Skip to content

[Update] EDR Telemetry for Windows - Elastic - Script-Block Activity, FileDownloaded and Device Operations#205

Merged
tsale merged 8 commits into
tsale:mainfrom
AsuNa-jp:elastic_windows_powershell_scriptblock
Jul 7, 2026
Merged

[Update] EDR Telemetry for Windows - Elastic - Script-Block Activity, FileDownloaded and Device Operations#205
tsale merged 8 commits into
tsale:mainfrom
AsuNa-jp:elastic_windows_powershell_scriptblock

Conversation

@AsuNa-jp

@AsuNa-jp AsuNa-jp commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

EDR Telemetry Pull Request

Contribution Details

This PR updates the Windows scoring matrix to reflect that Elastic now collects the following events:

Sub-Category Parent Previous New Note
USB Device Mount Device Operations No Via EnablingTelemetry
USB Device Unmount Device Operations No Via EnablingTelemetry
Script-Block Activity PowerShell Activity Via EventLogs Via EnablingTelemetry We collect PowerShell script-block via Amsi event (AmsiScanBuffer ETW event).
File Downloaded Network Activity No Partially We capture the creation of Mark of the Web associated with file downloads.

Telemetry Validation

Documentation or Evidence:

Type of Contribution

  • Adding telemetry information for an existing EDR product
  • Adding a new EDR product that meets eligibility criteria
  • Proposing new event categories/sub-categories
  • Documentation improvement
  • Tool enhancement

Validation Details

EDR Product Information

  • EDR Product Name: Elastic Defend
  • EDR Version: Tested by Elastic Defend 9.4.0
image
  • Operating System(s) Tested: Windows (25H2) OS Build: 26200.8655
image

Testing Methodology

USB Device Mount/Unmount event

Test method: Mounted and unmounted a USB flash drive to generate events

Enabled Device Control events for testing using the following policy settings:

image (41)
  • Screenshot of mount / unmount events
image
  • Event details (mount event)
    "message": "Endpoint volume device event",
    "volume": {
      "device_name": "\\Device\\HarddiskVolume9",
      "bus_type": "Usb",
      "size": 15489753088,
      "removable": true,
      "mount_name": "E:",
      "file_system_type": "FAT",
      "writable": true
    },

