Nucleon EDR
Overview
Nucleon EDR is an Endpoint Detection & Response platform built on Zero-Trust principles and enhanced by AI-driven detection. This documentation shows how to setup the automated events forwarding from the EDR to Sekoia.io.
- Vendor: Nucleon Security
- Supported environment: On Premise / Cloud
- Detection based on: Telemetry / Alert
- Supported application or feature: System & network events
Warning
Important note - This format is currently in beta. We highly value your feedback to improve its performance.
Configure
Prerequisite
For on-premise environment, network access must be open to forward logs from the EDR Console to Sekoia.io on the expected port.
Steps
Create your intake on Sekoia.io
Go to the intake page and create a new intake from the Nucleon EDR.
Copy the intake key. This key will be configured in the EDR Console.
In Nucleon EDR Console
-
Open the Entities view to access the list of all entities your user can manage.
-
Click on the entity where the forwarding must be configured.
-
In the "Entity details" section, click on
Syslog Exportbutton.
-
In the
Syslog Configurationpanel, click onAdd New Configuration -
Fill in all required fields in the form, and the Intake key previously generated:
- Name:
Sekoia - Host:
intake.sekoia.io - Port:
10514 - Protocol:
TLS - Format:
RFC 5424 - Click on
Add Blockto add structured data to the syslog exporter - Block ID:
sekoia@53288 - Click on
Add Parameterto add a new parameter in the structured block - Key:
intake_key - Value: Insert the generated intake key here
- Name:
-
Select the information you want to export in the Event filtering rules. We suggest enabling all options by default.
-
Click on
Savebutton to finish the setup. New events will then be forwarded directly.
Enjoy your events on the Events page
Raw Events Samples
In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.
{
"type": "execute",
"policy": "11111111-1111-1111-1111-111111111111",
"process_path": "C:\\\\Windows\\\\System32\\\\svchost.exe",
"process_md5": "7b88d0896fbf43469a9959d59824a514",
"process_sha1": "2938ff787f23b6a706526bf852bb9bc147225a77",
"process_sha256": "53a39b900e3bfbf384acd13f0fc2329fa8d42b61e993d8ed5adf3a1428005d26",
"process_size": 88232,
"process_device": 0,
"process_signed": 2,
"process_signature": "Microsoft Windows",
"pid": 2296,
"ppid": 1160,
"user": "Syst\u00c3\u00a8me",
"timestamp": 1757590024597,
"count": 1,
"action": 1,
"file_path": [
"C:\\\\Windows\\\\System32\\\\taskhostw.exe"
],
"file_md5": "ad050ed052aff11737ae0a25aed89799",
"file_sha1": "02bf51bbd3ec59e5bcc361193f46d64c3739558d",
"file_sha256": "818c6876e1028ab2b94e45b3cc45102cd83204803537d94263a9b7a6b6583d4b",
"file_signed": 2,
"file_signature": "Microsoft Windows",
"file_size": 117160,
"file_device": 0,
"cpid": 17396,
"command": "taskhostw.exe \"C:\\\\Program Files (x86)\\\\Microsoft Visual Studio\\\\Installer\\\\resources\\\\app\\\\ServiceHub\\\\Services\\\\Microsoft.VisualStudio.Setup.Service\\\\BackgroundDownload.exe\"",
"authenticator": "00000000-0000-0000-0000-000000000000",
"hostname": "HOST-ANONYMIZED",
"ip": "127.0.0.1",
"os": "windows",
"entity": "22222222-2222-2222-2222-222222222222"
}
{
"type": "network",
"policy": "11111111-1111-1111-1111-111111111111",
"process_path": "C:\\\\Program Files\\\\app\\\\app.exe",
"process_md5": "4837683aec1c564ae0de9c3030e90484",
"process_sha1": "adfd2afbdd6f30adfe6ba424388e55a748fa284f",
"process_sha256": "c13cf3289e75f6cbd0377a65e6e5be374b80bb4797dea8f78a27f65a365c5b3b",
"process_size": 28115096,
"process_device": 0,
"process_signed": 2,
"process_signature": "Wiretrustee UG (haftungsbeschr\u00c3\u00a4nkt)",
"pid": 5864,
"ppid": 1160,
