Event capture and Elastic Defend
Elastic Defend collects selective data on system activities in order to detect and prevent as many threats as possible, while balancing storage and performance overhead. To that end, Elastic Defend isn’t designed to provide a complete capture of all system events. The event data that Elastic Defend generates might be aggregated, truncated, or deduplicated as needed to optimize threat detection and prevention.
You can supplement Elastic Defend's protection capabilities with additional Elastic integrations and tools that provide more visibility and historical data. Consult the following sections to learn what Elastic Defend collects for specific system events and how to expand data collection.
The detailed event and API lists on this page cover Windows only. For other operating systems, Elastic Defend collects a similar selective set of events, but this page doesn't list them. To see which event categories Elastic Defend collects on each operating system, refer to Event collection.
Elastic Defend tracks TCP connections. If a port is created but no traffic flows, no events are generated.
For complete capture of network port creation and deletion, consider capturing Windows event ID 5158 using the Custom Windows Event Logs integration.
Elastic Defend tracks TCP connections, which don’t include network in/out connections.
For complete network capture, consider deploying Packetbeat using the Network Packet Capture integration.
Elastic Defend collects a selected set of user security events to support threat detection and prevention. It doesn't capture every user event, and the events it collects vary by operating system.
On Windows, Elastic Defend uses Event Tracing for Windows (ETW) to collect the following Windows Security events and stores them in the logs-endpoint.events.security-* data stream.
| Windows event ID | Description |
|---|---|
| 4624 | An account was successfully logged on. |
| 4625 | An account failed to log on. |
| 4634 | An account was logged off. |
| 4648 | A logon was attempted using explicit credentials. |
| 4672 | Special privileges were assigned to a new logon. |
| 4720
|
A user account was created. |
| 4800 | The workstation was locked. |
| 4801 | The workstation was unlocked. |
| 5382
|
Vault credentials were read. |
Elastic Defend doesn't collect other user-related events, such as user account deletion or modification. To collect these events, use the Custom Windows Event Logs integration.
Elastic Defend only captures system service security events required by its behavioral protection engine.
On Windows, Elastic Defend uses Event Tracing for Windows (ETW) to collect the following Windows Security events and stores them in the logs-endpoint.events.security-* data stream.
| Windows event ID | Description |
|---|---|
| 4697
|
A service was installed in the system. |
Service creation and modification can also be detected in registry activity, for which Elastic Defend has internal rules such as Registry or File Modification from Suspicious Memory.
For complete capture of all or specific Windows security events, consider the Custom Windows Event Logs integration.
Elastic Defend only captures scheduled task security events required by its behavioral protection engine.
On Windows, Elastic Defend uses Event Tracing for Windows (ETW) to collect the following Windows Security events and stores them in the logs-endpoint.events.security-* data stream.
| Windows event ID | Description |
|---|---|
| 4698
|
A scheduled task was created. |
| 4702
|
A scheduled task was updated. |
For complete capture of all or specific Windows security events, consider the Custom Windows Event Logs integration.
On Windows, Elastic Defend monitors calls to sensitive Windows APIs that malware commonly abuses, and stores selected calls as API events in the logs-endpoint.events.api-* data stream. The name of the called API is stored in the process.Ext.api.name field.
Elastic Defend doesn't generate an event for every call to a monitored API. Events are generated only under certain conditions. Also, some API events aren't sent to Elasticsearch by default. To send these events to Elasticsearch, set the windows.advanced.events.api_verbose advanced policy setting to true.
Monitored Windows APIs
AmsiScanBufferconnectCreateProcessAsUserACreateProcessAsUserWDeviceIoControlGetAsyncKeyStateImpersonateLoggedOnUserImpersonateNamedPipeClientINetFwRules::AddInternetOpenUrlIoCreateDeviceIWbemServicesmethods (WMI operations)IWbemServices::PutInstancefor WMI permanent event subscription creationldap_searchMapViewOfFileMapViewOfFile2NtCreateProcessNtCreateProcessExNtCreateUserProcessNtFsControlFileNtQueueApcThreadNtSetInformationThreadNtSuspendProcessOpenProcessOpenThreadQueueUserAPCReadProcessMemoryRegisterRawInputDevicesSetThreadContextSetThreadTokenSetWindowsHookExSuspendThreadTpAllocWorkTpCallbackStartVirtualAllocVirtualAllocExVirtualProtectVirtualProtectExWinHttpOpenRequestWow64SetThreadContextWriteProcessMemory
For some API events, process.Ext.api.name might contain the API that called the monitored API, rather than the monitored API itself.
Elastic Defend scans every driver as it is loaded, but it doesn’t generate an event each time.
Drivers are registered in the system as system services. You can capture this with Windows event ID 4697 using the Custom Windows Event Logs integration.
Also consider capturing Windows event ID 6 using Winlogbeat's Sysmon module.
Elastic Defend tracks creation, modification, and deletion of all files on the system. However, as mentioned above, the data might be aggregated, truncated, or deduplicated to provide only what’s required for threat detection and prevention.