    "message": [
      "Endpoint volume device event"
    ],
    "event.action": [
      "mount",
      "mount_audit"
    ],
Click to expand (View full event) 
{
  "_index": ".ds-logs-endpoint.events.device-default-2026.06.22-000001",
  "_id": "AZ7txW7Qi6d5qfKankxV",
  "_version": 1,
  "_source": {
    "agent": {
      "id": "c2f00df3-cf72-4fdf-9db3-388994658025",
      "type": "endpoint",
      "version": "9.4.2"
    },
    "process": {
      "Ext": {
        "code_signature": [
          {
            "thumbprint_sha256": "941519a414d737815c3173220f002819e2d9bc370c766f25d588bce65cab8456",
            "trusted": true,
            "subject_name": "Microsoft Windows Publisher",
            "exists": true,
            "status": "trusted"
          }
        ]
      },
      "code_signature": {
        "thumbprint_sha256": "941519a414d737815c3173220f002819e2d9bc370c766f25d588bce65cab8456",
        "trusted": true,
        "subject_name": "Microsoft Windows Publisher",
        "exists": true,
        "status": "trusted"
      },
      "name": "svchost.exe",
      "pid": 3356,
      "entity_id": "Kl0wZ4+twJeY6JMR4le8eA",
      "executable": "C:\\Windows\\System32\\svchost.exe"
    },
    "message": "Endpoint volume device event",
    "volume": {
      "device_name": "\\Device\\HarddiskVolume9",
      "bus_type": "Usb",
      "size": 15489753088,
      "removable": true,
      "mount_name": "E:",
      "file_system_type": "FAT",
      "writable": true
    },
    "@timestamp": "2026-06-22T05:19:55.8725926Z",
    "ecs": {
      "version": "8.10.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.device"
    },
    "elastic": {
      "agent": {
        "id": "c2f00df3-cf72-4fdf-9db3-388994658025"
      }
    },
    "host": {
      "os": {
        "type": "windows"
      },
      "name": "desktop-rnm57kt",
      "id": "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 10095,
      "ingested": "2026-06-22T05:20:10Z",
      "created": "2026-06-22T05:19:55.8893693Z",
      "kind": "event",
      "module": "endpoint",
      "action": [
        "mount",
        "mount_audit"
      ],
      "id": "OXX+7NZeUpElm2kX+++++Gup",
      "category": [
        "host"
      ],
      "type": [
        "device",
        "allowed"
      ],
      "dataset": "endpoint.events.device",
      "outcome": "success"
    },
    "device": {
      "product": {
        "name": "Patriot Memory",
        "id": "3D00"
      },
      "vendor": {
        "name": "",
        "id": "13FE"
      },
      "serial_number": "07B51F08943FFF05",
      "type": "Disk File System"
    },
    "user": {
      "domain": "DESKTOP-RNM57KT",
      "name": "vagrant",
      "id": "S-1-5-21-2866837675-1890317257-2335050649-1000"
    }
  },
  "fields": {
    "device.vendor.id": [
      "13FE"
    ],
    "event.category": [
      "host"
    ],
    "device.type": [
      "Disk File System"
    ],
    "process.name.text": [
      "svchost.exe"
    ],
    "process.pid": [
      3356
    ],
    "process.code_signature.exists": [
      true
    ],
    "elastic.agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "device.serial_number": [
      "07B51F08943FFF05"
    ],
    "process.code_signature.subject_name": [
      "Microsoft Windows Publisher"
    ],
    "volume.file_system_type": [
      "FAT"
    ],
    "host.name": [
      "desktop-rnm57kt"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "process.code_signature.thumbprint_sha256": [
      "941519a414d737815c3173220f002819e2d9bc370c766f25d588bce65cab8456"
    ],
    "event.outcome": [
      "success"
    ],
    "process.code_signature.trusted": [
      true
    ],
    "device.product.name": [
      "Patriot Memory"
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-21-2866837675-1890317257-2335050649-1000"
    ],
    "data_stream.type": [
      "logs"
    ],
    "volume.writable": [
      true
    ],
    "device.vendor.name": [
      ""
    ],
    "process.name": [
      "svchost.exe"
    ],
    "agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "ecs.version": [
      "8.10.0"
    ],
    "event.created": [
      "2026-06-22T05:19:55.889Z"
    ],
    "agent.version": [
      "9.4.2"
    ],
    "device.product.id": [
      "3D00"
    ],
    "user.name": [
      "vagrant"
    ],
    "volume.device_name": [
      "\\Device\\HarddiskVolume9"
    ],
    "process.entity_id": [
      "Kl0wZ4+twJeY6JMR4le8eA"
    ],
    "event.sequence": [
      10095
    ],
    "process.executable.caseless": [
      "c:\\windows\\system32\\svchost.exe"
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.executable.text": [
      "C:\\Windows\\System32\\svchost.exe"
    ],
    "event.module": [
      "endpoint"
    ],
    "volume.removable": [
      true
    ],
    "user.domain": [
      "DESKTOP-RNM57KT"
    ],
    "host.id": [
      "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    ],
    "process.name.caseless": [
      "svchost.exe"
    ],
    "process.executable": [
      "C:\\Windows\\System32\\svchost.exe"
    ],
    "volume.mount_name": [
      "E:"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "volume.bus_type": [
      "Usb"
    ],
    "process.code_signature.status": [
      "trusted"
    ],
    "message": [
      "Endpoint volume device event"
    ],
    "event.action": [
      "mount",
      "mount_audit"
    ],
    "event.ingested": [
      "2026-06-22T05:20:10.000Z"
    ],
    "@timestamp": [
      "2026-06-22T05:19:55.872Z"
    ],
    "data_stream.dataset": [
      "endpoint.events.device"
    ],
    "event.type": [
      "device",
      "allowed"
    ],
    "process.Ext.code_signature": [
      {
        "thumbprint_sha256": [
          "941519a414d737815c3173220f002819e2d9bc370c766f25d588bce65cab8456"
        ],
        "trusted": [
          true
        ],
        "subject_name": [
          "Microsoft Windows Publisher"
        ],
        "exists": [
          true
        ],
        "status": [
          "trusted"
        ]
      }
    ],
    "event.id": [
      "OXX+7NZeUpElm2kX+++++Gup"
    ],
    "volume.size": [
      15489753088
    ],
    "event.dataset": [
      "endpoint.events.device"
    ],
    "user.name.text": [
      "vagrant"
    ]
  }
}
  • Event details (unmount event)
    "volume": {
      "device_name": "SWD\\WPDBUSENUM\\_??_USBSTOR\\Disk&Ven_&Prod_Patriot_Memory&Rev_PMAP\\07B51F08943FFF05&0",
      "bus_type": "USB"
    },

