[carbon_black_cloud] Capture user domain from hostname and username field

packages/carbon_black_cloud/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: 0.1.1
+  changes:
+    - description: Captured domain from username and hostname
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3106
 - version: 0.1.0
   changes:
     - description: Initial draft of the package.

packages/carbon_black_cloud/data_stream/alert/_dev/test/pipeline/test-alert.log

@@ -1,3 +1,3 @@
-{"type":"WATCHLIST","id":"test1","legacy_alert_id":"ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613-BC154984541016AFD2467DF221AA20FD","org_key":"ABCD1234","create_time":"2021-01-04T23:33:32Z","last_update_time":"2021-01-04T23:33:32Z","first_event_time":"2021-01-04T23:25:58Z","last_event_time":"2021-01-04T23:25:58Z","threat_id":"t9101","severity":7,"category":"WARNING","device_id":1,"device_os":"WINDOWS","device_name":"DESKTOP-001","device_username":"test56@demo.com","policy_id":6525,"policy_name":"default","target_value":"MEDIUM","workflow":{"state":"OPEN","remediation":"","last_update_time":"2021-01-04T23:32:19Z","comment":"","changed_by":"Carbon Black"},"device_internal_ip":"1.128.3.4","device_external_ip":"81.2.69.145","alert_url":"https://defense.conferdeploy.net/cb/investigate/processes?orgId=123&query=alert_id%3A951d536a-2817-4790-8c97-c2d31624de7c+AND+device_id%3A3775337&searchWindow=ALL","reason_code":"Process powershell.exe was detected by the report \"Execution - PowerShell Downloading Behaviors Detected\" in watchlist \"Carbon Black Advanced Threats\"","process_name":"powershell.exe","threat_indicators":[{"process_name":"powershell.exe","sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","ttps":["e41b000e-eb5a-41f4-aa67-1902d186a457-0"]}],"threat_cause_actor_sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","threat_cause_actor_name":"powershell.exe","threat_cause_reputation":"COMMON_WHITE_LIST","threat_cause_threat_category":"RESPONSE_WATCHLIST","threat_cause_vector":"UNKNOWN","run_state":"RAN","ioc_id":"e41b000e-eb5a-41f4-aa67-1902d186a457-0","ioc_hit":"(process_cmdline:powershell* AND (process_cmdline:.downloaddata OR process_cmdline:.downloadstring OR process_cmdline:.downloadfile) -process_cmdline:chocolatey.org*) -enriched:true","watchlists":[{"id":"mrTB06fAQbeNfvl47cQiGg","name":"Carbon Black Advanced Threats"}],"process_guid":"ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613","process_path":"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe","report_name":"Execution - PowerShell Downloading Behaviors Detected","report_id":"MLRtPcpQGKFh5OE4BT3tQ-e41b000e-eb5a-41f4-aa67-1902d186a457","status":"UNRESOLVED"}
+{"type":"WATCHLIST","id":"test1","legacy_alert_id":"ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613-BC154984541016AFD2467DF221AA20FD","org_key":"ABCD1234","create_time":"2021-01-04T23:33:32Z","last_update_time":"2021-01-04T23:33:32Z","first_event_time":"2021-01-04T23:25:58Z","last_event_time":"2021-01-04T23:25:58Z","threat_id":"t9101","severity":7,"category":"WARNING","device_id":1,"device_os":"WINDOWS","device_name":"abc\\DESKTOP-001","device_username":"xyz\\test56@demo.com","policy_id":6525,"policy_name":"default","target_value":"MEDIUM","workflow":{"state":"OPEN","remediation":"","last_update_time":"2021-01-04T23:32:19Z","comment":"","changed_by":"Carbon Black"},"device_internal_ip":"1.128.3.4","device_external_ip":"81.2.69.145","alert_url":"https://defense.conferdeploy.net/cb/investigate/processes?orgId=123&query=alert_id%3A951d536a-2817-4790-8c97-c2d31624de7c+AND+device_id%3A3775337&searchWindow=ALL","reason_code":"Process