security-documents-generator/check_visual_analyzer.js at main · enriquesanchez-elastic/security-documents-generator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
import { Client } from '@elastic/elasticsearch';
import fs from 'fs';

const config = JSON.parse(fs.readFileSync('./config.json', 'utf8'));

const client = new Client({
  node: config.elastic.node,
  auth: {
    username: config.elastic.username,
    password: config.elastic.password,
  },
  tls: {
    rejectUnauthorized: false,
  },
});

async function checkData() {
  console.log('\n🔍 Checking Visual Event Analyzer Data Structure...\n');

  // 1. Check detection alerts
  console.log('1️⃣  Detection Alerts (.alerts-security.alerts-default):');
  const alerts = await client.search({
    index: '.alerts-security.alerts-default',
    size: 1,
    _source: ['process.entity_id', 'process.parent.entity_id', 'process.Ext.ancestry', 'kibana.alert.ancestors', 'host.name'],
    sort: [{ '@timestamp': 'desc' }],
  });

  if (alerts.hits.hits.length > 0) {
    const alert = alerts.hits.hits[0]._source;
    console.log('   ✓ Found alert');
    console.log(`   - process.entity_id: ${alert.process?.entity_id}`);
    console.log(`   - process.parent.entity_id: ${alert.process?.parent?.entity_id}`);
    console.log(`   - process.Ext.ancestry: ${JSON.stringify(alert.process?.Ext?.ancestry)}`);
    console.log(`   - kibana.alert.ancestors[0].id: ${alert.kibana?.alert?.ancestors?.[0]?.id}`);
    console.log(`   - kibana.alert.ancestors[0].index: ${alert.kibana?.alert?.ancestors?.[0]?.index}`);
    console.log(`   - host.name: ${alert.host?.name}\n`);

    // 2. Check if the referenced process event exists
    const ancestorId = alert.kibana?.alert?.ancestors?.[0]?.id;
    const ancestorIndex = alert.kibana?.alert?.ancestors?.[0]?.index;

    if (ancestorId && ancestorIndex) {
      console.log(`2️⃣  Process Event (${ancestorIndex}):`);
      try {
        const processEvent = await client.get({
          index: ancestorIndex,
          id: ancestorId,
        });
        console.log('   ✓ Process event found by _id');
        console.log(`   - process.entity_id: ${processEvent._source.process?.entity_id}`);
        console.log(`   - process.parent.entity_id: ${processEvent._source.process?.parent?.entity_id}`);
        console.log(`   - process.Ext.ancestry: ${JSON.stringify(processEvent._source.process?.Ext?.ancestry)}\n`);

        // 3. Check if we can find parent process
        const parentEntityId = processEvent._source.process?.parent?.entity_id;
        if (parentEntityId) {
          console.log('3️⃣  Parent Process:');
          const parentSearch = await client.search({
            index: ancestorIndex,
            body: {
              query: {
                term: { 'process.entity_id': parentEntityId },
              },
            },
            size: 1,
          });

          if (parentSearch.hits.hits.length > 0) {
            console.log('   ✓ Parent process found by entity_id');
            console.log(`   - process.entity_id: ${parentSearch.hits.hits[0]._source.process?.entity_id}`);
            console.log(`   - process.name: ${parentSearch.hits.hits[0]._source.process?.name}\n`);
          } else {
            console.log('   ✗ Parent process NOT found\n');
          }
        }

        // 4. Check if we can find grandparent
        const ancestry = processEvent._source.process?.Ext?.ancestry;
        if (ancestry && ancestry.length > 0) {
          console.log('4️⃣  Grandparent Process (from ancestry):');
          const grandparentEntityId = ancestry[ancestry.length - 1];
          const grandparentSearch = await client.search({
            index: ancestorIndex,
            body: {
              query: {
                term: { 'process.entity_id': grandparentEntityId },
              },
            },
            size: 1,
          });

          if (grandparentSearch.hits.hits.length > 0) {
            console.log('   ✓ Grandparent process found by entity_id');
            console.log(`   - process.entity_id: ${grandparentSearch.hits.hits[0]._source.process?.entity_id}`);
            console.log(`   - process.name: ${grandparentSearch.hits.hits[0]._source.process?.name}\n`);
          } else {
            console.log('   ✗ Grandparent process NOT found\n');
          }
        }

      } catch (error) {
        console.log(`   ✗ Process event NOT found by _id: ${error.message}\n`);
      }
    }
  } else {
    console.log('   ✗ No alerts found\n');
  }

  console.log('✅ Analysis complete');
}

checkData().catch(console.error);