"user": "Syst\u00c3\u00a8me",
"timestamp": 1757590022147,
"count": 1,
"action": 1,
"source_ip": "1.2.3.4",
"destination_ip": "5.6.7.8",
"source_port": 56275,
"destination_port": 53,
"protocol": "udp",
"authenticator": "00000000-0000-0000-0000-000000000000",
"hostname": "HOST-ANONYMIZED",
"ip": "127.0.0.1",
"os": "windows",
"entity": "22222222-2222-2222-2222-222222222222"
}
{
"type": "read",
"policy": "11111111-1111-1111-1111-111111111111",
"process_path": "C:\\\\Program Files (x86)\\\\Microsoft Visual Studio\\\\Installer\\\\resources\\\\app\\\\ServiceHub\\\\Services\\\\Microsoft.VisualStudio.Setup.Service\\\\BackgroundDownload.exe",
"process_md5": "466174176fa0fd9fd0c5d37d024319bb",
"process_sha1": "cd2cc4fba1123fc710ecedbd86858c09db7363cd",
"process_sha256": "f85ca16bbb7b6f10dc20e4e4eef6e30cba295b7222878873c3b88354e22b7086",
"process_size": 253368,
"process_device": 0,
"process_signed": 2,
"process_signature": "Microsoft Corporation",
"pid": 25824,
"ppid": 2296,
"user": "John",
"timestamp": 1757590008957,
"count": 4,
"action": 1,
"file_path": [
"C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\e2135c3v\\\\Microsoft.VisualCpp.CLI.X86.69D7C296F8DFFB988A13\\\\Microsoft.VisualCpp.CLI.X86.vsix"
],
"file_signed": 0,
"file_size": 0,
"file_device": 0,
"authenticator": "00000000-0000-0000-0000-000000000000",
"hostname": "HOST-ANONYMIZED",
"ip": "127.0.0.1",
"os": "windows",
"entity": "22222222-2222-2222-2222-222222222222"
}
{
"type": "write",
"policy": "11111111-1111-1111-1111-111111111111",
"process_path": "C:\\\\Program Files (x86)\\\\Mobatek\\\\MobaXterm\\\\MobaXterm.exe",
"process_md5": "b0143f3e1074b0ea9dca3c2a76544494",
"process_sha1": "045b89dacf5aea9c4ec66a3545c665676c29ce8b",
"process_sha256": "c08e0823c1d72f944cd7f3c50947290f6ff146bc6037fee3a386c7505a545075",
"process_size": 14715432,
"process_device": 0,
"process_signed": 2,
"process_signature": "Mobatek",
"pid": 15800,
"ppid": 11008,
"user": "John",
"timestamp": 1757590008644,
"count": 1,
"action": 1,
"file_path": [
"C:\\\\Users\\\\user\\\\Documents\\\\MobaXterm\\\\slash\\\\bin"
],
"file_signed": 0,
"file_size": 0,
"file_device": 0,
"threat": "4de10a349d006433d690133f98aa368b",
"authenticator": "00000000-0000-0000-0000-000000000000",
"hostname": "HOST-ANONYMIZED",
"ip": "127.0.0.1",
"os": "windows",
"entity": "22222222-2222-2222-2222-222222222222"
}
{
"type": "open_process",
"policy": "11111111-1111-1111-1111-111111111111",
"process_path": "C:\\\\Program Files\\\\WindowsApps\\\\Microsoft.OutlookForWindows_1.2025.828.402_x64__8wekyb3d8bbwe\\\\olk.exe",
"process_md5": "02a4928c18b31ad0b8d57410eeb95bde",
"process_sha1": "3ed883efc7ea54b14d7b1c3d8e718d9a43ea5f95",
"process_sha256": "f39c8e2506e7462b421c720873951116bc4b715d1ba1bf6e452b836249861b30",
"process_size": 224800,
"process_device": 0,
"process_signed": 2,
"process_signature": "Microsoft Corporation",
"pid": 18512,
"ppid": 11008,
"user": "John",
"timestamp": 1757590029265,
"count": 2,
"action": 3,
"file_path": [
"C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\139.0.3405.125\\\\msedgewebview2.exe"
],
"file_md5": "c23a1e04ccdd80bfd973091a1994d64b",
"file_sha1": "46ca64a8e158b4978704b66b1d56b7e2e7217da8",
"file_sha256": "0e2445b92f389493f072cff22f4537ba6c844dd715b5a88d0b9624354387e0a1",
"file_signed": 2,
"file_signature": "Microsoft Corporation",
"file_size": 3544616,
"file_device": 0,
"cpid": 15620,
"authenticator": "00000000-0000-0000-0000-000000000000",
"hostname": "HOST-ANONYMIZED",
"ip": "127.0.0.1",
"os": "windows",
"entity": "22222222-2222-2222-2222-222222222222"
}
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
No related built-in rules was found. This message is automatically generated.
