Export Lacework logs to Panther via S3, Google Cloud Storage, or Azure
Overview
Panther supports ingesting Lacework export logs common Data Transport options: Amazon Web Services (AWS) S3, Google Cloud Storage (GCS), and Azure Blob.
Lacework.Applications contains applications information running on the machine with an agent installed with details (such as application name, user name, machine, etc.).
fields: - name:APP_NAMErequired:truedescription:The application name detected by the Lacework agent installed on the machine.type:string - name:CONTAINER_INFOdescription:The container info provides details about the container where the application is running.type:json - name:END_TIMErequired:truedescription:The time and date when the hourly aggregation time period ends.type:timestamptimeFormats: - '%a, %d %b %Y %H:%M:%S %z' - '%Y-%m-%d %H:%M:%S.%f' - name:EXE_PATHrequired:truedescription:The executable path for the detected application.type:string - name:MIDdescription:The Lacework-generated machine identifier that uniquely identifies the machine.type:string - name:NET_STATSdescription:The network stats about the application including the number of bytes in and out of the network.type:json - name:PROPS_MACHINEdescription:The machine properties such as host name, ip address, machine tags, etc.type:objectfields: - name:hostnamedescription:hostnametype:stringindicators: - hostname - name:ip_addrdescription:ip_addrtype:stringindicators: - ip - name:mem_kbytesdescription:mem_kbytestype:bigint - name:num_usersdescription:num_userstype:bigint - name:primary_tagsdescription:primary_tagstype:json - name:tagsdescription:tagstype:json - name:up_timedescription:up_timetype:bigint - name:START_TIMErequired:truedescription:The time and date when the hourly aggregation time period starts.type:timestamptimeFormats: - '%a, %d %b %Y %H:%M:%S %z' - '%Y-%m-%d %H:%M:%S.%f'isEventTime:true - name:USERNAMEdescription:The username running the application on the machine.type:objectfields: - name:effectivedescription:effectivetype:stringindicators: - username - name:originaldescription:originaltype:stringindicators: - username
Lacework.ChangeFiles
Lacework.ChangeFiles tracks every time a file is changed in your environment.
fields: - name:START_TIMErequired:truedescription:The time and date when the hourly aggregation time period starts.type:timestamptimeFormats: - '%a, %d %b %Y %H:%M:%S %z' - '%Y-%m-%d %H:%M:%S.%f'isEventTime:true - name:END_TIMErequired:truedescription:The time and date when the hourly aggregation time period ends.type:timestamptimeFormats: - '%a, %d %b %Y %H:%M:%S %z' - '%Y-%m-%d %H:%M:%S.%f' - name:URNrequired:truedescription:URN of the resource.type:stringindicators: - aws_arn - name:SERVICEdescription:The service that the resource belongs to.type:string - name:STATUSdescription:The status of the resource.type:json - name:CLOUD_DETAILSdescription:Cloud details.type:json - name:RESOURCE_TYPEdescription:The resource type.type:string - name:RESOURCE_IDrequired:truedescription:The ID of the resource.type:string - name:RESOURCE_REGIONdescription:The region that the resource belongs to.type:string - name:RESOURCE_CONFIGdescription:The configuration of the resource.type:json - name:RESOURCE_TAGSdescription:The tags associated with the resource.type:json - name:CSPdescription:The cloud provider.type:string - name:API_KEYdescription:The key describing the API used to fetch data for the resource.type:string
Lacework.Cmdline
Lacework.Cmdline monitors any command line invocations in your environment.