Skip to content

[Update] EDR Telemetry for Windows - Elastic - Script-Block Activity, FileDownloaded and Device Operations#205

Open
AsuNa-jp wants to merge 4 commits into
tsale:mainfrom
AsuNa-jp:elastic_windows_powershell_scriptblock
Open

[Update] EDR Telemetry for Windows - Elastic - Script-Block Activity, FileDownloaded and Device Operations#205
AsuNa-jp wants to merge 4 commits into
tsale:mainfrom
AsuNa-jp:elastic_windows_powershell_scriptblock

Conversation

@AsuNa-jp

@AsuNa-jp AsuNa-jp commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown

EDR Telemetry Pull Request

Contribution Details

This PR updates the Windows scoring matrix to reflect that Elastic now collects the following events:

Sub-Category Parent Previous New Note
USB Device Mount Device Operations No Yes
USB Device Unmount Device Operations No Yes
Script-Block Activity PowerShell Activity Via EventLogs Yes We collect PowerShell script-block via Amsi event (AmsiScanBuffer ETW event).
File Downloaded Network Activity No Partially We capture the creation of Mark of the Web associated with file downloads.

Telemetry Validation

Documentation or Evidence:

Type of Contribution

  • Adding telemetry information for an existing EDR product
  • Adding a new EDR product that meets eligibility criteria
  • Proposing new event categories/sub-categories
  • Documentation improvement
  • Tool enhancement

Validation Details

EDR Product Information

  • EDR Product Name: Elastic Defend
  • EDR Version: Tested by Elastic Defend 9.4.0
image
  • Operating System(s) Tested: Windows (25H2) OS Build: 26200.8655
image

Testing Methodology

USB Device Mount/Unmount event

Test method: Mounted and unmounted a USB flash drive to generate events

Enabled Device Control events for testing using the following policy settings:

image (41)
  • Screenshot of mount / unmount events
image
  • Event details (mount event)
    "message": "Endpoint volume device event",
    "volume": {
      "device_name": "\\Device\\HarddiskVolume9",
      "bus_type": "Usb",
      "size": 15489753088,
      "removable": true,
      "mount_name": "E:",
      "file_system_type": "FAT",
      "writable": true
    },