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Binary file metadata |
hashes are computed on the fly and stored in the event |
Process monitoring |
execution, process of any program executed |
Process command-line parameters |
command-line parameters of any executed program |
Process use of network |
network connections of any executed program |
File monitoring |
file operations of any executed program |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | event |
| Category | file, network, process |
| Type | access, change, connection, deletion, info, start |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": "{\"type\": \"execute\", \"policy\": \"11111111-1111-1111-1111-111111111111\", \"process_path\": \"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\", \"process_md5\": \"7b88d0896fbf43469a9959d59824a514\", \"process_sha1\": \"2938ff787f23b6a706526bf852bb9bc147225a77\", \"process_sha256\": \"53a39b900e3bfbf384acd13f0fc2329fa8d42b61e993d8ed5adf3a1428005d26\", \"process_size\": 88232, \"process_device\": 0, \"process_signed\": 2, \"process_signature\": \"Microsoft Windows\", \"pid\": 2296, \"ppid\": 1160, \"user\": \"Syst\u00c3\u00a8me\", \"timestamp\": 1757590024597, \"count\": 1, \"action\": 1, \"file_path\": [\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\taskhostw.exe\"], \"file_md5\": \"ad050ed052aff11737ae0a25aed89799\", \"file_sha1\": \"02bf51bbd3ec59e5bcc361193f46d64c3739558d\", \"file_sha256\": \"818c6876e1028ab2b94e45b3cc45102cd83204803537d94263a9b7a6b6583d4b\", \"file_signed\": 2, \"file_signature\": \"Microsoft Windows\", \"file_size\": 117160, \"file_device\": 0, \"cpid\": 17396, \"command\": \"taskhostw.exe \\\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft Visual Studio\\\\\\\\Installer\\\\\\\\resources\\\\\\\\app\\\\\\\\ServiceHub\\\\\\\\Services\\\\\\\\Microsoft.VisualStudio.Setup.Service\\\\\\\\BackgroundDownload.exe\\\"\", \"authenticator\": \"00000000-0000-0000-0000-000000000000\", \"hostname\": \"HOST-ANONYMIZED\", \"ip\": \"127.0.0.1\", \"os\": \"windows\", \"entity\": \"22222222-2222-2222-2222-222222222222\"}",
"event": {
"category": [
"process"
],
"code": "11111111-1111-1111-1111-111111111111",
"dataset": "nucleon_edr",
"kind": "event",
"type": [
"info"
]
},
"@timestamp": "2025-09-11T11:27:04.597000Z",
"agent": {
"id": "00000000-0000-0000-0000-000000000000",
"name": "nucleon-edr"
},
"file": {
"code_signature": {
"subject_name": "Microsoft Windows",
"valid": true
},
"directory": "C:\\\\Windows\\\\System32\\",
"hash": {
"md5": "ad050ed052aff11737ae0a25aed89799",
"sha1": "02bf51bbd3ec59e5bcc361193f46d64c3739558d",
"sha256": "818c6876e1028ab2b94e45b3cc45102cd83204803537d94263a9b7a6b6583d4b"
},
"name": "taskhostw.exe",
"path": "C:\\\\Windows\\\\System32\\\\taskhostw.exe",
"size": 117160
},
"host": {
"hostname": "HOST-ANONYMIZED",
"name": "HOST-ANONYMIZED",
"os": {
"full": "windows"
}
},
"process": {
"code_signature": {
"subject_name": "Microsoft Windows",
"valid": true
},
"command_line": "taskhostw.exe \"C:\\\\Program Files (x86)\\\\Microsoft Visual Studio\\\\Installer\\\\resources\\\\app\\\\ServiceHub\\\\Services\\\\Microsoft.VisualStudio.Setup.Service\\\\BackgroundDownload.exe\"",
"executable": "C:\\\\Windows\\\\System32\\\\svchost.exe",
"hash": {
"md5": "7b88d0896fbf43469a9959d59824a514",
