elastic / elastic/endpoint

[Bug] Network Direction Incorrect on Some Events

Open
#55 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Swift
Stars
47
Forks
9
PR merge metrics
No merged PRs in 30d

Description

## Describe the Issue

There may be more, but at least one event I have found marks `network.direction` as `egress` when `source.ip` and `destination.ip` are both "127.0.0.1". This should be considered an "internal" connection since it is neither egress nor ingress.

## Sample Data

```
{
"agent": {
"id": "12345678-90ab-cdef-fedc-ba0987654321",
"type": "endpoint",
"version": "8.8.1"
},
"process": {
"Ext": {
"ancestry": [
"ZjMxYmM0NDUtODJlMi00YmY4LTk5YTAtMzQ3NGRjZjAwYzk5LTIwMjY4LTE2ODc1MzM4MzMuMjM4NTg0NzAw",
"ZjMxYmM0NDUtODJlMi00YmY4LTk5YTAtMzQ3NGRjZjAwYzk5LTEyOTIwLTE2ODc1MzM3NzEuMzAzNzE5MzAw",
"ZjMxYmM0NDUtODJlMi00YmY4LTk5YTAtMzQ3NGRjZjAwYzk5LTIzNzYtMTY4NzUzMzc3MC42MzU0OTM4MDA=",
"ZjMxYmM0NDUtODJlMi00YmY4LTk5YTAtMzQ3NGRjZjAwYzk5LTEyNDAtMTY4NzUzMzY5NS42NzMyODU5MDA="
],
"code_signature": [
{
"trusted": true,
"subject_name": "Microsoft Corporation",
"exists": true,
"status": "trusted"
}
]
},
"code_signature": {
"trusted": true,
"subject_name": "Microsoft Corporation",
"exists": true,
"status": "trusted"
},
"name": "msedge.exe",
"pid": 15700,
"entity_id": "ZjMxYmM0NDUtODJlMi00YmY4LTk5YTAtMzQ3NGRjZjAwYzk5LTE1NzAwLTE2ODc1MzM4MzcuNjAxNzk0NzAw",
"executable": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
"uptime": 5843
},
"destination": {
"address": "127.0.0.1",
"port": 3128,
"bytes": 7,
"ip": "127.0.0.1"
},
"source": {
"address": "127.0.0.1",
"port": 52103,
"bytes": 517,
"ip": "127.0.0.1"
},
"message": "Endpoint network event",
"network": {
"bytes": 524,
"transport": "tcp",
"type": "ipv4",
"direction": "egress"
},
"@timestamp": "2023-06-23T17:01:21.3855299Z",
"ecs": {
"version": "1.11.0"
},
"related": {
"hosts": [
"COMPUTER1"
],
"ip": [
"127.0.0.1",
"10.10.10.10"
],
"user": [
"jdoe"
],
"mac": [
"01:23:45:67:89:AB",
"01:23:45:67:89:AC"
]
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "endpoint.events.network"
},
"elastic": {
"agent": {
"id": "12345678-90ab-cdef-fedc-ba0987654321"
}
},
"host": {
"hostname": "COMPUTER1",
"os": {
"Ext": {
"variant": "Windows 10 Enterprise"
},
"kernel": "22H2 (10.0.19045.3086)",
"name": "Windows",
"family": "windows",
"type": "windows",
"version": "22H2 (10.0.19045.3086)",
"platform": "windows",
"full": "Windows 10 Enterprise 22H2 (10.0.19045.3086)"
},
"ip": [
"127.0.0.1",
"10.10.10.10",
"::1"
],
"name": "COMPUTER1",
"id": "646e7e77-6bef-4ba0-a25e-bcfb7b723f51",
"mac": [
"01:23:45:67:89:AB",
"01:23:45:67:89:AC"
],
"architecture": "x86_64"
},
"event": {
"agent_id_status": "verified",
"sequence": 123647,
"ingested": "2023-06-23T17:01:22Z",
"created": "2023-06-23T17:01:21.3855299Z",
"kind": "event",
"module": "endpoint",
"action": "disconnect_received",
"id": "N7KsXpf7mWziy1Bm++++/Dit",
"category": [
"network"
],
"type": [
"end"
],
"dataset": "endpoint.events.network",
"outcome": "unknown"
},
"user": {
"domain": "CONTOSO",
"name": "jdoe",
"id": "S-1-5-21-574250515-252729241-315576832-44972"
}
}
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.