{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/ecs/issues/126","repository_url":"https://api.github.com/repos/elastic/ecs","labels_url":"https://api.github.com/repos/elastic/ecs/issues/126/labels{/name}","comments_url":"https://api.github.com/repos/elastic/ecs/issues/126/comments","events_url":"https://api.github.com/repos/elastic/ecs/issues/126/events","html_url":"https://github.com/elastic/ecs/issues/126","id":364205452,"node_id":"MDU6SXNzdWUzNjQyMDU0NTI=","number":126,"title":"Application Fields (e.g. app name for Endpoint Detection logs)?","user":{"login":"dainperkins","id":39424713,"node_id":"MDQ6VXNlcjM5NDI0NzEz","avatar_url":"https://avatars0.githubusercontent.com/u/39424713?v=4","gravatar_id":"","url":"https://api.github.com/users/dainperkins","html_url":"https://github.com/dainperkins","followers_url":"https://api.github.com/users/dainperkins/followers","following_url":"https://api.github.com/users/dainperkins/following{/other_user}","gists_url":"https://api.github.com/users/dainperkins/gists{/gist_id}","starred_url":"https://api.github.com/users/dainperkins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dainperkins/subscriptions","organizations_url":"https://api.github.com/users/dainperkins/orgs","repos_url":"https://api.github.com/users/dainperkins/repos","events_url":"https://api.github.com/users/dainperkins/events{/privacy}","received_events_url":"https://api.github.com/users/dainperkins/received_events","type":"User","site_admin":false},"labels":[{"id":947079992,"node_id":"MDU6TGFiZWw5NDcwNzk5OTI=","url":"https://api.github.com/repos/elastic/ecs/labels/discuss","name":"discuss","color":"b1f279","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-09-26T20:47:56Z","updated_at":"2018-09-28T13:32:34Z","closed_at":null,"author_association":"NONE","body":"I couldn't find anything regarding a field for \"Application\" (as in executed program on an OS, not L7 application ID of a network flow)\r\n\r\nApplication.name\r\nApplication.verison\r\netc...\r\n\r\nAm I missing it?\r\n\r\nthx\r\n/d"},"comment":{"url":"https://api.github.com/repos/elastic/ecs/issues/comments/425436716","html_url":"https://github.com/elastic/ecs/issues/126#issuecomment-425436716","issue_url":"https://api.github.com/repos/elastic/ecs/issues/126","id":425436716,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNTQzNjcxNg==","user":{"login":"dainperkins","id":39424713,"node_id":"MDQ6VXNlcjM5NDI0NzEz","avatar_url":"https://avatars0.githubusercontent.com/u/39424713?v=4","gravatar_id":"","url":"https://api.github.com/users/dainperkins","html_url":"https://github.com/dainperkins","followers_url":"https://api.github.com/users/dainperkins/followers","following_url":"https://api.github.com/users/dainperkins/following{/other_user}","gists_url":"https://api.github.com/users/dainperkins/gists{/gist_id}","starred_url":"https://api.github.com/users/dainperkins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dainperkins/subscriptions","organizations_url":"https://api.github.com/users/dainperkins/orgs","repos_url":"https://api.github.com/users/dainperkins/repos","events_url":"https://api.github.com/users/dainperkins/events{/privacy}","received_events_url":"https://api.github.com/users/dainperkins/received_events","type":"User","site_admin":false},"created_at":"2018-09-28T13:32:34Z","updated_at":"2018-09-28T13:32:34Z","author_association":"NONE","body":"would it be appropriate to have e.g. process namespace for os process\ninformation, and a separate application name space for name/version/etc, or\nbetter to collapse it all under process?\n\nMy $.02, fwiw, is that with things like \"source\", \"process\", \"device\", and\n\"event\" the top level name spaces are for discrete types of entities, a\nprocess being any executed item on a host (service, part of an application,\nplugin, etc) , an application being a logical entity that could encompass\nmultiple processes, etc.   Thats how I read the intent, and it seems\neasier, but I can certainly understand if there is a concern over too large\na top level set of namespaces\n\nApplication specifics (as opposed to process specifics in the case of a\nprocess not necessarily being indicative of a specific application/ app\nversion - think about all the stuff that O365 runs)  could also be useful\nfor dynamically looking up CVE / CVSS information (either to score an event\nfrom aCVSS perspective, populating additional context, or for linking\nevents to relative CVE issues)\n\n/d\n\nHeres an example (making up some chrome memory access issue EDR alert)\n\n[reporting device info - cylance mgmt console]\ndevice.hostname   = cylance_mgr.mydomain.com\ndevice.ip                 = 10.192.1.10\ndevice.vendor        = Cylance\ndevice.type            = EDR\n\n[info about the event itself]\nevent.type             = Threat\nevent.action          = Alert\nevent.module        = Memory Protection\nevent.duration       = 2s\nevent.type             = Application attempted to access protected memory\nevent.risk_score = 7\n\n[details of the entity flagged in event]\nhost.ip                   = 192.168.5.17\nhost.name             = myWorkstation.mydomain.com\nhost.os.platform    = Mac OS x\nhost.os.name        = High Sierra\nhost.os.version     = 10.13.6\nhost.architecture   = x86_64\n\n[user involved in event]\nuser.name             = dain.perkins\nuser.id                   = some UUID\n\n[process involved in event]\nprocess.name       = Google Chrome Helper (or maybe its a Flash Plugin... )\nprocess.pid       = 91408\nprocess.ppid         = 90023\n\n[application that spawned the process - presumably ppid if present]\nApplication.name   = Chrome\nApplication.version = 69.0.3497.100\n\n[Threat information]\nthreat.type   = Memory Access\nthreat.tactic  = Privilege Escalation\nthreat.descripiton = CAPEC-69\n&c\n\n\nOn Fri, Sep 28, 2018 at 12:53 AM John Callahan <notifications@github.com>\nwrote:\n\n> I would think events related to an application should readily fit under\n> process.*?\n>\n> Would be great if ECS *process.** were fleshed out to cover everything in\n> *system.process.** in Metricbeat.\n>\n> —\n> You are receiving this because you authored the thread.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/elastic/ecs/issues/126#issuecomment-425320645>, or mute\n> the thread\n> <https://github.com/notifications/unsubscribe-auth/AlmSycKGSOpDd9LqHInRFtm3RERWDDJWks5ufatXgaJpZM4W7dkC>\n> .\n>\n"}}
{"actor":{"display_login":"dainperkins"}}