    "volume.bus_type": [
      "USB"
    ],
    "message": [
      "Endpoint volume device event"
    ],
    "data_stream.type": [
      "logs"
    ],
    "process.name": [
      "System"
    ],
    "event.action": [
      "unmount"
    ],
Click to expand (View full event) 
{
  "_index": ".ds-logs-endpoint.events.device-default-2026.06.22-000001",
  "_id": "AZ7txm7Qi6d5qfITnqyD",
  "_version": 1,
  "_source": {
    "volume": {
      "device_name": "SWD\\WPDBUSENUM\\_??_USBSTOR\\Disk&Ven_&Prod_Patriot_Memory&Rev_PMAP\\07B51F08943FFF05&0",
      "bus_type": "USB"
    },
    "agent": {
      "id": "c2f00df3-cf72-4fdf-9db3-388994658025",
      "type": "endpoint",
      "version": "9.4.2"
    },
    "process": {
      "name": "System",
      "pid": 4,
      "entity_id": "j91iw3hOjETjxPK13+x7Kg"
    },
    "@timestamp": "2026-06-22T05:20:33.0Z",
    "ecs": {
      "version": "8.10.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.device"
    },
    "elastic": {
      "agent": {
        "id": "c2f00df3-cf72-4fdf-9db3-388994658025"
      }
    },
    "host": {
      "os": {
        "type": "windows"
      },
      "name": "desktop-rnm57kt",
      "id": "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 10266,
      "ingested": "2026-06-22T05:20:41Z",
      "created": "2026-06-22T05:20:33.3756764Z",
      "kind": "event",
      "module": "endpoint",
      "action": [
        "unmount"
      ],
      "id": "OXX+7NZeUpElm2kX+++++HpF",
      "category": [
        "host"
      ],
      "type": [
        "device"
      ],
      "dataset": "endpoint.events.device",
      "outcome": "success"
    },
    "message": "Endpoint volume device event",
    "user": {
      "domain": "NT AUTHORITY",
      "name": "SYSTEM",
      "id": "S-1-5-18"
    }
  },
  "fields": {
    "event.category": [
      "host"
    ],
    "process.name.text": [
      "System"
    ],
    "user.name": [
      "SYSTEM"
    ],
    "volume.device_name": [
      "SWD\\WPDBUSENUM\\_??_USBSTOR\\Disk&Ven_&Prod_Patriot_Memory&Rev_PMAP\\07B51F08943FFF05&0"
    ],
    "process.pid": [
      4
    ],
    "elastic.agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "process.entity_id": [
      "j91iw3hOjETjxPK13+x7Kg"
    ],
    "event.sequence": [
      10266
    ],
    "agent.type": [
      "endpoint"
    ],
    "event.module": [
      "endpoint"
    ],
    "host.name": [
      "desktop-rnm57kt"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "user.domain": [
      "NT AUTHORITY"
    ],
    "event.kind": [
      "event"
    ],
    "host.id": [
      "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    ],
    "process.name.caseless": [
      "system"
    ],
    "event.outcome": [
      "success"
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-18"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "volume.bus_type": [
      "USB"
    ],
    "message": [
      "Endpoint volume device event"
    ],
    "data_stream.type": [
      "logs"
    ],
    "process.name": [
      "System"
    ],
    "event.action": [
      "unmount"
    ],
    "event.ingested": [
      "2026-06-22T05:20:41.000Z"
    ],
    "@timestamp": [
      "2026-06-22T05:20:33.000Z"
    ],
    "agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "ecs.version": [
      "8.10.0"
    ],
    "data_stream.dataset": [
      "endpoint.events.device"
    ],
    "event.created": [
      "2026-06-22T05:20:33.375Z"
    ],
    "event.type": [
      "device"
    ],
    "agent.version": [
      "9.4.2"
    ],
    "event.id": [
      "OXX+7NZeUpElm2kX+++++HpF"
    ],
    "event.dataset": [
      "endpoint.events.device"
    ],
    "user.name.text": [
      "SYSTEM"
    ]
  }
}

Script-Block Activity event

Test Method: Ran an EDR bypass tool (DSCourier) that executes PowerShell through the WinGet DSC COM API, to test whether Script Block logging captures its execution.

The events themselves can be enabled by checking the "API" option in the settings below.
image

Additionally, setting the windows.advanced.events.api_verbose advanced policy setting to true will allow the events to be forwarded to Elasticsearch (SIEM).

image
  • Screenshot
image
  • Event details
        "api": {
          "summary": "AmsiScanBuffer( PowerShell, NULL, 2083d73a4bbc96c01b18da73ef3dbf29016a0c908195f28cfbf819a1cc2d766e )",
          "metadata": {
            "return_value": 1
          },
          "name": "AmsiScanBuffer",
          "parameters": {
            "app_name": "PowerShell",
            "size": 434,
            "buffer": "$timestamp = Get-Date -Format \"yyyy-MM-dd HH:mm:ss\"\n$info = \"DSCourier executed at $timestamp on $env:COMPUTERNAME as $env:USERNAME\"\n$info | Out-File -FilePath \"$env:TEMP\\dscourier_test.txt\" -Force\nWrite-Output $info\n"
          }
        },
Click to expand (View full event) 
{
  "_index": ".ds-logs-endpoint.events.api-default-2026.06.22-000001",
  "_id": "AZ7uGTrx-vIkJgXIye3B",
  "_version": 1,
  "_source": {
    "agent": {
      "id": "c2f00df3-cf72-4fdf-9db3-388994658025",
      "type": "endpoint",
      "version": "9.4.2"
    },
    "process": {
      "Ext": {
        "code_signature": [
          {
            "thumbprint_sha256": "b41c444f8cbd49d1b27cc2c76e0f3fb042bf9970b6b6f6b57fc8976514b03952",
            "trusted": true,
            "subject_name": "Microsoft Corporation",
            "exists": true,
            "status": "trusted"
          }
        ],
        "api": {
          "summary": "AmsiScanBuffer( PowerShell, NULL, 2083d73a4bbc96c01b18da73ef3dbf29016a0c908195f28cfbf819a1cc2d766e )",
          "metadata": {
            "return_value": 1
          },
          "name": "AmsiScanBuffer",
          "parameters": {
            "app_name": "PowerShell",
            "size": 434,
            "buffer": "$timestamp = Get-Date -Format \"yyyy-MM-dd HH:mm:ss\"\n$info = \"DSCourier executed at $timestamp on $env:COMPUTERNAME as $env:USERNAME\"\n$info | Out-File -FilePath \"$env:TEMP\\dscourier_test.txt\" -Force\nWrite-Output $info\n"
          }
        },
        "token": {
          "integrity_level_name": "high"
        }
      },
      "parent": {
        "executable": "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\WindowsPackageManagerServer.exe"
      },
      "code_signature": {
        "thumbprint_sha256": "b41c444f8cbd49d1b27cc2c76e0f3fb042bf9970b6b6f6b57fc8976514b03952",
        "trusted": true,
        "subject_name": "Microsoft Corporation",
        "exists": true,
        "status": "trusted"
      },
      "name": "ConfigurationRemotingServer.exe",
      "pid": 8260,
      "entity_id": "1pf3+3r2pnf4phusldktYg",
      "executable": "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\DotNet\\ConfigurationRemotingServer.exe"
    },
    "@timestamp": "2026-06-22T06:51:39.1938246Z",
    "ecs": {
      "version": "8.10.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.api"
    },
    "elastic": {
      "agent": {
        "id": "c2f00df3-cf72-4fdf-9db3-388994658025"
      }
    },
    "host": {
      "os": {
        "type": "windows"
      },
      "name": "desktop-rnm57kt",
      "id": "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    },
    "event": {
      "created": "2026-06-22T06:51:39.2401242Z",
      "kind": "event",
      "module": "endpoint",
      "type": [
        "allowed"
      ],
      "agent_id_status": "verified",
      "sequence": 38373,
      "ingested": "2026-06-22T06:52:07Z",
      "provider": "Microsoft-Antimalware-Scan-Interface",
      "action": [],
      "id": "OXX+7NZeUpElm2kX++++/iJY",
      "category": [
        "api"
      ],
      "dataset": "endpoint.events.api",
      "outcome": "unknown"
    },
    "message": "Endpoint API event - AmsiScanBuffer",
    "user": {
      "domain": "DESKTOP-RNM57KT",
      "name": "vagrant",
      "id": "S-1-5-21-2866837675-1890317257-2335050649-1000"
    }
  },
