ElkeidData.xlsx

采集字段列表

DataType	1	2	10	35	42	43	49	59	60	62	82	86	101	112	157	165	200	231	356	601	602	603	604	605	606	607	608	609	610	611	700	701	702	703	1000	1001	1010	2010	2011	2459	4000	4001	5050	5051	5052	5053	5054	5055	5057	5058	6001	6002	6003
Source	Driver Plugin(Gray means that only Driver Sandbox mode is supported default is off)																																		Elkeid Agent			Elkeid RASP			Journal Watcher		Collector Plugin								ScannerClamav Plugin
Description	Write	Open	Mprotect	Nanosleep	Connect	Accept	Bind	Execve	Exit	Kill	Rename	Link	Ptrace	SetSid	Prctl	Mount	tkill	exit_group	MemfdCreate	DNS Query	CreateFile	LoadModule	CommitCred	unlink	rmdir	call_usermode	ReadFile	WriteFile	USB Event	PrivilegeEscalation	ProcFileHook	SyscallHook	LkmHidden	InterruptsHook	Agent Heartbeat	Plugin Heartbeat	Agent Error Log	Command	Report	Hook	SSH Login	Kerberos Auth	Process	Port	User	Cron	Service	Software	Integrity	Sudoers	Dir Match	Proc Match	Scan Task
Field	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	data_type	kernel_version	name	level	data_type	data_type	data_type	status	authorized	cmdline	family	username	path	name	name	software_name	run_as_users	types	types	types
	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	uid	exe	uid	uid	uid	uid	module_name	module_name	module_name	module_name	arch	pversion	msg	probe_version	pid	probe_version	types	principal	cwd	protocol	password	username	type	sversion	digest	run_as_groups	class	class	class
	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	exe	argv	exe	exe	exe	exe		syscall_number		interrupt_number	platform	rx_speed	source	name	action	runtime	invalid	rawlog	checksum	state	uid	schedule	command	type	origin_digest	options	name	name	name
	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	pid	wait	pid	pid	pid	pid					platform_family	tx_speed	plugin	commands	reason	runtime_version	user	pid	exe_hash	sport	gid	command	restart	source	digest_algotithm	command	exe	exe	exe
	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid	ppid		ppid	ppid	ppid	ppid					platform_version	rx_tps	psign	pid	cmdline	message_type	sip		exe	dport	groupname	checksum	working_dir	status	exe	username	exe_size	exe_size	exe_size
	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid	pgid		pgid	pgid	pgid	pgid					idc	tx_tps	pver	state	tracing_state	class_id	sport		pid	sip	info		checksum	vendor	modify_time		exe_hash	exe_hash	exe_hash
	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid	tgid		tgid	tgid	tgid	tgid					region	cpu		runtime	runtime	method_id	rawlog		comm	dip	home		bus_name	component_version	software_version		md5_hash	md5_hash	md5_hash
	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid	sid		sid	sid	sid	sid					net_mode	rss		probe_message	attach_start_time	pid	extra		state	uid	shell			pid			create_at	create_at	create_at
	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm	comm		comm	comm	comm	comm					rx_speed	read_speed			attach_end_time	args	pid		ppid	inode	last_login_time			pod_name			modify_at	modify_at	modify_at
	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename	nodename		nodename	nodename	nodename	nodename					tx_speed	write_speed			failed_time	stack_trace			pgid	username	last_login_ip			psm				pid	error
	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid	sessionid		sessionid	sessionid	sessionid	sessionid					cpu	pid			missing_time	rasp_timestamp			sid	pid	weak_password							ppid	token
	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns	pns		pns	pns	pns	pns					rss	started_at			try_attach_count				cpu	exe								pgid	{custom}
	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns	root_pns		root_pns	root_pns	root_pns	root_pns					read_speed	du			attached_count				start_at	comm								tgid
	file	flags	mprotect_prot	sec	sa_family	sa_family	sa_family	argv	argv	target_pid	old_name	old_name	ptrace_request	argv	option	pid_tree	target_pid	argv	fd_name	query	file_path	ko_file	pid_tree	file	file		file	file	product_info	dpid					write_speed	fd_cnt							nthreads	cmdline								argv
	buf	mode	owner_pid	nsec	dip	dip	sip	run_path	ppid_argv	sig	new_name	new_name	target_pid	ppid_argv	new_name	dev	sig	ppid_argv	flags	sa_family	dip	pid_tree	old_uid	argv	argv		sb_id	sb_id	manufacturer	pid_tree					pid								vsize									comm
	argv	file	owner_file	argv	dport	dport	sport	stdin	pgid_argv	argv	sb_id	sb_id	addr	pgid_argv	argv	file_path	argv	pgid_argv	argv	dip	dport	run_path	res	ppid_argv	ppid_argv		argv	argv	serial	dcred					fd_cnt								rss									sessionid
	ppid_argv	argv	vm_file	ppid_argv	sip	sip	res	stdout	username	ppid_argv	argv	argv	data	username	ppid_argv	fstype	ppid_argv	username	ppid_argv	dport	sip	argv	argv	pgid_argv	pgid_argv		ppid_argv	ppid_argv	action	cred					started_at								umask									uid
	pgid_argv	ppid_argv	pid_tree	pgid_argv	sport	sport	argv	dip	pod_name	pgid_argv	ppid_argv	ppid_argv	pid_tree	pod_name	pgid_argv	flag	pgid_argv	pod_name	pgid_argv	sip	sport	ppid_argv	ppid_argv	username	username		pgid_argv	pgid_argv	argv	argv					tx_tps								tcpid									pns
	username	pgid_argv	argv	username	res	res	ppid_argv	dport	exe_hash	username	pgid_argv	pgid_argv	argv	exe_hash	username	argv	username	exe_hash	username	sport	sa_family	pgid_argv	pgid_argv	pod_name	pod_name		username	username	ppid_argv	ppid_argv					rx_tps								ruid
	pod_name	username	ppid_argv	pod_name	argv	argv	pgid_argv	sip	pid_tree	pod_name	username	username	ppid_argv	pid_tree	pod_name	ppid_argv	pod_name	pid_tree	pod_name	opcode	socket_pid	username	username	exe_hash	exe_hash		pod_name	pod_name	pgid_argv	pgid_argv					du								euid
	exe_hash	pod_name	pgid_argv	exe_hash	ppid_argv	ppid_argv	username	sport		exe_hash	pod_name	pod_name	pgid_argv		exe_hash	pgid_argv	exe_hash		exe_hash	rcode	sb_id	pod_name	pod_name	pid_tree	pid_tree		exe_hash	exe_hash	username	username					grs								suid
	pid_tree	exe_hash	username	pid_tree	pgid_argv	pgid_argv	pod_name	sa_family		pid_tree	exe_hash	exe_hash	username		pid_tree	username	pid_tree		pid_tree	argv	argv	exe_hash	exe_hash				pid_tree	pid_tree	pod_name	pod_name					nproc								fsuid
		pid_tree	pod_name		username	username	exe_hash	pid_tree		target_argv	pid_tree	pid_tree	pod_name			pod_name				ppid_argv	ppid_argv		old_username						exe_hash	exe_hash					load_1								rusername
			exe_hash		pod_name	pod_name	pid_tree	tty					exe_hash			exe_hash				pgid_argv	pgid_argv								pid_tree	pid_tree					load_5								eusername
					exe_hash	exe_hash		socket_pid					target_argv							username	username									dpid_argv					load_15								susername
					pid_tree	pid_tree		ssh												pod_name	pod_name														running_procs								fsusername
								ld_preload												exe_hash	exe_hash														total_procs								nspid
								res												pid_tree	pid_tree														boot_at								nspgid
								socket_argv													socket_argv														sys_cpu								nssid
								ppid_argv																											sys_mem								dns
								pgid_argv																																			cns
								username																																			ins
								pod_name																																			mns
								exe_hash																																			nns
																																											pns
																																											tns
																																											uns
																																											utns