    "message": [
      "Endpoint volume device event"
    ],
    "event.action": [
      "mount",
      "mount_audit"
    ],
Click to expand (View full event) 
{
  "_index": ".ds-logs-endpoint.events.device-default-2026.06.22-000001",
  "_id": "AZ7txW7Qi6d5qfKankxV",
  "_version": 1,
  "_source": {
    "agent": {
      "id": "c2f00df3-cf72-4fdf-9db3-388994658025",
      "type": "endpoint",
      "version": "9.4.2"
    },
    "process": {
      "Ext": {
        "code_signature": [
          {
            "thumbprint_sha256": "941519a414d737815c3173220f002819e2d9bc370c766f25d588bce65cab8456",
            "trusted": true,
            "subject_name": "Microsoft Windows Publisher",
            "exists": true,
            "status": "trusted"
          }
        ]
      },
      "code_signature": {
        "thumbprint_sha256": "941519a414d737815c3173220f002819e2d9bc370c766f25d588bce65cab8456",
        "trusted": true,
        "subject_name": "Microsoft Windows Publisher",
        "exists": true,
        "status": "trusted"
      },
      "name": "svchost.exe",
      "pid": 3356,
      "entity_id": "Kl0wZ4+twJeY6JMR4le8eA",
      "executable": "C:\\Windows\\System32\\svchost.exe"
    },
    "message": "Endpoint volume device event",
    "volume": {
      "device_name": "\\Device\\HarddiskVolume9",
      "bus_type": "Usb",
      "size": 15489753088,
      "removable": true,
      "mount_name": "E:",
      "file_system_type": "FAT",
      "writable": true
    },
    "@timestamp": "2026-06-22T05:19:55.8725926Z",
    "ecs": {
      "version": "8.10.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.device"
    },
    "elastic": {
      "agent": {
        "id": "c2f00df3-cf72-4fdf-9db3-388994658025"
      }
    },
    "host": {
      "os": {
        "type": "windows"
      },
      "name": "desktop-rnm57kt",
      "id": "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 10095,
      "ingested": "2026-06-22T05:20:10Z",
      "created": "2026-06-22T05:19:55.8893693Z",
      "kind": "event",
      "module": "endpoint",
      "action": [
        "mount",
        "mount_audit"
      ],
      "id": "OXX+7NZeUpElm2kX+++++Gup",
      "category": [
        "host"
      ],
      "type": [
        "device",
        "allowed"
      ],
      "dataset": "endpoint.events.device",
      "outcome": "success"
    },
    "device": {
      "product": {
        "name": "Patriot Memory",
        "id": "3D00"
      },
      "vendor": {
        "name": "",
        "id": "13FE"
      },
      "serial_number": "07B51F08943FFF05",
      "type": "Disk File System"
    },
    "user": {
      "domain": "DESKTOP-RNM57KT",
      "name": "vagrant",
      "id": "S-1-5-21-2866837675-1890317257-2335050649-1000"
    }
  },
  "fields": {
    "device.vendor.id": [
      "13FE"
    ],
    "event.category": [
      "host"
    ],
    "device.type": [
      "Disk File System"
    ],
    "process.name.text": [
      "svchost.exe"
    ],
    "process.pid": [
      3356
    ],
    "process.code_signature.exists": [
      true
    ],
    "elastic.agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "device.serial_number": [
      "07B51F08943FFF05"
    ],
    "process.code_signature.subject_name": [
      "Microsoft Windows Publisher"
    ],
    "volume.file_system_type": [
      "FAT"
    ],
    "host.name": [
      "desktop-rnm57kt"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "process.code_signature.thumbprint_sha256": [
      "941519a414d737815c3173220f002819e2d9bc370c766f25d588bce65cab8456"
    ],
    "event.outcome": [
      "success"
    ],
    "process.code_signature.trusted": [
      true
    ],
    "device.product.name": [
      "Patriot Memory"
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-21-2866837675-1890317257-2335050649-1000"
    ],
    "data_stream.type": [
      "logs"
    ],
    "volume.writable": [
      true
    ],
    "device.vendor.name": [
      ""
    ],
    "process.name": [
      "svchost.exe"
    ],
    "agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "ecs.version": [
      "8.10.0"
    ],
    "event.created": [
      "2026-06-22T05:19:55.889Z"
    ],
    "agent.version": [
      "9.4.2"
    ],
    "device.product.id": [
      "3D00"
    ],
    "user.name": [
      "vagrant"
    ],
    "volume.device_name": [
      "\\Device\\HarddiskVolume9"
    ],
    "process.entity_id": [
      "Kl0wZ4+twJeY6JMR4le8eA"
    ],
    "event.sequence": [
      10095
    ],
    "process.executable.caseless": [
      "c:\\windows\\system32\\svchost.exe"
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.executable.text": [
      "C:\\Windows\\System32\\svchost.exe"
    ],
    "event.module": [
      "endpoint"
    ],
    "volume.removable": [
      true
    ],
    "user.domain": [
      "DESKTOP-RNM57KT"
    ],
    "host.id": [
      "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    ],
    "process.name.caseless": [
      "svchost.exe"
    ],
    "process.executable": [
      "C:\\Windows\\System32\\svchost.exe"
    ],
    "volume.mount_name": [
      "E:"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "volume.bus_type": [
      "Usb"
    ],
    "process.code_signature.status": [
      "trusted"
    ],
    "message": [
      "Endpoint volume device event"
    ],
    "event.action": [
      "mount",
      "mount_audit"
    ],
    "event.ingested": [
      "2026-06-22T05:20:10.000Z"
    ],
    "@timestamp": [
      "2026-06-22T05:19:55.872Z"
    ],
    "data_stream.dataset": [
      "endpoint.events.device"
    ],
    "event.type": [
      "device",
      "allowed"
    ],
    "process.Ext.code_signature": [
      {
        "thumbprint_sha256": [
          "941519a414d737815c3173220f002819e2d9bc370c766f25d588bce65cab8456"
        ],
        "trusted": [
          true
        ],
        "subject_name": [
          "Microsoft Windows Publisher"
        ],
        "exists": [
          true
        ],
        "status": [
          "trusted"
        ]
      }
    ],
    "event.id": [
      "OXX+7NZeUpElm2kX+++++Gup"
    ],
    "volume.size": [
      15489753088
    ],
    "event.dataset": [
      "endpoint.events.device"
    ],
    "user.name.text": [
      "vagrant"
    ]
  }
}
  • Event details (unmount event)
    "volume": {
      "device_name": "SWD\\WPDBUSENUM\\_??_USBSTOR\\Disk&Ven_&Prod_Patriot_Memory&Rev_PMAP\\07B51F08943FFF05&0",
      "bus_type": "USB"
    },