  "fields": {
    "event.category": [
      "api"
    ],
    "process.name.text": [
      "ConfigurationRemotingServer.exe"
    ],
    "process.Ext.api.summary": [
      "AmsiScanBuffer( PowerShell, NULL, 2083d73a4bbc96c01b18da73ef3dbf29016a0c908195f28cfbf819a1cc2d766e )"
    ],
    "process.pid": [
      8260
    ],
    "process.code_signature.exists": [
      true
    ],
    "elastic.agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "process.code_signature.subject_name": [
      "Microsoft Corporation"
    ],
    "process.Ext.api.metadata.return_value": [
      1
    ],
    "host.name": [
      "desktop-rnm57kt"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "process.code_signature.thumbprint_sha256": [
      "b41c444f8cbd49d1b27cc2c76e0f3fb042bf9970b6b6f6b57fc8976514b03952"
    ],
    "event.kind": [
      "event"
    ],
    "event.outcome": [
      "unknown"
    ],
    "process.code_signature.trusted": [
      true
    ],
    "process.Ext.api.parameters.size": [
      434
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-21-2866837675-1890317257-2335050649-1000"
    ],
    "data_stream.type": [
      "logs"
    ],
    "process.name": [
      "ConfigurationRemotingServer.exe"
    ],
    "event.provider": [
      "Microsoft-Antimalware-Scan-Interface"
    ],
    "agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "ecs.version": [
      "8.10.0"
    ],
    "event.created": [
      "2026-06-22T06:51:39.240Z"
    ],
    "process.Ext.api.parameters.buffer": [
      "$timestamp = Get-Date -Format \"yyyy-MM-dd HH:mm:ss\"\n$info = \"DSCourier executed at $timestamp on $env:COMPUTERNAME as $env:USERNAME\"\n$info | Out-File -FilePath \"$env:TEMP\\dscourier_test.txt\" -Force\nWrite-Output $info\n"
    ],
    "agent.version": [
      "9.4.2"
    ],
    "user.name": [
      "vagrant"
    ],
    "process.Ext.api.name": [
      "AmsiScanBuffer"
    ],
    "process.Ext.api.parameters.app_name": [
      "PowerShell"
    ],
    "process.entity_id": [
      "1pf3+3r2pnf4phusldktYg"
    ],
    "process.executable.caseless": [
      "c:\\program files\\windowsapps\\microsoft.desktopappinstaller_1.28.240.0_x64__8wekyb3d8bbwe\\dotnet\\configurationremotingserver.exe"
    ],
    "event.sequence": [
      38373
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.executable.text": [
      "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\DotNet\\ConfigurationRemotingServer.exe"
    ],
    "event.module": [
      "endpoint"
    ],
    "user.domain": [
      "DESKTOP-RNM57KT"
    ],
    "host.id": [
      "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    ],
    "process.name.caseless": [
      "configurationremotingserver.exe"
    ],
    "process.executable": [
      "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\DotNet\\ConfigurationRemotingServer.exe"
    ],
    "process.Ext.token.integrity_level_name": [
      "high"
    ],
    "process.parent.executable": [
      "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\\WindowsPackageManagerServer.exe"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "process.code_signature.status": [
      "trusted"
    ],
    "message": [
      "Endpoint API event - AmsiScanBuffer"
    ],
    "event.ingested": [
      "2026-06-22T06:52:07.000Z"
    ],
    "@timestamp": [
      "2026-06-22T06:51:39.193Z"
    ],
    "data_stream.dataset": [
      "endpoint.events.api"
    ],
    "event.type": [
      "allowed"
    ],
    "process.Ext.code_signature": [
      {
        "subject_name": [
          "Microsoft Corporation"
        ],
        "exists": [
          true
        ],
        "thumbprint_sha256": [
          "b41c444f8cbd49d1b27cc2c76e0f3fb042bf9970b6b6f6b57fc8976514b03952"
        ],
        "trusted": [
          true
        ],
        "status": [
          "trusted"
        ]
      }
    ],
    "event.id": [
      "OXX+7NZeUpElm2kX++++/iJY"
    ],
    "event.dataset": [
      "endpoint.events.api"
    ],
    "user.name.text": [
      "vagrant"
    ]
  }
}