"sha1": "2938ff787f23b6a706526bf852bb9bc147225a77",
"sha256": "53a39b900e3bfbf384acd13f0fc2329fa8d42b61e993d8ed5adf3a1428005d26"
},
"parent": {
"pid": 1160
},
"pid": 2296
},
"related": {
"hash": [
"02bf51bbd3ec59e5bcc361193f46d64c3739558d",
"2938ff787f23b6a706526bf852bb9bc147225a77",
"53a39b900e3bfbf384acd13f0fc2329fa8d42b61e993d8ed5adf3a1428005d26",
"7b88d0896fbf43469a9959d59824a514",
"818c6876e1028ab2b94e45b3cc45102cd83204803537d94263a9b7a6b6583d4b",
"ad050ed052aff11737ae0a25aed89799"
],
"hosts": [
"HOST-ANONYMIZED"
],
"user": [
"Syst\u00c3\u00a8me"
]
},
"user": {
"name": "Syst\u00c3\u00a8me"
}
}
{
"message": "{\"type\": \"network\", \"policy\": \"11111111-1111-1111-1111-111111111111\", \"process_path\": \"C:\\\\\\\\Program Files\\\\\\\\app\\\\\\\\app.exe\", \"process_md5\": \"4837683aec1c564ae0de9c3030e90484\", \"process_sha1\": \"adfd2afbdd6f30adfe6ba424388e55a748fa284f\", \"process_sha256\": \"c13cf3289e75f6cbd0377a65e6e5be374b80bb4797dea8f78a27f65a365c5b3b\", \"process_size\": 28115096, \"process_device\": 0, \"process_signed\": 2, \"process_signature\": \"Wiretrustee UG (haftungsbeschr\u00c3\u00a4nkt)\", \"pid\": 5864, \"ppid\": 1160, \"user\": \"Syst\u00c3\u00a8me\", \"timestamp\": 1757590022147, \"count\": 1, \"action\": 1, \"source_ip\": \"1.2.3.4\", \"destination_ip\": \"5.6.7.8\", \"source_port\": 56275, \"destination_port\": 53, \"protocol\": \"udp\", \"authenticator\": \"00000000-0000-0000-0000-000000000000\", \"hostname\": \"HOST-ANONYMIZED\", \"ip\": \"127.0.0.1\", \"os\": \"windows\", \"entity\": \"22222222-2222-2222-2222-222222222222\"}",
"event": {
"category": [
"process"
],
"code": "11111111-1111-1111-1111-111111111111",
"dataset": "nucleon_edr",
"kind": "event",
"type": [
"info"
]
},
"@timestamp": "2025-09-11T11:27:02.147000Z",
"agent": {
"id": "00000000-0000-0000-0000-000000000000",
"name": "nucleon-edr"
},
"destination": {
"address": "5.6.7.8",
"ip": "5.6.7.8",
"port": 53
},
"file": {
"code_signature": {
"valid": false
}
},
"host": {
"hostname": "HOST-ANONYMIZED",
"name": "HOST-ANONYMIZED",
"os": {
"full": "windows"
}
},
"network": {
"transport": "udp"
},
"process": {
"code_signature": {
"subject_name": "Wiretrustee UG (haftungsbeschr\u00c3\u00a4nkt)",
"valid": true
},
"executable": "C:\\\\Program Files\\\\app\\\\app.exe",
"hash": {
"md5": "4837683aec1c564ae0de9c3030e90484",
"sha1": "adfd2afbdd6f30adfe6ba424388e55a748fa284f",
"sha256": "c13cf3289e75f6cbd0377a65e6e5be374b80bb4797dea8f78a27f65a365c5b3b"
},
"parent": {
"pid": 1160
},
"pid": 5864
},
"related": {
"hash": [
"4837683aec1c564ae0de9c3030e90484",
"adfd2afbdd6f30adfe6ba424388e55a748fa284f",
"c13cf3289e75f6cbd0377a65e6e5be374b80bb4797dea8f78a27f65a365c5b3b"
],
"hosts": [
"HOST-ANONYMIZED"
],
"ip": [
"1.2.3.4",
"5.6.7.8"
],
"user": [
"Syst\u00c3\u00a8me"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4",
"port": 56275
},
"user": {
"name": "Syst\u00c3\u00a8me"
}
}
{
