Package microsoft/sysmon Release Notes
Package microsoft/sysmon Release Notes Version 1.1.1
Removes the references to the lookup file from the parser.
Bumps the ecs.version to 8.16.0.
Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.
Package microsoft/sysmon Release Notes Version 1.1.0
The old parser sysmon is deprecated, and replaced by the new parser microsoft-sysmon. While the old parser will remain available during a tranisition period, all future changes will only go into the new microsoft-sysmon parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old sysmon parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.
Duplicated vendor fields dropped in new parserThe old sysmon parser would duplicate certain fields, which the new microsoft-sysmon parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp), and as a field mapped to CPS (e.g. source.ip). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved. This means the following fields will no longer be present in the parsed data, when using the new parser:
Vendor.EventData.CommandLine
Vendor.EventData.Company
Vendor.EventData.CurrentDirectory
Vendor.EventData.Description
Vendor.EventData.Destination
Vendor.EventData.DestinationIp
Vendor.EventData.DestinationPort
Vendor.EventData.DestinationPortName
Vendor.EventData.Device
Vendor.EventData.FileVersion
Vendor.EventData.Hashes.IMPHASH
Vendor.EventData.Image
Vendor.EventData.ImageLoaded
Vendor.EventData.OriginalFileName
Vendor.EventData.ParentCommandLine
Vendor.EventData.ParentImage
Vendor.EventData.ParentProcessGuid
Vendor.EventData.ParentProcessId
Vendor.EventData.PipeName
Vendor.EventData.ProcessGuid
Vendor.EventData.ProcessId
Vendor.EventData.Product
Vendor.EventData.Protocol
Vendor.EventData.QueryName
Vendor.EventData.RuleName
Vendor.EventData.Signature
Vendor.EventData.SignatureStatus
Vendor.EventData.Signed
Vendor.EventData.SourceImage
Vendor.EventData.SourceIp
Vendor.EventData.SourcePort
Vendor.EventData.SourcePortName
Vendor.EventData.SourceProcessGUID
Vendor.EventData.SourceProcessGuid
Vendor.EventData.SourceProcessId
Vendor.EventData.SourceThreadId
Vendor.EventData.TargetFilename
Vendor.EventData.TargetObject
Bug fix: Renamed the field name from file.code_signature.signed> to file.code_signature.exists to ensure compliance with CPS standard.
Package microsoft/sysmon Release Notes Version 1.0.0
Adds new event.module, event.dataset and Cps.version fields
Removes the Product, related.ip, related.user, related.hosts and related.hash fields
Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type