    "volume.bus_type": [
      "USB"
    ],
    "message": [
      "Endpoint volume device event"
    ],
    "data_stream.type": [
      "logs"
    ],
    "process.name": [
      "System"
    ],
    "event.action": [
      "unmount"
    ],
Click to expand (View full event) 
{
  "_index": ".ds-logs-endpoint.events.device-default-2026.06.22-000001",
  "_id": "AZ7txm7Qi6d5qfITnqyD",
  "_version": 1,
  "_source": {
    "volume": {
      "device_name": "SWD\\WPDBUSENUM\\_??_USBSTOR\\Disk&Ven_&Prod_Patriot_Memory&Rev_PMAP\\07B51F08943FFF05&0",
      "bus_type": "USB"
    },
    "agent": {
      "id": "c2f00df3-cf72-4fdf-9db3-388994658025",
      "type": "endpoint",
      "version": "9.4.2"
    },
    "process": {
      "name": "System",
      "pid": 4,
      "entity_id": "j91iw3hOjETjxPK13+x7Kg"
    },
    "@timestamp": "2026-06-22T05:20:33.0Z",
    "ecs": {
      "version": "8.10.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.device"
    },
    "elastic": {
      "agent": {
        "id": "c2f00df3-cf72-4fdf-9db3-388994658025"
      }
    },
    "host": {
      "os": {
        "type": "windows"
      },
      "name": "desktop-rnm57kt",
      "id": "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 10266,
      "ingested": "2026-06-22T05:20:41Z",
      "created": "2026-06-22T05:20:33.3756764Z",
      "kind": "event",
      "module": "endpoint",
      "action": [
        "unmount"
      ],
      "id": "OXX+7NZeUpElm2kX+++++HpF",
      "category": [
        "host"
      ],
      "type": [
        "device"
      ],
      "dataset": "endpoint.events.device",
      "outcome": "success"
    },
    "message": "Endpoint volume device event",
    "user": {
      "domain": "NT AUTHORITY",
      "name": "SYSTEM",
      "id": "S-1-5-18"
    }
  },
  "fields": {
    "event.category": [
      "host"
    ],
    "process.name.text": [
      "System"
    ],
    "user.name": [
      "SYSTEM"
    ],
    "volume.device_name": [
      "SWD\\WPDBUSENUM\\_??_USBSTOR\\Disk&Ven_&Prod_Patriot_Memory&Rev_PMAP\\07B51F08943FFF05&0"
    ],
    "process.pid": [
      4
    ],
    "elastic.agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "process.entity_id": [
      "j91iw3hOjETjxPK13+x7Kg"
    ],
    "event.sequence": [
      10266
    ],
    "agent.type": [
      "endpoint"
    ],
    "event.module": [
      "endpoint"
    ],
    "host.name": [
      "desktop-rnm57kt"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "user.domain": [
      "NT AUTHORITY"
    ],
    "event.kind": [
      "event"
    ],
    "host.id": [
      "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    ],
    "process.name.caseless": [
      "system"
    ],
    "event.outcome": [
      "success"
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-18"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "volume.bus_type": [
      "USB"
    ],
    "message": [
      "Endpoint volume device event"
    ],
    "data_stream.type": [
      "logs"
    ],
    "process.name": [
      "System"
    ],
    "event.action": [
      "unmount"
    ],
    "event.ingested": [
      "2026-06-22T05:20:41.000Z"
    ],
    "@timestamp": [
      "2026-06-22T05:20:33.000Z"
    ],
    "agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "ecs.version": [
      "8.10.0"
    ],
    "data_stream.dataset": [
      "endpoint.events.device"
    ],
    "event.created": [
      "2026-06-22T05:20:33.375Z"
    ],
    "event.type": [
      "device"
    ],
    "agent.version": [
      "9.4.2"
    ],
    "event.id": [
      "OXX+7NZeUpElm2kX+++++HpF"
    ],
    "event.dataset": [
      "endpoint.events.device"
    ],
    "user.name.text": [
      "SYSTEM"
    ]
  }
}

Script-Block Activity event

Test Method: Ran an EDR bypass tool (DSCourier) that executes PowerShell through the WinGet DSC COM API, to test whether Script Block logging captures its execution.

The events themselves can be enabled by checking the "API" option in the settings below.
image

Additionally, setting the windows.advanced.events.api_verbose advanced policy setting to true will allow the events to be forwarded to Elasticsearch (SIEM).

image
  • Screenshot
image
  • Event details
        "api": {
          "summary": "AmsiScanBuffer( PowerShell, NULL, 2083d73a4bbc96c01b18da73ef3dbf29016a0c908195f28cfbf819a1cc2d766e )",
          "metadata": {
            "return_value": 1
          },
          "name": "AmsiScanBuffer",
          "parameters": {
            "app_name": "PowerShell",
            "size": 434,
            "buffer": "$timestamp = Get-Date -Format \"yyyy-MM-dd HH:mm:ss\"\n$info = \"DSCourier executed at $timestamp on $env:COMPUTERNAME as $env:USERNAME\"\n$info | Out-File -FilePath \"$env:TEMP\\dscourier_test.txt\" -Force\nWrite-Output $info\n"
          }
        },
Click to expand (View full event) 
{
  "_index": ".ds-logs-endpoint.events.api-default-2026.06.22-000001",
  "_id": "AZ7uGTrx-vIkJgXIye3B",
  "_version": 1,
  "_source": {
    "agent": {
      "id": "c2f00df3-cf72-4fdf-9db3-388994658025",
      "type": "endpoint",
      "version": "9.4.2"
    },
    "process": {
      "Ext": {
        "code_signature": [
          {
            "thumbprint_sha256": "b41c444f8cbd49d1b27cc2c76e0f3fb042bf9970b6b6f6b57fc8976514b03952",
            "trusted": true,
            "subject_name": "Microsoft Corporation",
            "exists": true,
            "status": "trusted"
          }
        ],
        "api": {
          "summary": "AmsiScanBuffer( PowerShell, NULL, 2083d73a4bbc96c01b18da73ef3dbf29016a0c908195f28cfbf819a1cc2d766e )",
          "metadata": {
            "return_value": 1
          },
          "name": "AmsiScanBuffer",
          "parameters": {
            "app_name": "PowerShell",
            "size": 434,
            "buffer": "$timestamp = Get-Date -Format \"yyyy-MM-dd HH:mm:ss\"\n$info = \"DSCourier executed at $timestamp on $env:COMPUTERNAME as $env:USERNAME\"\n$info | Out-File -FilePath \"$env:TEMP\\dscourier_test.txt\" -Force\nWrite-Output $info\n"
          }
        },
        "token": {
          "integrity_level_name": "high"
        }
      },
      "parent": {
        "executable": "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\WindowsPackageManagerServer.exe"
      },
      "code_signature": {
        "thumbprint_sha256": "b41c444f8cbd49d1b27cc2c76e0f3fb042bf9970b6b6f6b57fc8976514b03952",
        "trusted": true,
        "subject_name": "Microsoft Corporation",
        "exists": true,
        "status": "trusted"
      },
      "name": "ConfigurationRemotingServer.exe",
      "pid": 8260,
      "entity_id": "1pf3+3r2pnf4phusldktYg",
      "executable": "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\DotNet\\ConfigurationRemotingServer.exe"
    },
    "@timestamp": "2026-06-22T06:51:39.1938246Z",
    "ecs": {
      "version": "8.10.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.api"
    },
    "elastic": {
      "agent": {
        "id": "c2f00df3-cf72-4fdf-9db3-388994658025"
      }
    },
    "host": {
      "os": {
        "type": "windows"
      },
      "name": "desktop-rnm57kt",
      "id": "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    },
    "event": {
      "created": "2026-06-22T06:51:39.2401242Z",
      "kind": "event",
      "module": "endpoint",
      "type": [
        "allowed"
      ],
      "agent_id_status": "verified",
      "sequence": 38373,
      "ingested": "2026-06-22T06:52:07Z",
      "provider": "Microsoft-Antimalware-Scan-Interface",
      "action": [],
      "id": "OXX+7NZeUpElm2kX++++/iJY",
      "category": [
        "api"
      ],
      "dataset": "endpoint.events.api",
      "outcome": "unknown"
    },
    "message": "Endpoint API event - AmsiScanBuffer",
    "user": {
      "domain": "DESKTOP-RNM57KT",
      "name": "vagrant",
      "id": "S-1-5-21-2866837675-1890317257-2335050649-1000"
    }
  },
  "fields": {
    "event.category": [
      "api"
    ],
    "process.name.text": [
      "ConfigurationRemotingServer.exe"
    ],
    "process.Ext.api.summary": [
      "AmsiScanBuffer( PowerShell, NULL, 2083d73a4bbc96c01b18da73ef3dbf29016a0c908195f28cfbf819a1cc2d766e )"
    ],
    "process.pid": [
      8260
    ],
    "process.code_signature.exists": [
      true
    ],
    "elastic.agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "process.code_signature.subject_name": [
      "Microsoft Corporation"
    ],
    "process.Ext.api.metadata.return_value": [
      1
    ],
    "host.name": [
      "desktop-rnm57kt"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "process.code_signature.thumbprint_sha256": [
      "b41c444f8cbd49d1b27cc2c76e0f3fb042bf9970b6b6f6b57fc8976514b03952"
    ],
    "event.kind": [
      "event"
    ],
    "event.outcome": [
      "unknown"
    ],
    "process.code_signature.trusted": [
      true
    ],
    "process.Ext.api.parameters.size": [
      434
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-21-2866837675-1890317257-2335050649-1000"
    ],
    "data_stream.type": [
      "logs"
    ],
    "process.name": [
      "ConfigurationRemotingServer.exe"
    ],
    "event.provider": [
      "Microsoft-Antimalware-Scan-Interface"
    ],
    "agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "ecs.version": [
      "8.10.0"
    ],
    "event.created": [
      "2026-06-22T06:51:39.240Z"
    ],
    "process.Ext.api.parameters.buffer": [
      "$timestamp = Get-Date -Format \"yyyy-MM-dd HH:mm:ss\"\n$info = \"DSCourier executed at $timestamp on $env:COMPUTERNAME as $env:USERNAME\"\n$info | Out-File -FilePath \"$env:TEMP\\dscourier_test.txt\" -Force\nWrite-Output $info\n"
    ],
    "agent.version": [
      "9.4.2"
    ],
    "user.name": [
      "vagrant"
    ],
    "process.Ext.api.name": [
      "AmsiScanBuffer"
    ],
    "process.Ext.api.parameters.app_name": [
      "PowerShell"
    ],
    "process.entity_id": [
      "1pf3+3r2pnf4phusldktYg"
    ],
    "process.executable.caseless": [
      "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.28.240.0_x64__8wekyb3d8bbwe\\dotnet\\configurationremotingserver.exe"
    ],
    "event.sequence": [
      38373
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.executable.text": [
      "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\DotNet\\ConfigurationRemotingServer.exe"
    ],
    "event.module": [
      "endpoint"
    ],
    "user.domain": [
      "DESKTOP-RNM57KT"
    ],
    "host.id": [
      "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    ],
    "process.name.caseless": [
      "configurationremotingserver.exe"
    ],
    "process.executable": [
      "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\DotNet\\ConfigurationRemotingServer.exe"
    ],
    "process.Ext.token.integrity_level_name": [
      "high"
    ],
    "process.parent.executable": [
      "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\WindowsPackageManagerServer.exe"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "process.code_signature.status": [
      "trusted"
    ],
    "message": [
      "Endpoint API event - AmsiScanBuffer"
    ],
    "event.ingested": [
      "2026-06-22T06:52:07.000Z"
    ],
    "@timestamp": [
      "2026-06-22T06:51:39.193Z"
    ],
    "data_stream.dataset": [
      "endpoint.events.api"
    ],
    "event.type": [
      "allowed"
    ],
    "process.Ext.code_signature": [
      {
        "subject_name": [
          "Microsoft Corporation"
        ],
        "exists": [
          true
        ],
        "thumbprint_sha256": [
          "b41c444f8cbd49d1b27cc2c76e0f3fb042bf9970b6b6f6b57fc8976514b03952"
        ],
        "trusted": [
          true
        ],
        "status": [
          "trusted"
        ]
      }
    ],
    "event.id": [
      "OXX+7NZeUpElm2kX++++/iJY"
    ],
    "event.dataset": [
      "endpoint.events.api"
    ],
    "user.name.text": [
      "vagrant"
    ]
  }
}

