elastic / elastic/integrations
[Windows Security] Scheduled Task ECS Mappings
Open
enhancement
Integration:system
Team:Security-Service Integrations
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
Windows event ID 4698 (sample data [here](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698)) is triggered when a scheduled task is created.
The system/security pipeline does not current parse/map the scheduled task process name, executable and command line - all useful fields for malware detection.
Can we please update the pipeline to ensure these fields are mapped to ECS? A sample event from a customer is also available internally, which I can provide.
Contributor guide
Assessment
This issue has not been assessed yet.