session_summarization_queries

session_summarization_queries.txt

# Select important fields to extract from session logs
# Get top 10 unique values for each of the fields, and a representative document for each unique value 
# Sample query on Infosec cluster:
GET logs-*/_search
{
  "query":{
    "bool": {
      "must": [
        {"match": {"host.os.type": "linux"}},
        {"match": {"process.session_leader.entity_id": "ODBjMTU4YmEtZDkzYy00YTU2LTg5MGItZjZhZGViM2JlNmQ5LTUyOTEwLTE2ODYxNjE2ODU="}},
        {"range": {
          "@timestamp": {
            "gte": "now-1M/h",
            "lte": "now"
          }
        }}
      ]
    }
  },
  "size": 0,
  "aggs": {
    "unique_process_names": {
      "terms": {
        "field": "process.name",
        "size": 10
      },
      "aggs":{
        "representative_docs": {
          "top_hits": {
            "size": 1
          }
        }
      }
    },
    "unique_file_paths": {
      "terms": {
        "field": "file.path",
        "size": 10
      },
      "aggs":{
        "representative_docs": {
          "top_hits": {
            "size": 1
          }
        }
      }
    },
    "unique_event_actions": {
      "terms": {
        "field": "event.action",
        "size": 10
      },
      "aggs":{
        "representative_docs": {
          "top_hits": {
            "size": 1
          }
        }
      }
    },
    "unique_event_categories": {
      "terms": {
        "field": "event.category",
        "size": 10
      },
      "aggs":{
        "representative_docs": {
          "top_hits": {
            "size": 1
          }
        }
      }
    },
    "session_duration": {
      "scripted_metric": {
        "init_script": "state.minTimestamp = Long.MAX_VALUE; state.maxTimestamp = Long.MIN_VALUE;",
        "map_script": "def docTimestamp = doc['@timestamp'].value.millis; if (docTimestamp < state.minTimestamp) { state.minTimestamp = docTimestamp } if (docTimestamp > state.maxTimestamp) { state.maxTimestamp = docTimestamp }",
        "combine_script": "return state",
        "reduce_script": "def minTimestamp = Long.MAX_VALUE; def maxTimestamp = Long.MIN_VALUE; for (s in states) { if (s.minTimestamp < minTimestamp) { minTimestamp = s.minTimestamp } if (s.maxTimestamp > maxTimestamp) { maxTimestamp = s.maxTimestamp } } return maxTimestamp - minTimestamp"
      }
    }
  }
}

# Can also nest fields within each other to get representative documents for all combinations of the top 10 values of each field.
# Sample query on Infosec cluster:
GET logs-*/_search
{
  "query":{
    "bool": {
      "must": [
        {"match": {"host.os.type": "linux"}},
        {"match": {"process.session_leader.entity_id": "ODBjMTU4YmEtZDkzYy00YTU2LTg5MGItZjZhZGViM2JlNmQ5LTUyOTEwLTE2ODYxNjE2ODU="}},
        {"range": {
          "@timestamp": {
            "gte": "now-1M/h",
            "lte": "now"
          }
        }}
      ]
    }
  },
  "size": 0,
  "aggs": {
    "top_process_names": {
      "terms": {
        "field": "process.name",
        "size": 10
      },
      "aggs": {
        "top_event_categories": {
          "terms": {
            "field": "event.category",
            "size": 10
          },
          "aggs": {
            "top_event_actions": {
              "terms": {
                "field": "event.action",
                "size": 10
              },
              "aggs": {
                "representative_docs": {
                  "top_hits": {
                    "size": 1
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}