File Downloaded event

Test Method: Manually download https://ja.wikipedia.org/wiki/%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB:Elasticsearch_logo.svg from Google Chrome

The events themselves can be enabled by checking the "File" option in the settings below.
image

  • Screenshot
image
  • Event details (We capture the creation of Mark of the Web associated with file downloads.)
    "file": {
      "Ext": {
        "header_data": [],
        "header_bytes": "5b5a6f6e655472616e736665725d0d0a",
        "windows": {
          "zone_identifier": 3
        }
      },
      "origin_url": "https://upload.wikimedia.org/wikipedia/commons/thumb/f/f4/Elasticsearch_logo.svg/960px-Elasticsearch_logo.svg.png",
      "path": "C:\\Users\\vagrant\\Downloads\\Elasticsearch_logo.svg.png:Zone.Identifier",
      "extension": "png",
      "size": 187,
      "name": "Elasticsearch_logo.svg.png:Zone.Identifier",
      "origin_referrer_url": "https://ja.wikipedia.org/"
    },
Click to expand (View full event) 
{
  "_index": ".ds-logs-endpoint.events.file-default-2026.06.22-000001",
  "_id": "AZ7uLm7Qi6d5qfIItE-_",
  "_version": 1,
  "_source": {
    "agent": {
      "id": "c2f00df3-cf72-4fdf-9db3-388994658025",
      "type": "endpoint",
      "version": "9.4.2"
    },
    "process": {
      "Ext": {
        "code_signature": [
          {
            "thumbprint_sha256": "2029505d14baf18af60a0d1a7d8b56447db643b32faa849d4c08d2ab1ff3a4fd",
            "trusted": true,
            "subject_name": "Google LLC",
            "exists": true,
            "status": "trusted"
          }
        ]
      },
      "parent": {
        "pid": 1320
      },
      "code_signature": {
        "thumbprint_sha256": "2029505d14baf18af60a0d1a7d8b56447db643b32faa849d4c08d2ab1ff3a4fd",
        "trusted": true,
        "subject_name": "Google LLC",
        "exists": true,
        "status": "trusted"
      },
      "name": "chrome.exe",
      "pid": 11160,
      "thread": {
        "id": 14232
      },
      "entity_id": "9IZPy5NH7dCpmonXzUksEQ",
      "executable": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    },
    "@timestamp": "2026-06-22T07:13:36.5490362Z",
    "file": {
      "Ext": {
        "header_data": [],
        "header_bytes": "5b5a6f6e655472616e736665725d0d0a",
        "windows": {
          "zone_identifier": 3
        }
      },
      "origin_url": "https://upload.wikimedia.org/wikipedia/commons/thumb/f/f4/Elasticsearch_logo.svg/960px-Elasticsearch_logo.svg.png",
      "path": "C:\\Users\\vagrant\\Downloads\\Elasticsearch_logo.svg.png:Zone.Identifier",
      "extension": "png",
      "size": 187,
      "name": "Elasticsearch_logo.svg.png:Zone.Identifier",
      "origin_referrer_url": "https://ja.wikipedia.org/"
    },
    "ecs": {
      "version": "8.10.0"
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "endpoint.events.file"
    },
    "elastic": {
      "agent": {
        "id": "c2f00df3-cf72-4fdf-9db3-388994658025"
      }
    },
    "host": {
      "os": {
        "type": "windows"
      },
      "name": "desktop-rnm57kt",
      "id": "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    },
    "event": {
      "agent_id_status": "verified",
      "sequence": 48657,
      "ingested": "2026-06-22T07:14:14Z",
      "created": "2026-06-22T07:13:36.5470826Z",
      "kind": "event",
      "module": "endpoint",
      "action": [
        "creation"
      ],
      "id": "OXX+7NZeUpElm2kX++++03qE",
      "category": [
        "file"
      ],
      "type": [
        "creation"
      ],
      "dataset": "endpoint.events.file",
      "outcome": "unknown"
    },
    "message": "Endpoint file event",
    "user": {
      "domain": "DESKTOP-RNM57KT",
      "name": "vagrant",
      "id": "S-1-5-21-2866837675-1890317257-2335050649-1000"
    }
  },
  "fields": {
    "file.path": [
      "C:\\Users\\vagrant\\Downloads\\Elasticsearch_logo.svg.png:Zone.Identifier"
    ],
    "event.category": [
      "file"
    ],
