elastic / elastic/integrations

[Windows Security] Scheduled Task ECS Mappings

Open
#10,536 8 comments 1 reaction 1 assignee Claimed by @marc-gr View on GitHub
enhancement Integration:system Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

Windows event ID 4698 (sample data [here](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698)) is triggered when a scheduled task is created.

The system/security pipeline does not current parse/map the scheduled task process name, executable and command line - all useful fields for malware detection.

Can we please update the pipeline to ensure these fields are mapped to ECS? A sample event from a customer is also available internally, which I can provide.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.