File Downloaded event

Test Method: Manually download https://ja.wikipedia.org/wiki/%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB:Elasticsearch_logo.svg from Google Chrome

The events themselves can be enabled by checking the "File" option in the settings below.
image

  • Screenshot
image
  • Event details (We capture the creation of Mark of the Web associated with file downloads.)
    "file": {
      "Ext": {
        "header_data": [],
        "header_bytes": "5b5a6f6e655472616e736665725d0d0a",
        "windows": {
          "zone_identifier": 3
        }
      },
      "origin_url": "https://upload.wikimedia.org/wikipedia/commons/thumb/f/f4/Elasticsearch_logo.svg/960px-Elasticsearch_logo.svg.png",
      "path": "C:\\Users\\vagrant\\Downloads\\Elasticsearch_logo.svg.png:Zone.Identifier",
      "extension": "png",
      "size": 187,
      "name": "Elasticsearch_logo.svg.png:Zone.Identifier",
      "origin_referrer_url": "https://ja.wikipedia.org/"
    },
Click to expand (View full event) 
{
  "_index": ".ds-logs-endpoint.events.file-default-2026.06.22-000001",
  "_id": "AZ7uLm7Qi6d5qfIItE-_",
  "_version": 1,
  "_source": {
    "agent": {
      "id": "c2f00df3-cf72-4fdf-9db3-388994658025",
      "type": "endpoint",
      "version": "9.4.2"
    },
    "process": {
      "Ext": {
        "code_signature": [
          {
            "thumbprint_sha256": "2029505d14baf18af60a0d1a7d8b56447db643b32faa849d4c08d2ab1ff3a4fd",
            "trusted": true,
            "subject_name": "Google LLC",
            "exists": true,
            "status": "trusted"
          }
        ]
      },
      "parent": {
        "pid": 1320
      },
      "code_signature": {
        "thumbprint_sha256": "2029505d14baf18af60a0d1a7d8b56447db643b32faa849d4c08d2ab1ff3a4fd",
        "trusted": true,
        "subject_name": "Google LLC",
        "exists": true,
        "status": "trusted"
      },
      "name": "chrome.exe",
      "pid": 11160,
      "thread": {
        "id": 14232
      },
      "entity_id": "9IZPy5NH7dCpmonXzUksEQ",
      "executable": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    },
    "@timestamp": "2026-06-22T07:13:36.5490362Z",
    "file": {
      "Ext": {
        "header_data": [],
        "header_bytes": "5b5a6f6e655472616e736665725d0d0a",
        "windows": {
          "zone_identifier": 3
        }
      },
      "origin_url": "https://upload.wikimedia.org/wikipedia/commons/thumb/f/f4/Elasticsearch_logo.svg/960px-Elasticsearch_logo.svg.png",
      "path": "C:\\Users\\vagrant\\Downloads\\Elasticsearch_logo.svg.png:Zone.Identifier",
      "extension": "png",
      "size": 187,
      "name": "Elasticsearch_logo.svg.png:Zone.Identifier",
      "origin_referrer_url": "https://ja.wikipedia.org/"
    },
    "ecs": {
      "version": "8.10.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.file"
    },
    "elastic": {
      "agent": {
        "id": "c2f00df3-cf72-4fdf-9db3-388994658025"
      }
    },
    "host": {
      "os": {
        "type": "windows"
      },
      "name": "desktop-rnm57kt",
      "id": "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 48657,
      "ingested": "2026-06-22T07:14:14Z",
      "created": "2026-06-22T07:13:36.5470826Z",
      "kind": "event",
      "module": "endpoint",
      "action": [
        "creation"
      ],
      "id": "OXX+7NZeUpElm2kX++++03qE",
      "category": [
        "file"
      ],
      "type": [
        "creation"
      ],
      "dataset": "endpoint.events.file",
      "outcome": "unknown"
    },
    "message": "Endpoint file event",
    "user": {
      "domain": "DESKTOP-RNM57KT",
      "name": "vagrant",
      "id": "S-1-5-21-2866837675-1890317257-2335050649-1000"