    "process.name.text": [
      "chrome.exe"
    ],
    "file.origin_url": [
      "https://upload.wikimedia.org/wikipedia/commons/thumb/f/f4/Elasticsearch_logo.svg/960px-Elasticsearch_logo.svg.png"
    ],
    "process.parent.pid": [
      1320
    ],
    "process.pid": [
      11160
    ],
    "process.code_signature.exists": [
      true
    ],
    "elastic.agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "process.code_signature.subject_name": [
      "Google LLC"
    ],
    "host.name": [
      "desktop-rnm57kt"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "process.code_signature.thumbprint_sha256": [
      "2029505d14baf18af60a0d1a7d8b56447db643b32faa849d4c08d2ab1ff3a4fd"
    ],
    "event.outcome": [
      "unknown"
    ],
    "process.code_signature.trusted": [
      true
    ],
    "file.path.text": [
      "C:\\Users\\vagrant\\Downloads\\Elasticsearch_logo.svg.png:Zone.Identifier"
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-21-2866837675-1890317257-2335050649-1000"
    ],
    "data_stream.type": [
      "logs"
    ],
    "file.Ext.header_bytes": [
      "5b5a6f6e655472616e736665725d0d0a"
    ],
    "process.name": [
      "chrome.exe"
    ],
    "agent.id": [
      "c2f00df3-cf72-4fdf-9db3-388994658025"
    ],
    "ecs.version": [
      "8.10.0"
    ],
    "event.created": [
      "2026-06-22T07:13:36.547Z"
    ],
    "agent.version": [
      "9.4.2"
    ],
    "file.extension": [
      "png"
    ],
    "process.thread.id": [
      14232
    ],
    "file.Ext.windows.zone_identifier": [
      "3"
    ],
    "file.origin_referrer_url": [
      "https://ja.wikipedia.org/"
    ],
    "user.name": [
      "vagrant"
    ],
    "process.entity_id": [
      "9IZPy5NH7dCpmonXzUksEQ"
    ],
    "event.sequence": [
      48657
    ],
    "process.executable.caseless": [
      "c:\\program files\\google\\chrome\\application\\chrome.exe"
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.executable.text": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    ],
    "event.module": [
      "endpoint"
    ],
    "user.domain": [
      "DESKTOP-RNM57KT"
    ],
    "host.id": [
      "511df897-07a4-4dbf-bfba-c74f569dcc5a"
    ],
    "process.name.caseless": [
      "chrome.exe"
    ],
    "process.executable": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "file.name": [
      "Elasticsearch_logo.svg.png:Zone.Identifier"
    ],
    "file.size": [
      187
    ],
    "process.code_signature.status": [
      "trusted"
    ],
    "message": [
      "Endpoint file event"
    ],
    "event.action": [
      "creation"
    ],
    "event.ingested": [
      "2026-06-22T07:14:14.000Z"
    ],
    "@timestamp": [
      "2026-06-22T07:13:36.549Z"
    ],
    "file.path.caseless": [
      "c:\\users\\vagrant\\downloads\\elasticsearch_logo.svg.png:zone.identifier"
    ],
    "data_stream.dataset": [
      "endpoint.events.file"
    ],
    "event.type": [
      "creation"
    ],
    "process.Ext.code_signature": [
      {
        "thumbprint_sha256": [
          "2029505d14baf18af60a0d1a7d8b56447db643b32faa849d4c08d2ab1ff3a4fd"
        ],
        "trusted": [
          true
        ],
        "subject_name": [
          "Google LLC"
        ],
        "exists": [
          true
        ],
        "status": [
          "trusted"
        ]
      }
    ],
    "event.id": [
      "OXX+7NZeUpElm2kX++++03qE"
    ],
    "event.dataset": [
      "endpoint.events.file"
    ],
    "user.name.text": [
      "vagrant"
    ]
  }
}

Additional Notes

@AsuNa-jp AsuNa-jp marked this pull request as ready for review June 24, 2026 08:43
@AsuNa-jp

AsuNa-jp commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Hi @tsale,
I work as an engineer at Elastic, and I'd like to update the current telemetry coverage status of Elastic Defend on Windows. When you have some time, would it be possible for you to review and merge this PR? 🙇‍♀️ Please feel free to reach out if you need any further information or if anything is missing.

