Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add several new observable types #1326

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

MiDoCisco
Copy link
Contributor

@MiDoCisco MiDoCisco commented Jan 27, 2025

Related Issue: N/A

Description of changes:

We are populating the observables with values which are notable for correlation or display to the users. There are several values, which we think make good observables, but are not marked as such. This PR tries to add them.

These are the details:

  1. Added email.subject, email.uid and message_uid as an Observable types - type_id: 39, type_id: 40 and 45.
  2. Added process_entity.uid as an Observable type - type_id: 41
  3. Added file_path_t as an Observable type - type_id: 42 and marked fields as this type
    • lineage dictionary attribute
    • affected_package.path object attribute
    • file.path object attribute
    • image.path object attribute
    • kernel.path object attribute
    • malware.path object attribute
    • process_entity.path object attribute
  4. Added extensions/windows/reg_key_path_t as an Observable type - type_id: 43 and marked fields as this type
    • reg_key.path object attribute
    • reg_value.path object attribute
  5. Added reg_value.name as an Observable type - type_id: 44

I have updated CHANGELOG.md with the same granularity of the information it already uses, but it's not a "single-line" description. Should I reduce the detail to make it single line?

Note On Compatibility

There is a failing compatibility validator, as I changed some fields from string_t to the new file_path_t and reg_key_path_t - as this seem to be the only way to mark several different fields as same observable. Since both old and new types are strings (the new one just adds semantics) I don't see how this could break type compatibility (e.g. in generated classes). But I am happy to learn about any concerns and also whether there is a better (more compatible) way to mark multiple fields with the same observable type.

---------

Signed-off-by: Michal Dobisek <[email protected]>
---------

Signed-off-by: Michal Dobisek <[email protected]>
---------

Signed-off-by: Michal Dobisek <[email protected]>
@MiDoCisco MiDoCisco force-pushed the add-new-observable-types branch from 9ca7d3e to 14abf4d Compare February 4, 2025 11:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants