Sysmon Playbook Alerts look weired

[ben-sec]

Hello!

My Sysmon Playbook Alerts look weired in Hunt (SO 2.3.170):

Any ideas what's going on there?

Cheers, Ben

[defensivedepth]

@ben-sec Do you have any custom Plays or Elastalert rules? Which Play is this generated from?

[ben-sec]

Oh sorry, yes I have some custome Elastalerts and one custom Play.

[defensivedepth]

Can you sanitize & drop the details / json / etc for one of those alerts over on a gist & post it here?

[ben-sec]

There you go: https://gist.github.com/ben-sec/21ad2c39058a5c6d410b50363a1cce75

[ben-sec]

BTW: I received a different Playbook alert today and it looked just fine in Hunt. Maybe it's just the rule?

[defensivedepth]

@ben-sec Ya, looking at that rule & how it is being converted --> doesn't look right. I would suggest disabling it for now. I have it on my list to look into it and adjust the field mappings for those fields.

[ben-sec]

OK, rule has been deactivated.