(I also had a look at the Vendor Improvement Leaderboard below. Thanks for the cool visualization!)

@tsale

tsale commented Jul 6, 2026

Copy link
Copy Markdown
Owner

Hi @AsuNa-jp, and thank you for the nice words and for your contribution! Also, thanks for the detailed evidence and raw event examples here.

I made a small methodology adjustment to the USB device entries:

  • USB Device Mount: Yes → Via EnablingTelemetry
  • USB Device Unmount: Yes → Via EnablingTelemetry

Reason: the evidence looks good for Elastic collecting direct USB mount/unmount telemetry under the tested configuration, but the PR notes that Device Control was explicitly enabled for the test. Under the project taxonomy, telemetry that requires enabling a built-in product feature or setting should be represented as Via EnablingTelemetry rather than default Yes.

One question on Script-Block Activity: does forwarding the AmsiScanBuffer API event content to Elasticsearch require windows.advanced.events.api_verbose=true or another explicit policy/advanced-setting change in normal Elastic Defend deployments?

If that has to be explicitly enabled, I think this should receive the same treatment as the USB entries and be changed from Yes to Via EnablingTelemetry. If it is collected and exposed by default, then Yes looks supportable based on the event sample.

@tsale tsale self-assigned this Jul 6, 2026
@tsale tsale added waiting for info Further information is requested under review Evaluating proposal labels Jul 6, 2026
AsuNa-jp
AsuNa-jp commented Jul 7, 2026
View reviewed changes
Comment thread EDR_telem_windows.json Outdated
AsuNa-jp
AsuNa-jp commented Jul 7, 2026
View reviewed changes
Comment thread EDR_telem_windows.json Outdated
AsuNa-jp
AsuNa-jp commented Jul 7, 2026
View reviewed changes
Comment thread EDR_telem_windows.json Outdated
@AsuNa-jp

AsuNa-jp commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Hi @tsale
Thanks so much for the thorough review of this PR. I agree with all your feedback and have updated the PR accordingly. Please find my responses to each of your comments below. 🙇‍♀️

USB Device Mount / Unmount events

I re-checked this on Elastic Defend 9.2, where USB Device Mount / Unmount events were introduced, and confirmed that the following was the default state. So I've updated it to Via EnablingTelemetry.

image (42)

Script-Block Activity events

API events, including AmsiScanBuffer, are collected by default behind the scenes. However, as you pointed out, AmsiScanBuffer specifically won't be sent to Elasticsearch unless windows.advanced.events.api_verbose=true is set. So I've updated this to Via EnablingTelemetry

image (43)

@tsale tsale removed waiting for info Further information is requested under review Evaluating proposal labels Jul 7, 2026
tsale
tsale approved these changes Jul 7, 2026
View reviewed changes

@tsale tsale left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @AsuNa-jp,

Thank you very much for checking and updating this. That makes sense on both points.

Really appreciate the detailed follow-up and screenshots!

@tsale tsale merged commit ba60a55 into tsale:main Jul 7, 2026
1 check failed
@AsuNa-jp

AsuNa-jp commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

Hi @tsale
Thank you very much for merging this PR so quickly! I also really appreciate your kind words on LinkedIn. 😄

As we are planning to release new telemetry in the next Elastic Defend update, I expect to open another PR sometime next month. Looking forward to collaborating with you again! 🙇‍♀️

@tsale

tsale commented Jul 8, 2026

Copy link
Copy Markdown
Owner

Hi @tsale Thank you very much for merging this PR so quickly! I also really appreciate your kind words on LinkedIn. 😄

As we are planning to release new telemetry in the next Elastic Defend update, I expect to open another PR sometime next month. Looking forward to collaborating with you again! 🙇‍♀️

Awesome! Looking forward to it 😊

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tsale tsale tsale approved these changes

Assignees

@tsale tsale

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@AsuNa-jp @tsale