"message": "{\"type\": \"read\", \"policy\": \"11111111-1111-1111-1111-111111111111\", \"process_path\": \"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft Visual Studio\\\\\\\\Installer\\\\\\\\resources\\\\\\\\app\\\\\\\\ServiceHub\\\\\\\\Services\\\\\\\\Microsoft.VisualStudio.Setup.Service\\\\\\\\BackgroundDownload.exe\", \"process_md5\": \"466174176fa0fd9fd0c5d37d024319bb\", \"process_sha1\": \"cd2cc4fba1123fc710ecedbd86858c09db7363cd\", \"process_sha256\": \"f85ca16bbb7b6f10dc20e4e4eef6e30cba295b7222878873c3b88354e22b7086\", \"process_size\": 253368, \"process_device\": 0, \"process_signed\": 2, \"process_signature\": \"Microsoft Corporation\", \"pid\": 25824, \"ppid\": 2296, \"user\": \"John\", \"timestamp\": 1757590008957, \"count\": 4, \"action\": 1, \"file_path\": [\"C:\\\\\\\\Users\\\\\\\\user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\e2135c3v\\\\\\\\Microsoft.VisualCpp.CLI.X86.69D7C296F8DFFB988A13\\\\\\\\Microsoft.VisualCpp.CLI.X86.vsix\"], \"file_signed\": 0, \"file_size\": 0, \"file_device\": 0, \"authenticator\": \"00000000-0000-0000-0000-000000000000\", \"hostname\": \"HOST-ANONYMIZED\", \"ip\": \"127.0.0.1\", \"os\": \"windows\", \"entity\": \"22222222-2222-2222-2222-222222222222\"}",
"event": {
"category": [
"process"
],
"code": "11111111-1111-1111-1111-111111111111",
"dataset": "nucleon_edr",
"kind": "event",
"type": [
"info"
]
},
"@timestamp": "2025-09-11T11:26:48.957000Z",
"agent": {
"id": "00000000-0000-0000-0000-000000000000",
"name": "nucleon-edr"
},
"file": {
"code_signature": {
"valid": false
},
"directory": "C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\e2135c3v\\\\Microsoft.VisualCpp.CLI.X86.69D7C296F8DFFB988A13\\",
"name": "Microsoft.VisualCpp.CLI.X86.vsix",
"path": "C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\e2135c3v\\\\Microsoft.VisualCpp.CLI.X86.69D7C296F8DFFB988A13\\\\Microsoft.VisualCpp.CLI.X86.vsix",
"size": 0
},
"host": {
"hostname": "HOST-ANONYMIZED",
"name": "HOST-ANONYMIZED",
"os": {
"full": "windows"
}
},
"process": {
"code_signature": {
"subject_name": "Microsoft Corporation",
"valid": true
},
"executable": "C:\\\\Program Files (x86)\\\\Microsoft Visual Studio\\\\Installer\\\\resources\\\\app\\\\ServiceHub\\\\Services\\\\Microsoft.VisualStudio.Setup.Service\\\\BackgroundDownload.exe",
"hash": {
"md5": "466174176fa0fd9fd0c5d37d024319bb",
"sha1": "cd2cc4fba1123fc710ecedbd86858c09db7363cd",
"sha256": "f85ca16bbb7b6f10dc20e4e4eef6e30cba295b7222878873c3b88354e22b7086"
},
"parent": {
"pid": 2296
},
"pid": 25824
},
"related": {
"hash": [
"466174176fa0fd9fd0c5d37d024319bb",
"cd2cc4fba1123fc710ecedbd86858c09db7363cd",
"f85ca16bbb7b6f10dc20e4e4eef6e30cba295b7222878873c3b88354e22b7086"
],
"hosts": [
"HOST-ANONYMIZED"
],
"user": [
"John"
]
},
"user": {
"name": "John"
}
}
{
"message": "{\"type\": \"write\", \"policy\": \"11111111-1111-1111-1111-111111111111\", \"process_path\": \"C:\\\\\\\\Program Files (x86)\\\\\\\\Mobatek\\\\\\\\MobaXterm\\\\\\\\MobaXterm.exe\", \"process_md5\": \"b0143f3e1074b0ea9dca3c2a76544494\", \"process_sha1\": \"045b89dacf5aea9c4ec66a3545c665676c29ce8b\", \"process_sha256\": \"c08e0823c1d72f944cd7f3c50947290f6ff146bc6037fee3a386c7505a545075\", \"process_size\": 14715432, \"process_device\": 0, \"process_signed\": 2, \"process_signature\": \"Mobatek\", \"pid\": 15800, \"ppid\": 11008, \"user\": \"John\", \"timestamp\": 1757590008644, \"count\": 1, \"action\": 1, \"file_path\": [\"C:\\\\\\\\Users\\\\\\\\user\\\\\\\\Documents\\\\\\\\MobaXterm\\\\\\\\slash\\\\\\\\bin\"], \"file_signed\": 0, \"file_size\": 0, \"file_device\": 0, \"threat\": \"4de10a349d006433d690133f98aa368b\", \"authenticator\": \"00000000-0000-0000-0000-000000000000\", \"hostname\": \"HOST-ANONYMIZED\", \"ip\": \"127.0.0.1\", \"os\": \"windows\", \"entity\": \"22222222-2222-2222-2222-222222222222\"}",
