Description

This issue describes critical ECS field mapping updates for the Symantec Endpoint Security integration, including broad mapping improvements and proper handling of Windows event logs embedded within SES events. Customers have specifically requested these mappings to correlate SES events with their other security telemetry and leverage standard ECS fields.

Requested fields include:

• Windows event logs (critical for correlating with other Windows telemetry)
• Threat/attack field mapping (MITRE ATT&CK related fields)
• File and process hash mappings
• Network/URL field mappings
• Registry field mappings

See the Integrated Cyber Defense Schema documentation for full event type reference. Examples are available on request.

Enhancements

1. Implement ECS-compliant field mappings for various event types
2. Map Windows Event Logs (type_id 8015) to standard winlog ECS fields
3. Populate the message field for multiple event types

1a. General mapping improvements

The following fields need proper ECS mappings:

1b. Special handling for message fields:

For type_id 8027 and 8031, extract bpe_description from the ses.product_data field (if present) and map it to threat.enrichments.indicator.description or message:
Example value: "Suspicious PowerShell command line for downloading and executing a remote file detected - Method 180"

For type_id 42, map ses.type to message field:
Example value: "URL_REPUTATION", "FILE_REPUTATION"

For type_id 8003,8002,8006,8018,8001,8007,8005, 8000: Linux is correctly parsed/mapped, but for ses.device_os_type_value: Windows, map ses.edr_enriched_data.rule_description to message:
Example value: "Ps1 PowerShell script file created"

2a. Windows event log handling (type_id 8015)

For events with type_id 8015 (monitored source):

• Map ses.ref_event to winlog.event_id (contains Windows Event ID)
• Map ses.data to message field (currently empty). The ses.data field is a JSON string that needs to be parsed before mapping individual fields.

2b. Implement specific mappings for different Windows Event IDs as follows: