How to create Provenance Graph

[datndptit]

can you guide me how to create provenance graph from sysmon log? if possible can you provide me the code?
thank you very much.

[anisyusof-sc]

Hey @datndptit . For sysdig graphs, we utilize the following tool. For Sysmon graphs, it is more involved. Here are the brief steps:

1. Have the Sysmon *.evtx file ready
2. Set up Grafiki by following their guide
3. Upload the Sysmon *.evxt file into Grafiki's web interface
4. On the Grafiki's interactive and animated page that shows your Sysmon graph, run our custom JavaScript code in your browser (e.g., for Chrome, it will be Developer Tools > Console). You might need to customize the JavaScript code.

(function(){
        const export_nodes = network.body.data.nodes.get();
        const export_edges = network.body.data.edges.get();
        const exportGraphData = { nodes: export_nodes, edges: export_edges };
        const blob = new Blob([JSON.stringify(exportGraphData, null, 2)], { type: "application/json" });
        const url = URL.createObjectURL(blob);
        const link = document.createElement("a");
        link.href = url;
        link.download = "provenance-graph.json";
        document.body.appendChild(link);
        link.click();
        document.body.removeChild(link);
    })();

5. Once the JavaScript is executed successfully, the *.json file will be automatically downloaded on your web browser
6. Optionally, you may want to automate the steps above by using Selenium

Hope this helps!

[datndptit]

@anisyusof-sc Thank you very much