"event": {
"category": [
"process"
],
"code": "11111111-1111-1111-1111-111111111111",
"dataset": "nucleon_edr",
"kind": "event",
"type": [
"info"
]
},
"@timestamp": "2025-09-11T11:26:48.644000Z",
"agent": {
"id": "00000000-0000-0000-0000-000000000000",
"name": "nucleon-edr"
},
"file": {
"code_signature": {
"valid": false
},
"directory": "C:\\\\Users\\\\user\\\\Documents\\\\MobaXterm\\\\slash\\",
"name": "bin",
"path": "C:\\\\Users\\\\user\\\\Documents\\\\MobaXterm\\\\slash\\\\bin",
"size": 0
},
"host": {
"hostname": "HOST-ANONYMIZED",
"name": "HOST-ANONYMIZED",
"os": {
"full": "windows"
}
},
"process": {
"code_signature": {
"subject_name": "Mobatek",
"valid": true
},
"executable": "C:\\\\Program Files (x86)\\\\Mobatek\\\\MobaXterm\\\\MobaXterm.exe",
"hash": {
"md5": "b0143f3e1074b0ea9dca3c2a76544494",
"sha1": "045b89dacf5aea9c4ec66a3545c665676c29ce8b",
"sha256": "c08e0823c1d72f944cd7f3c50947290f6ff146bc6037fee3a386c7505a545075"
},
"parent": {
"pid": 11008
},
"pid": 15800
},
"related": {
"hash": [
"045b89dacf5aea9c4ec66a3545c665676c29ce8b",
"b0143f3e1074b0ea9dca3c2a76544494",
"c08e0823c1d72f944cd7f3c50947290f6ff146bc6037fee3a386c7505a545075"
],
"hosts": [
"HOST-ANONYMIZED"
],
"user": [
"John"
]
},
"user": {
"name": "John"
}
}
{
"message": "{\"type\": \"open_process\", \"policy\": \"11111111-1111-1111-1111-111111111111\", \"process_path\": \"C:\\\\\\\\Program Files\\\\\\\\WindowsApps\\\\\\\\Microsoft.OutlookForWindows_1.2025.828.402_x64__8wekyb3d8bbwe\\\\\\\\olk.exe\", \"process_md5\": \"02a4928c18b31ad0b8d57410eeb95bde\", \"process_sha1\": \"3ed883efc7ea54b14d7b1c3d8e718d9a43ea5f95\", \"process_sha256\": \"f39c8e2506e7462b421c720873951116bc4b715d1ba1bf6e452b836249861b30\", \"process_size\": 224800, \"process_device\": 0, \"process_signed\": 2, \"process_signature\": \"Microsoft Corporation\", \"pid\": 18512, \"ppid\": 11008, \"user\": \"John\", \"timestamp\": 1757590029265, \"count\": 2, \"action\": 3, \"file_path\": [\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft\\\\\\\\EdgeWebView\\\\\\\\Application\\\\\\\\139.0.3405.125\\\\\\\\msedgewebview2.exe\"], \"file_md5\": \"c23a1e04ccdd80bfd973091a1994d64b\", \"file_sha1\": \"46ca64a8e158b4978704b66b1d56b7e2e7217da8\", \"file_sha256\": \"0e2445b92f389493f072cff22f4537ba6c844dd715b5a88d0b9624354387e0a1\", \"file_signed\": 2, \"file_signature\": \"Microsoft Corporation\", \"file_size\": 3544616, \"file_device\": 0, \"cpid\": 15620, \"authenticator\": \"00000000-0000-0000-0000-000000000000\", \"hostname\": \"HOST-ANONYMIZED\", \"ip\": \"127.0.0.1\", \"os\": \"windows\", \"entity\": \"22222222-2222-2222-2222-222222222222\"}",
"event": {
"category": [
"process"
],
"code": "11111111-1111-1111-1111-111111111111",
"dataset": "nucleon_edr",
"kind": "event",
"type": [
"info"
]
},
"@timestamp": "2025-09-11T11:27:09.265000Z",
"agent": {
"id": "00000000-0000-0000-0000-000000000000",
"name": "nucleon-edr"
},
"file": {
"code_signature": {
"subject_name": "Microsoft Corporation",
"valid": true
},
"directory": "C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\139.0.3405.125\\",
"hash": {
"md5": "c23a1e04ccdd80bfd973091a1994d64b",
