action": {
"id": 4625,
"outcome": "failure",
"properties": {
"AuthenticationPackageName": "NTLM",
"EventType": "AUDIT_FAILURE",
"FailureReason": "%%2313",
"IpAddress": "1.1.1.1",
"IpPort": "0",
"KeyLength": "0",
"Keywords": "0x8010000000000000",
"LmPackageName": "-",
"LogonProcessName": "NtLmSsp ",
"LogonType": "3",
"ProcessName": "-",
"ProviderGuid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"Severity": "LOG_ALWAYS",
"SourceName": "Microsoft-Windows-Security-Auditing",
"Status": "0xC000006D",
"SubStatus": "0xC0000064",
"SubjectDomainName": "-",
"SubjectLogonId": "0x0",
"SubjectUserName": "-",
"SubjectUserSid": "S-1-0-0",
"TargetDomainName": "example.com",
"TargetUserName": "user1",
"TargetUserSid": "S-1-0-0",
"TransmittedServices": "-",
"WorkstationName": "WIN-FOO"
}
},
"agent": {
"id": "dd4e2378f7208b8b8557a9b7a725b6d551887b868c72b8cb91668d56eca10c6f",
"version": "v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f"
},
"client": {
"ip": "1.1.1.1"
},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"type": "windows"
}
},
"related": {
"hosts": [
"example.com"
],
"ip": [
"1.1.1.1"
],
"user": [
"user1"
]
},
"sekoiaio": {
"authentication": {
"process": {
"name": "NtLmSsp "
}
},
"client": {
"name": "WIN-FOO",
"os": {
"type": "windows"
}
},
"server": {
"name": "example.com",
"os": {
"type": "windows"
}
}
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1"
},
"user": {
"id": "S-1-0-0",
"target": {
"domain": "example.com",
"id": "S-1-0-0",
"name": "user1"
}
}
}
{
"message": "{\"@timestamp\":\"2022-06-23T13:10:31.7691464Z\",\"agent\":{\"id\":\"3598e70397f8931e6288d7aa4075d336bee33fa6224627218e7b67587c3a62e9\",\"version\":\"0.1.0\"},\"action\":{\"id\":1151,\"properties\":{\"AS security intelligence creation time\":\"23/06/2022 03:14:37\",\"AS security intelligence version\":\"1.369.112.0\",\"AV security intelligence creation time\":\"23/06/2022 03:14:37\",\"AV security intelligence version\":\"1.369.112.0\",\"BM state\":\"Activ\\u00e9\",\"Engine up-to-date\":\"0\",\"Engine version\":\"1.1.19300.2\",\"IOAV state\":\"Activ\\u00e9\",\"Keywords\":\"0x8000000000000000\",\"Last AS security intelligence age\":\"0\",\"Last AV security intelligence age\":\"0\",\"Last full scan age\":\"4294967295\",\"Last full scan end time\":\"01/01/1601 00:00:00\",\"Last full scan source\":\"0\",\"Last full scan start time\":\"01/01/1601 00:00:00\",\"Last quick scan age\":\"1\",\"Last quick scan end time\":\"22/06/2022 10:01:43\",\"Last quick scan source\":\"2\",\"Last quick scan start time\":\"22/06/2022 10:00:16\",\"Latest engine version\":\"1.1.19300.2\",\"Latest platform version\":\"4.18.2205.7\",\"NRI engine version\":\"1.1.19300.2\",\"NRI security intelligence version\":\"1.369.112.0\",\"OA state\":\"Activ\\u00e9\",\"Platform up-to-date\":\"1\",\"Platform version\":\"4.18.2205.7\",\"Product Name\":\"Antivirus Microsoft Defender\",\"Product status\":\"0x00080000\",\"ProviderGuid\":\"{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}\",\"RTP state\":\"Activ\\u00e9\",\"Severity\":\"INFO\",\"SourceName\":\"Microsoft-Windows-Windows Defender\",\"Unused\":\"\"}},\"event\":{\"code\":1151,\"provider\":\"Microsoft-Windows-Windows Defender\"},\"host\":{\"hostname\":\"example.com\"}}",
"event": {
"code": "1151",
"provider": "Microsoft-Windows-Windows Defender"
},
"@timestamp": "2022-06-23T13:10:31.769146Z",
"action": {
"id": 1151,
"properties": {
"AS security intelligence creation time": "23/06/2022 03:14:37",
"AS security intelligence version": "1.369.112.0",
"AV security intelligence creation time": "23/06/2022 03:14:37",
"AV security intelligence version": "1.369.112.0",
"BM state": "Activ\u00e9",
"Engine up-to-date": "0",
"Engine version": "1.1.19300.2",
"IOAV state": "Activ\u00e9",
"Keywords": "0x8000000000000000",
"Last AS security intelligence age": "0",
"Last AV security intelligence age": "0",
