Sysmon

Normalizer windows sysmon

Maps Windows Sysmon events onto Bifract's normalized fields, including bifract_category.

Add it

In Bifract, open Exchange, find Sysmon and click Add. Adds an instance-wide normalizer. Needs a tenant admin.

File

exchange/normalizers/sysmon/sysmon-normalizer.yaml

sysmon-normalizer.yaml

name: Sysmon
description: >-
  Maps Windows Sysmon events onto Bifract's normalized field contract, including
  bifract_category, which gates proc_lineage, proc_freq and process_edges and therefore
  everything pgr() can traverse. Accepts flat native Sysmon fields and the nested
  System/EventData shape Velociraptor ships, which flatten_leaf reduces to the same names.
  Field names are snake_case, matching Bifract Default.

transforms:
  - flatten_leaf
  - snake_case
  - lowercase

# Sources are names after the transforms. snake_case already produces most of the
# contract (EventID -> event_id, ProcessGuid -> process_guid, SourceProcessGUID ->
# source_process_guid), so only fields whose contract name differs are listed. Sigma
# field names pass through the same transforms and mappings. Sources starting with $.
# are paths into the raw event, matched before any transform.
field_mappings:
  # Velociraptor nests the ID under System.EventID.Value.
  - sources: [$.System.EventID.Value]
    target: event_id
  - sources: [computer]
    target: computer_name

  # Velociraptor's System.Execution names the event log service, not the subject
  # process, so it is kept apart from EventData.ProcessId and ThreadId.
  - sources: [$.System.Execution.ProcessID]
    target: execution_process_id
  - sources: [$.System.Execution.ThreadID]
    target: execution_thread_id

  # Image. Events 1/3/11/22 carry Image; events 8/10 carry SourceImage instead, and pgr
  # reads fields.image as the acting process for those too. No event carries both.
  - sources: [source_image]
    target: image
  - sources: [hashes]
    target: hash
  - sources: [command_line]
    target: commandline
  - sources: [parent_command_line]
    target: parent_commandline

  # File
  - sources: [target_filename]
    target: target_file

  # Network
  - sources: [source_ip]
    target: src_ip
  - sources: [source_port]
    target: src_port
  - sources: [destination_ip]
    target: dst_ip
  - sources: [destination_port]
    target: dst_port
  - sources: [protocol]
    target: proto

  # DNS
  - sources: [query_name]
    target: query

# Runs after field_mappings, so from_field is the already-renamed key. Additive: event_id
# is preserved. Any EventID not listed leaves bifract_category unset, which is correct,
# an unmapped event should not be claimed by a category.
value_mappings:
  - from_field: event_id
    to_field: bifract_category
    map:
      "1": process_creation
      "3": network_connect
      "6": driver_load
      "7": image_load
      "8": remote_thread
      "10": process_access
      "11": file_write
      "12": registry_event
      "13": registry_event
      "14": registry_event
      "15": create_stream_hash
      "17": pipe_created
      "18": pipe_created
      "22": dns_query
      "23": file_delete
      "26": file_delete

timestamp_fields:
  - field: utc_time
    format: "2006-01-02 15:04:05.000"
  # Velociraptor's System.TimeCreated.SystemTime, when UtcTime is absent.
  - field: system_time
    format: unix