    }
  },
  "fields": {
    "file.path": [
      "C:\\Users\\vagrant\\Downloads\\Elasticsearch_logo.svg.png:Zone.Identifier"
    ],
    "event.category": [
      "file"
    ],
    "process.name.text": [
      "chrome.exe"
    ],
    "file.origin_url": [
      "https://upload.wikimedia.org/wikipedia/commons/thumb/f/f4/Elasticsearch_logo.svg/960px-Elasticsearch_logo.svg.png"
    ],
    "process.parent.pid": [
      1320
    ],
    "process.pid": [
      11160
    ],
    "process.code_signature.exists": [
      true
    ],
    "elastic.agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "process.code_signature.subject_name": [
      "Google LLC"
    ],
    "host.name": [
      "desktop-rnm57kt"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "process.code_signature.thumbprint_sha256": [
      "2029505d14baf18af60a0d1a7d8b56447db643b32faa849d4c08d2ab1ff3a4fd"
    ],
    "event.outcome": [
      "unknown"
    ],
    "process.code_signature.trusted": [
      true
    ],
    "file.path.text": [
      "C:\\Users\\vagrant\\Downloads\\Elasticsearch_logo.svg.png:Zone.Identifier"
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-21-2866837675-1890317257-2335050649-1000"
    ],
    "data_stream.type": [
      "logs"
    ],
    "file.Ext.header_bytes": [
      "5b5a6f6e655472616e736665725d0d0a"
    ],
    "process.name": [
      "chrome.exe"
    ],
    "agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "ecs.version": [
      "8.10.0"
    ],
    "event.created": [
      "2026-06-22T07:13:36.547Z"
    ],
    "agent.version": [
      "9.4.2"
    ],
    "file.extension": [
      "png"
    ],
    "process.thread.id": [
      14232
    ],
    "file.Ext.windows.zone_identifier": [
      "3"
    ],
    "file.origin_referrer_url": [
      "https://ja.wikipedia.org/"
    ],
    "user.name": [
      "vagrant"
    ],
    "process.entity_id": [
      "9IZPy5NH7dCpmonXzUksEQ"
    ],
    "event.sequence": [
      48657
    ],
    "process.executable.caseless": [
      "c:\\program files\\google\\chrome\\application\\chrome.exe"
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.executable.text": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    ],
    "event.module": [
      "endpoint"
    ],
    "user.domain": [
      "DESKTOP-RNM57KT"
    ],
    "host.id": [
      "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    ],
    "process.name.caseless": [
      "chrome.exe"
    ],
    "process.executable": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "file.name": [
      "Elasticsearch_logo.svg.png:Zone.Identifier"
    ],
    "file.size": [
      187
    ],
    "process.code_signature.status": [
      "trusted"
    ],
    "message": [
      "Endpoint file event"
    ],
    "event.action": [
      "creation"
    ],
    "event.ingested": [
      "2026-06-22T07:14:14.000Z"
    ],
    "@timestamp": [
      "2026-06-22T07:13:36.549Z"
    ],
    "file.path.caseless": [
      "c:\\users\\vagrant\\downloads\\elasticsearch_logo.svg.png:zone.identifier"
    ],
    "data_stream.dataset": [
      "endpoint.events.file"
    ],
    "event.type": [
      "creation"
    ],
    "process.Ext.code_signature": [
      {
        "thumbprint_sha256": [
          "2029505d14baf18af60a0d1a7d8b56447db643b32faa849d4c08d2ab1ff3a4fd"
        ],
        "trusted": [
          true
        ],
        "subject_name": [
          "Google LLC"
        ],
        "exists": [
          true
        ],
        "status": [
          "trusted"
        ]
      }
    ],
    "event.id": [
      "OXX+7NZeUpElm2kX++++03qE"
    ],
    "event.dataset": [
      "endpoint.events.file"
    ],
    "user.name.text": [
      "vagrant"
    ]
  }
}