数据类型分类

File	create
	read/write
	mem_createfd
	rename
	link
	open
	unlink
	rmdir
Network	connect
	bind
	dns_query
	accept
Process	execve
	call_usermode
	prctl
	setsid
	ptrace
	exit/exit_group
	kill
Authority	commit_cred
Authority	mprotect
Kernel	load_module
Rootkit	proc_file_hook
	syscall_hook
	lkm_hidden
	interrupts_hook
Assets	process list
	port listeing list
	linux user list
	crontab list
	deb list
	rpm list
	pypi list
	apt conf
	yum conf
	sshd conf
	linux service list
LogWatcher	ssh login
LogWatcher	kerberos auth

字段对应中文描述

字段名	类型	中文名
agent_id	string	AgentID
attack_id_list	[]string	ATT&CK的ID
command	string	Cron命令行
path	string	Cron文件位置
user	string	Cron执行用户
query	string	DNS查询
ptrace_request	string	Ptrace 请求
ssh	string	SSH登陆信息
option	string	操作类型
handle_user	string	处理人
handle_time	int	处理时间
status	string	处理状态
flags	string	创建参数
types	string	登陆类型
user	string	登陆用户名
external_conns	string	对外连接
create_time	int	发生时间
level	string	风险级别
alarm_name	string	风险类型
desc	string	风险说明
ppid	string	父进程ID
ppid_argv	string	父进程命令行
node_list	[]string	告警节点
rule_name	string	告警名
update_time	int	更新时间
file_path	string	挂载目录
flags	string	挂载选项
top_rule_chain	string	规则链
sip	string	监听IP
sport	string	监听端口
timestamp	string	检测时间
suggest	string	解决建议
pid	string	进程ID
pid_set	string	进程ID集合
exe	string	进程二进制文件
top_chain	string	进程链
comm	string	进程名
argv	string	进程命令行
stdout	stirng	进程输出
stdin	stirng	进程输入
pid_tree	string	进程树信息
uid	string	进程所属用户(用户ID)
username	string	进程所属用户(用户名)
pgid	string	进程组ID
pgid_argv	string	进程组命令行
static_file	string	静态文件
connect_info	string	连接信息
ssh_info	string	连接信息
target_pid	string	目标进程ID
target_argv	string	目标进程命令行
fd_name	string	内存文件名
ko_file	string	内核模块
module_name	string	内核模块名
in_ip_list	[]string	内网IP列表
container_image	string	容器镜像
container_name	string	容器名
dev	string	设备
docker	string	是否处于容器环境
data_type_str	string	数据类型
data_type	string	数据类型标识
data_type_str	string	数据描述
old_uid	string	提权前用户ID
old_username	string	提权前用户名
socket_pid	string	外联进程ID
socket_argv	string	外联进程命令行
out_ip_list	[]string	外网IP列表
create_at	string	文件创建时间
types	string	文件类型
file_path	string	文件路径
fstype	string	文件系统类型
modify_at	string	文件修改时间
md5_hash	string	文件指纹
syscall_number	string	系统调用ID
dpid	string	先祖进程ID
dcred	string	先祖进程权限序列
cred	string	先祖进程权限序列
ssh	string	相关SSH登陆信息
new_name	string	新进程名
new_name	string	新文件
name	string	样本家族
class	string	样本类型
argv	string	用户态执行命令
old_name	string	原始文件
ld_preload	string	运行时链接
wait	string	执行等待
run_path	string	执行目录
interrupt_number	string	中断ID
os	string	主机操作系统类型
hostname	string	主机名