"Last full scan age": "4294967295",
"Last full scan end time": "01/01/1601 00:00:00",
"Last full scan source": "0",
"Last full scan start time": "01/01/1601 00:00:00",
"Last quick scan age": "1",
"Last quick scan end time": "22/06/2022 10:01:43",
"Last quick scan source": "2",
"Last quick scan start time": "22/06/2022 10:00:16",
"Latest engine version": "1.1.19300.2",
"Latest platform version": "4.18.2205.7",
"NRI engine version": "1.1.19300.2",
"NRI security intelligence version": "1.369.112.0",
"OA state": "Activ\u00e9",
"Platform up-to-date": "1",
"Platform version": "4.18.2205.7",
"Product Name": "Antivirus Microsoft Defender",
"Product status": "0x00080000",
"ProviderGuid": "{11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78}",
"RTP state": "Activ\u00e9",
"Severity": "INFO",
"SourceName": "Microsoft-Windows-Windows Defender",
"Unused": ""
}
},
"agent": {
"id": "3598e70397f8931e6288d7aa4075d336bee33fa6224627218e7b67587c3a62e9",
"version": "0.1.0"
},
"host": {
"hostname": "example.com",
"name": "example.com",
"os": {
"type": "windows"
}
},
"related": {
"hosts": [
"example.com"
]
}
}
{
"message": "{\"action\":{\"properties\":{\"AvFlags\":\"0x6\",\"AvFlagsStr\":\"MIC Provided, Target unverified\",\"ChannelBindingStatus\":\"Supported\",\"ClientIP\":\"192.0.2.68\",\"ClientNetworkName\":\"Null\",\"DomainName\":\"example\",\"Keywords\":\"0x8000000000000000\",\"Mic Status\":\"Protected\",\"NegotiatedFlags\":\"0xE2888215\",\"NtlmVersion\":\"NTLMv2\",\"ProcessName\":\"svchost\",\"ProcessPID\":\"0x758\",\"ProviderGuid\":\"{AC43300D-5FCC-4800-8E99-1BD3F85F0320}\",\"RemoteClientMachine\":\"SERVER01\",\"ServiceBinding\":\"HOSTNAME.example.com\",\"SessionKeyStatus\":\"Present\",\"Severity\":\"WARNING\",\"SourceName\":\"Microsoft-Windows-NTLM\",\"Status\":\"0xC000015B\",\"StatusMsg\":\"A user has requested a type of logon (e.g., interactive or network) that has not been granted. An administrator has control over who may logon interactively and through the network.\",\"TargetDomain\":\"RPCSS/host02.example.com\",\"TargetMachine\":\"example.com\",\"Username\":\"testuser\"},\"id\":4023},\"event\":{\"provider\":\"Microsoft-Windows-NTLM\",\"code\":4023},\"agent\":{\"id\":\"927d2332e633af996810d527e758d1a6cf19c049130f44c6fe6a7cf805882e46\",\"version\":\"v1.9.1+5107dad0124d33e6131b4b7e372893087aca50d3\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"HOSTNAME\",\"ip\":[\"fe80::216b:582d:261d:ca03\",\"198.51.100.128\"]},\"process\":{\"hash\":{\"md5\":\"85d4d595fe7dc3ed6213adf32b83dc73\",\"sha1\":\"b09abc0b6e7de15151057b4ac75a9051fa9fdea9\",\"sha256\":\"0d8420567f868b7df9d89567dbf8f86f1a7df51fc8719d28cb904b0b066d20f2\"},\"thread\":{\"id\":35748},\"executable\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\",\"name\":\"lsass.exe\",\"pid\":1548},\"sekoiaio\":{\"process\":{\"guid\":\"692339c1-152c-5d2f-9458-e4ee11934f81\"}},\"@timestamp\":\"2026-05-11T08:23:36.6425808Z\"}",
"event": {
"code": "4023",
"provider": "Microsoft-Windows-NTLM"
},
"@timestamp": "2026-05-11T08:23:36.642580Z",
"action": {
"id": 4023,
"properties": {
"AvFlags": "0x6",
"AvFlagsStr": "MIC Provided, Target unverified",
"ChannelBindingStatus": "Supported",
"ClientIP": "192.0.2.68",
"ClientNetworkName": "Null",
"DomainName": "example",
"Keywords": "0x8000000000000000",
"Mic Status": "Protected",
"NegotiatedFlags": "0xE2888215",
"NtlmVersion": "NTLMv2",
"ProcessName": "svchost",
"ProcessPID": "0x758",
"ProviderGuid": "{AC43300D-5FCC-4800-8E99-1BD3F85F0320}",
"RemoteClientMachine": "SERVER01",
"ServiceBinding": "HOSTNAME.example.com",
"SessionKeyStatus": "Present",
"Severity": "WARNING",
"SourceName": "Microsoft-Windows-NTLM",
"Status": "0xC000015B",
"StatusMsg": "A user has requested a type of logon (e.g., interactive or network) that has not been granted. An administrator has control over who may logon interactively and through the network.",
