sysmon-arangodb/arango_sysmon.py at master · SecSamDev/sysmon-arangodb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
from pyArango.collection import Collection, Field, Edges
from pyArango.graph import Graph, EdgeDefinition


class SysmonProcess(Collection):
    _fields = {
        "_name" : Field(),
        "Image": Field(),
        "ProcessId": Field(),
        "ProcessGuid": Field(),
        "User": Field(),
        "ProcessName": Field(),
        "LogonGuid": Field(),
        "Computer" : Field() # For shardening
    }

class NetworkObject(Collection):
    _fields = {
        "_name" : Field(),
        "Ip": Field(),
        "Computer" : Field() # For shardening
    }

class RegistryObject(Collection):
    _fields = {
        "_name" : Field(),
        "Path": Field(),
        "Computer" : Field() # For shardening
    }

class CreateNewProcess(Edges):
    _fields = {
        "_name" : Field(),
        "UtcTime": Field(),
        "EventRecordID": Field(),
        "CurrentDirectory": Field(),
        "User": Field(),
        "CommandLine": Field(),
        "Hashes": Field(),
        "Computer" : Field() # For shardening
    }


class NetworkConnection(Edges):
    _fields = {
        "_name" : Field(),
        "UtcTime": Field(),
        "EventRecordID": Field(),
        "User": Field(),
        "DestinationPort": Field(),
        "DestinationIp": Field(),
        "SourceIp": Field(),
        "SourcePort" : Field(),
        "Protocol" : Field(),
        "Computer" : Field() # For shardening
    }

class NetworkConnection(Edges):
    _fields = {
        "_name" : Field(),
        "UtcTime": Field(),
        "EventRecordID": Field(),
        "User": Field(),
        "DestinationPort": Field(),
        "DestinationIp": Field(),
        "SourceIp": Field(),
        "SourcePort" : Field(),
        "Protocol" : Field(),
        "Computer" : Field() # For shardening
    }

class RegistryEvent(Edges):
    _fields = {
        "_name" : Field(),
        "UtcTime": Field(),
        "EventRecordID": Field(),
        "User": Field(),
        "EventType": Field(),
        "Computer" : Field() # For shardening
    }

class ProcessAccessed(Edges):
    _fields = {
        "_name" : Field(),
        "UtcTime": Field(),
        "EventRecordID": Field(),
        "User": Field(),
        "CallTrace": Field(),
        "TargetImage" : Field(),
        "Computer" : Field() # For shardening
    }

class SysmonGraph(Graph):
    _edgeDefinitions = [EdgeDefinition("CreateNewProcess", fromCollections=[
                                       "SysmonProcess"], toCollections=["SysmonProcess"]),
                        EdgeDefinition("NetworkConnection", fromCollections=[
                                       "SysmonProcess"], toCollections=["NetworkObject"]),
                        EdgeDefinition("RegistryEvent", fromCollections=[
                                       "SysmonProcess"], toCollections=["RegistryObject"]),
                        EdgeDefinition("ProcessAccessed", fromCollections=[
                                       "SysmonProcess"], toCollections=["SysmonProcess"])]
    _orphanedCollections = []


def customSysmonGraph(name):
    return type(name, (Graph, ), {
        "_edgeDefinitions" : [EdgeDefinition("CreateNewProcess", fromCollections=[
                                       "SysmonProcess"], toCollections=["SysmonProcess"]),
                        EdgeDefinition("NetworkConnection", fromCollections=[
                                       "SysmonProcess"], toCollections=["NetworkObject"]),
                        EdgeDefinition("RegistryEvent", fromCollections=[
                                       "SysmonProcess"], toCollections=["RegistryObject"]),
                        EdgeDefinition("ProcessAccessed", fromCollections=[
                                       "SysmonProcess"], toCollections=["SysmonProcess"])],
        "_orphanedCollections" : []
    })