Making Threat Graph Extensible: Leveraging a DSL to Improve Data Ingestion (Part 1 of 2)

Glossary

The Challenge

What Is a DSL?

Why a DSL?

Our DSL

• Name: Used to describe the context of the handler
• Event list: A set of the events the handler is interested in processing
• Variable and constant declaration: Used for storing, transforming, combining shared attributes.
• Graph mutations:
  • Vertex to create
  • Edges to create
  • Properties to add to the above vertices and edges

Our Process

 

Go Representation of the DSL Specification

type HandlerDef struct {
  Name        string     `hcl:"name,label"`
  Constants   <>Constant `hcl:"const,block"`
  Variables   <>Variable `hcl:"var,block"`
  Events      <>Event    `hcl:"event,block"`
  Graph       Graph      `hcl:"graph,block"`
}

type Event struct {
  Name  string `hcl:"name"`
}

type Constant struct {
  Name  string      `hcl:"name,label"`
  Value interface{} `hcl:"value"`
}

type Variable struct {
  Name        string         `hcl:"name,label"`
  Key         string         `hcl:"key,optional"`
  OnError     string         `hcl:"onError,optional"`
  Action      hcl.Attributes `hcl:"action,remain"`
  Transformer string         `hcl:"execute,optional"`
}

type Vertex struct {
  Name       string            `hcl:"name,label"`
  Type       string            `hcl:"type"`
  ID         string            `hcl:"id"`
  Timestamp  string            `hcl:"timestamp,optional"`
  Props      mapstring `hcl:"props,optional"`
}

type Edge struct {
  SourceVertex string            `hcl:"sourceVertex,label"`
  Direction    string            `hcl:"direction,label"`
  AdjVertex    string            `hcl:"adjVertex,label"`
  EdgeType     string            `hcl:"type"`
  Timestamp    string            `hcl:"timestamp"`
  Props        mapstring `hcl:"props,optional"`
}

type Graph struct {
  Mutations <>Mutation `hcl:"mutation,block"`
}

type Mutation struct {
  Events    <>string   `hcl:"events,optional"`
  Vertices  <>Vertex   `hcl:"vertex,block"`
  Edges     <>Edge     `hcl:"edge,block"`
  Variables <>Variable `hcl:"var,block"`
}

DSL Representation of Handler

handler "process_handler" {
}

event {
  name = event.ProcessInformation
}

const "badProcessID" {
  value = -1
}

const “validTypes” {
  value = <1, 2, 3>
}

var "host" {
  key     = field.Hostname
  onError = action.Break
}

var "processID" {
  key     = field.ProcessId
  onError = action.Continue
}

var "user" {
  execute = userlib.GetUser()
  onError = action.Error
}

• action.Continue: Ignore any failure to extract or compute the field and move forward
• action.Break: Stop the execution of the handler, but do not return an error to the caller
• action.Error: Stop the execution of the handler, and return an error to the caller

var "processID" {
  key     = field.ProcessId
  onError = action.Continue
  action  = "${len(processID) == 0 || processID == badProcessID ? break : continue}"
}

graph {
  mutation {
  }
}

vertex "process" {
  type       = vertex.Process
  id         = var.processID
  timestamp  = time.Now
  props = {
    "process_id" : var.processID
  }
}

vertex "user" {
  type      = vertex.User
  id        = var.user
  timestamp = time.Now
}

vertex "host" {
  type      = vertex.Host
  id        = var.host
  timestamp = time.Now
}

edge "user" "->" "host" {
  type      = edge.UserHostEdge
  timestamp = time.Now
}

handler "process_handler" {
  event {
    name = event.ProcessInformation
  }

  const "badProcessID" {
    value = -1
  }

  var "host" {
    execute = field.Hostname
    onError = action.Break
  }

  var "processID" {
  key     = field.ProcessId
  onError = action.Error
  action  = "${len(processID) == 0 || processID == badProcessID ? break : continue}"
}

  var "user" {
    execute = userlib.GetUser()
    onError = action.Error
  }

  graph {
    mutation {
      vertex "process" {
        type       = vertex.Process
        id         = var.processID
        timestamp  = time.Now
        props = {
          "process_id" : var.processID
        }
      }

      vertex "user" {
        type       = vertex.User
        id         = var.user
        timestamp  = time.Now
      }

      vertex "host" {
        type      = vertex.Host
        id        = var.host
        timestamp = time.Now
      }

      edge "user" "->" "host" {
        type      = edge.UserHostEdge
        timestamp = time.Now
      }

      edge "user" "<-" "host" { type = edge.HostUserEdge timestamp = time.Now } edge "user" "->" "process" {
        type      = edge.UserProcessEdge
        timestamp = time.Now
      }
    }
  }
}

Intermediate Representation

type Edge struct {
  SourceVertex string
  Direction    EdgeDirection
  AdjVertex    string
  EdgeType     Edge
  Timestamp    time.Time
  Props        mapstring
}

Additional Resources

• For more information about CrowdStrike Threat Graph, download the data sheet.

   

• Find out more about the benefits of Threat Graph by visiting the webpage.

   

• Learn about the powerful, cloud-native CrowdStrike Falcon® platform by visiting the product webpage.

   

• Get a full-featured free trial of CrowdStrike Falcon® Prevent™ and see how true next-gen AV performs against today’s most sophisticated threats.