"TargetDomain": "RPCSS/host02.example.com",
"TargetMachine": "example.com",
"Username": "testuser"
}
},
"agent": {
"id": "927d2332e633af996810d527e758d1a6cf19c049130f44c6fe6a7cf805882e46",
"version": "v1.9.1+5107dad0124d33e6131b4b7e372893087aca50d3"
},
"host": {
"hostname": "hostname",
"ip": [
"198.51.100.128",
"fe80::216b:582d:261d:ca03"
],
"name": "hostname",
"os": {
"type": "windows"
}
},
"process": {
"executable": "C:\\Windows\\System32\\lsass.exe",
"hash": {
"md5": "85d4d595fe7dc3ed6213adf32b83dc73",
"sha1": "b09abc0b6e7de15151057b4ac75a9051fa9fdea9",
"sha256": "0d8420567f868b7df9d89567dbf8f86f1a7df51fc8719d28cb904b0b066d20f2"
},
"name": "lsass.exe",
"pid": 1548,
"thread": {
"id": 35748
}
},
"related": {
"hash": [
"0d8420567f868b7df9d89567dbf8f86f1a7df51fc8719d28cb904b0b066d20f2",
"85d4d595fe7dc3ed6213adf32b83dc73",
"b09abc0b6e7de15151057b4ac75a9051fa9fdea9"
],
"hosts": [
"hostname"
],
"ip": [
"192.0.2.68",
"198.51.100.128",
"fe80::216b:582d:261d:ca03"
]
},
"sekoiaio": {
"process": {
"guid": "692339c1-152c-5d2f-9458-e4ee11934f81"
}
},
"source": {
"address": "192.0.2.68",
"ip": "192.0.2.68"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
action.properties.BytesTotal |
long |
|
action.properties.TaskContentNew_Args |
keyword |
|
action.properties.TaskContentNew_Command |
keyword |
|
auditd.data.a1 |
keyword |
argument 1 of syscall |
auditd.data.a2 |
keyword |
argument 2 of syscall |
auditd.data.a3 |
keyword |
argument 3 of syscall |
auditd.data.socket.addr |
keyword |
|
auditd.data.socket.family |
keyword |
|
auditd.data.socket.port |
keyword |
|
auditd.data.syscall |
keyword |
name of the invoked system call that generated the event |
client.ip |
ip |
IP address of the client. |
dns.answers |
object |
Array of DNS answers. |
dns.id |
keyword |
The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. |
dns.op_code |
keyword |
The DNS operation code that specifies the kind of query in the message. |
dns.resolved_ip |
ip |
Array containing all IPs seen in answers.data |
dns.response_code |
keyword |
The DNS response code. |
dns.type |
keyword |
The type of DNS event captured, query or answer. |
event.action |
keyword |
The action captured by the event. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.code |
keyword |
Identification code for this event. |
event.end |
date |
event.end contains the date when the event ended or when the activity was last observed. |
event.kind |
keyword |
The kind of the event. The highest categorization field in the hierarchy. |
event.outcome |
keyword |
The outcome of the event. The lowest level categorization field in the hierarchy. |
event.provider |
keyword |
Source of the event. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.start |
date |
event.start contains the date when the event started or when the activity was first observed. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
host.hostname |
keyword |
Hostname of the host. |
host.os.type |
keyword |
Which commercial OS family (one of: linux, macos, unix or windows). |
process.name |
keyword |
Process name. |
sekoiaio.client.name |
keyword |
Name of the client |
sekoiaio.server.name |
keyword |
Name of the server |
sekoiaio.server.os.type |
keyword |
OS type of the server |
source.ip |
ip |
IP address of the source. |
tags |
keyword |
List of keywords used to tag each event. |
user.target.domain |
keyword |
Name of the directory the user is a member of. |
user.target.name |
keyword |
Short name or login of the user. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.
Related articles
Sekoia Endpoint Agent: Overview of the agent, supported OS versions, prerequisites, and resource footprint.
Sekoia Endpoint Agent — built-in detection rules: Reference for all built-in detection rules that match this intake.