"sha1": "46ca64a8e158b4978704b66b1d56b7e2e7217da8",
"sha256": "0e2445b92f389493f072cff22f4537ba6c844dd715b5a88d0b9624354387e0a1"
},
"name": "msedgewebview2.exe",
"path": "C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\139.0.3405.125\\\\msedgewebview2.exe",
"size": 3544616
},
"host": {
"hostname": "HOST-ANONYMIZED",
"name": "HOST-ANONYMIZED",
"os": {
"full": "windows"
}
},
"process": {
"code_signature": {
"subject_name": "Microsoft Corporation",
"valid": true
},
"executable": "C:\\\\Program Files\\\\WindowsApps\\\\Microsoft.OutlookForWindows_1.2025.828.402_x64__8wekyb3d8bbwe\\\\olk.exe",
"hash": {
"md5": "02a4928c18b31ad0b8d57410eeb95bde",
"sha1": "3ed883efc7ea54b14d7b1c3d8e718d9a43ea5f95",
"sha256": "f39c8e2506e7462b421c720873951116bc4b715d1ba1bf6e452b836249861b30"
},
"parent": {
"pid": 11008
},
"pid": 18512
},
"related": {
"hash": [
"02a4928c18b31ad0b8d57410eeb95bde",
"0e2445b92f389493f072cff22f4537ba6c844dd715b5a88d0b9624354387e0a1",
"3ed883efc7ea54b14d7b1c3d8e718d9a43ea5f95",
"46ca64a8e158b4978704b66b1d56b7e2e7217da8",
"c23a1e04ccdd80bfd973091a1994d64b",
"f39c8e2506e7462b421c720873951116bc4b715d1ba1bf6e452b836249861b30"
],
"hosts": [
"HOST-ANONYMIZED"
],
"user": [
"John"
]
},
"user": {
"name": "John"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
agent.id |
keyword |
Unique identifier of this agent. |
agent.name |
keyword |
Custom name of the agent. |
destination.ip |
ip |
IP address of the destination. |
destination.port |
long |
Port of the destination. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.code |
keyword |
Identification code for this event. |
event.dataset |
keyword |
Name of the dataset. |
event.kind |
keyword |
The kind of the event. The highest categorization field in the hierarchy. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
file.code_signature.subject_name |
keyword |
Subject name of the code signer |
file.code_signature.valid |
boolean |
Boolean to capture if the digital signature is verified against the binary content. |
file.hash.md5 |
keyword |
MD5 hash. |
file.hash.sha1 |
keyword |
SHA1 hash. |
file.hash.sha256 |
keyword |
SHA256 hash. |
file.path |
keyword |
Full path to the file, including the file name. |
file.size |
long |
File size in bytes. |
host.hostname |
keyword |
Hostname of the host. |
host.name |
keyword |
Name of the host. |
host.os.full |
keyword |
Operating system name, including the version or code name. |
network.transport |
keyword |
Protocol Name corresponding to the field iana_number. |
process.code_signature.subject_name |
keyword |
Subject name of the code signer |
process.code_signature.valid |
boolean |
Boolean to capture if the digital signature is verified against the binary content. |
process.command_line |
wildcard |
Full command line that started the process. |
process.executable |
keyword |
Absolute path to the process executable. |
process.hash.md5 |
keyword |
MD5 hash. |
process.hash.sha1 |
keyword |
SHA1 hash. |
process.hash.sha256 |
keyword |
SHA256 hash. |
process.parent.pid |
long |
Process id. |
process.pid |
long |
Process id. |
source.ip |
ip |
IP address of the source. |
source.port |
long |
Port of the source. |
user.name |
keyword |
Short name or login of the user. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.