Sysmon Parsing Problem | Log collection solutions

#1 cybergoof 7 years ago

The ProcessID in the "Message" is the ProcessID (25848) of the new process that sysmon sees created. However, in the structured NXLog key/values, the ProcessID is that of sysmon itself (1680)

The only way to get the ProcessID of the process sysmon observed created, is to use regular expressions. Can you verify that this is a bug in NXLog?

Permalink

#2 adm Nxlog ✓ 7 years ago

#1 cybergoof

The article on structured logging (https://nxlog.co/why-use-structured-logging) shows how you should use structured logging so that changes in log format is minimized. The example of the sysmon event, process creates, shows what I think is a bug in NXLog. The ProcessID in the "Message" is the ProcessID (25848) of the new process that sysmon sees created. However, in the structured NXLog key/values, the ProcessID is that of sysmon itself (1680) The only way to get the ProcessID of the process sysmon observed created, is to use regular expressions. Can you verify that this is a bug in NXLog?

This is a known issue. Unfortunately in the case of sysmon logs there is a ProcessID field under EventData while within the System properties there is also a ProcessID so the former does not get captured. See this question.