Add origin_url and origin_referrer_url field to Process/DLL events (#610)

* add origin_url and origin_referrer_url fields

* add generated files

Author: AsuNa-jp

custom_documentation/doc/endpoint/library/windows/windows_library_load.md

@@ -34,6 +34,8 @@ This event is generated when a DLL or driver is loaded.
 | dll.hash.sha1 |
 | dll.hash.sha256 |
 | dll.name |
+| dll.origin_referrer_url |
+| dll.origin_url |
 | dll.path |
 | dll.pe.file_version |
 | dll.pe.imphash |

custom_documentation/doc/endpoint/process/windows/windows_process_already_running.md

@@ -77,6 +77,8 @@ This event is generated for a process that was already running before Endpoint's
 | process.hash.sha1 |
 | process.hash.sha256 |
 | process.name |
+| process.origin_referrer_url |
+| process.origin_url |
 | process.parent.Ext.code_signature.exists |
 | process.parent.Ext.code_signature.status |
 | process.parent.Ext.code_signature.subject_name |

custom_documentation/doc/endpoint/process/windows/windows_process_create_and_exit.md

@@ -94,6 +94,8 @@ This event is generated when a process is created or exits.
 | process.hash.sha1 |
 | process.hash.sha256 |
 | process.name |
+| process.origin_referrer_url |
+| process.origin_url |
 | process.parent.Ext.code_signature.exists |
 | process.parent.Ext.code_signature.status |
 | process.parent.Ext.code_signature.subject_name |

custom_documentation/src/endpoint/data_stream/library/windows/windows_library_load.yaml

@@ -39,6 +39,8 @@ fields:
   - dll.hash.sha1
   - dll.hash.sha256
   - dll.name
+  - dll.origin_referrer_url
+  - dll.origin_url
   - dll.path
   - dll.pe.file_version
   - dll.pe.imphash

custom_documentation/src/endpoint/data_stream/process/windows/windows_process_already_running.yaml

@@ -83,6 +83,8 @@ fields:
   - process.hash.sha1
   - process.hash.sha256
   - process.name
+  - process.origin_referrer_url
+  - process.origin_url
   - process.parent.Ext.code_signature.exists
   - process.parent.Ext.code_signature.status
   - process.parent.Ext.code_signature.subject_name

custom_documentation/src/endpoint/data_stream/process/windows/windows_process_create_and_exit.yaml

@@ -101,6 +101,8 @@ fields:
   - process.hash.sha1
   - process.hash.sha256
   - process.name
+  - process.origin_referrer_url
+  - process.origin_url 
   - process.parent.Ext.code_signature.exists
   - process.parent.Ext.code_signature.status
   - process.parent.Ext.code_signature.subject_name

custom_schemas/custom_dll.yml

@@ -277,3 +277,19 @@
         This is used to identify the team or vendor of a software product. The field is
         relevant to Apple *OS only.'
       example: EQHXZ8M8AV
+
+    - name: origin_referrer_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: >
+        The URL of the webpage that linked to the dll file.
+      example: http://example.com/article1.html
+
+    - name: origin_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: >
+        The URL where the dll file is hosted.
+      example: http://example.com/files/example.dll

custom_schemas/custom_process.yml

@@ -55,6 +55,22 @@
       description: Parent process' pid.
       example: 4241
 
+    - name: origin_referrer_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: >
+        The URL of the webpage that linked to the process's executable file.
+      example: http://example.com/article1.html
+      
+    - name: origin_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: >
+        The URL where the process's executable file is hosted.
+      example: http://example.com/files/example.exe
+
     - name: parent.thread
       level: custom
       type: object

custom_subsets/elastic_endpoint/library/library.yaml

@@ -204,6 +204,8 @@ fields:
           imphash: {}
           original_file_name: {}
           product: {}
+      origin_referrer_url: {}
+      origin_url: {}
       Ext:
         fields:
           code_signature:

custom_subsets/elastic_endpoint/process/process.yaml

@@ -151,6 +151,8 @@ fields:
       title: {}
       uptime: {}
       working_directory: {}
+      origin_referrer_url: {}
+      origin_url: {}
       Ext:
         fields:
           ancestry: {}