Additional Notes

@AsuNa-jp AsuNa-jp marked this pull request as ready for review June 24, 2026 08:43
@AsuNa-jp

AsuNa-jp commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Hi @tsale,
I work as an engineer at Elastic, and I'd like to update the current telemetry coverage status of Elastic Defend on Windows. When you have some time, would it be possible for you to review and merge this PR? 🙇‍♀️ Please feel free to reach out if you need any further information or if anything is missing.

(I also had a look at the Vendor Improvement Leaderboard below. Thanks for the cool visualization!)

@tsale

tsale commented Jul 6, 2026

Copy link
Copy Markdown
Owner

Hi @AsuNa-jp, and thank you for the nice words and for your contribution! Also, thanks for the detailed evidence and raw event examples here.

I made a small methodology adjustment to the USB device entries:

  • USB Device Mount: Yes → Via EnablingTelemetry
  • USB Device Unmount: Yes → Via EnablingTelemetry

Reason: the evidence looks good for Elastic collecting direct USB mount/unmount telemetry under the tested configuration, but the PR notes that Device Control was explicitly enabled for the test. Under the project taxonomy, telemetry that requires enabling a built-in product feature or setting should be represented as Via EnablingTelemetry rather than default Yes.

One question on Script-Block Activity: does forwarding the AmsiScanBuffer API event content to Elasticsearch require windows.advanced.events.api_verbose=true or another explicit policy/advanced-setting change in normal Elastic Defend deployments?

If that has to be explicitly enabled, I think this should receive the same treatment as the USB entries and be changed from Yes to Via EnablingTelemetry. If it is collected and exposed by default, then Yes looks supportable based on the event sample.

@tsale tsale self-assigned this Jul 6, 2026
@tsale tsale added waiting for info Further information is requested under review Evaluating proposal labels Jul 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@tsale tsale

Labels

under review Evaluating proposal waiting for info Further information is requested

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@AsuNa-jp @tsale