powershell.exe was detected by the report \"Execution - PowerShell Downloading Behaviors Detected\" in watchlist \"Carbon Black Advanced Threats\"","process_name":"powershell.exe","threat_indicators":[{"process_name":"powershell.exe","sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","ttps":["e41b000e-eb5a-41f4-aa67-1902d186a457-0"]}],"threat_cause_actor_sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","threat_cause_actor_name":"powershell.exe","threat_cause_reputation":"COMMON_WHITE_LIST","threat_cause_threat_category":"RESPONSE_WATCHLIST","threat_cause_vector":"UNKNOWN","run_state":"RAN","ioc_id":"e41b000e-eb5a-41f4-aa67-1902d186a457-0","ioc_hit":"(process_cmdline:powershell* AND (process_cmdline:.downloaddata OR process_cmdline:.downloadstring OR process_cmdline:.downloadfile) -process_cmdline:chocolatey.org*) -enriched:true","watchlists":[{"id":"mrTB06fAQbeNfvl47cQiGg","name":"Carbon Black Advanced Threats"}],"process_guid":"ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613","process_path":"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe","report_name":"Execution - PowerShell Downloading Behaviors Detected","report_id":"MLRtPcpQGKFh5OE4BT3tQ-e41b000e-eb5a-41f4-aa67-1902d186a457","status":"UNRESOLVED"}
 {"type":"DEVICE_CONTROL","id":"test1","legacy_alert_id":"C8EB7306-AF26-4A9A-B677-814B3AF69720","org_key":"ABCD6X3T","create_time":"2020-11-17T22:05:13Z","last_update_time":"2020-11-17T22:05:13Z","first_event_time":"2020-11-17T22:02:16Z","last_event_time":"2020-11-17T22:02:16Z","threat_id":"t5678","severity":3,"category":"WARNING","device_id":2,"device_os":"WINDOWS","device_os_version":"Windows 10 x64","device_name":"DESKTOP-002","device_username":"test34@demo.com","policy_id":6997287,"policy_name":"Standard","target_value":"MEDIUM","workflow":{"state":"OPEN","remediation":"","last_update_time":"2020-11-17T22:02:16Z","comment":"","changed_by":"Carbon Black"},"device_internal_ip":"81.2.69.144","device_external_ip":"81.2.69.143","alert_url":"https://defense-eap01.conferdeploy.net/alerts?orgId=1889976","reason":"Access attempted on unapproved USB device SanDisk U3 Cruzer Micro (SN: 0875920EF7C2A304). A Deny Policy Action was applied.","reason_code":"6D578342-9DE5-4353-9C25-1D3D857BFC5B:DCAEB1FA-513C-4026-9AB6-37A935873FBC","device_location":"UNKNOWN","threat_cause_threat_category":"NON_MALWARE","threat_cause_vector":"REMOVABLE_MEDIA","threat_cause_cause_event_id":"FCEE2AF0-D832-4C9F-B988-F11B46028C9E","sensor_action":"DENY","run_state":"DID_NOT_RUN","policy_applied":"APPLIED","vendor_name":"SanDisk","vendor_id":"0x0781","product_name":"U3 Cruzer Micro","product_id":"0x5406","serial_number":"0875920EF7C2A304"}
 {"type":"CB_ANALYTICS","id":"test1","legacy_alert_id":"ZHGKP3EM","org_key":"ABCD1234","create_time":"2021-01-04T22:22:52Z","last_update_time":"2021-01-04T22:23:05Z","first_event_time":"2021-01-04T22:22:42Z","last_event_time":"2021-01-04T22:22:42Z","threat_id":"t1234","severity":4,"category":"NOTICE","device_id":3,"device_os":"WINDOWS","device_os_version":"Windows 10 x64","device_name":"DESKTOP-003","device_username":"test12@demo.com","policy_id":6525,"policy_name":"default","target_value":"MEDIUM","workflow":{"state":"OPEN","remediation":"","last_update_time":"2021-01-04T22:22:52Z","comment":"","changed_by":"Carbon Black"},"device_internal_ip":"1.128.3.4","device_external_ip":"81.2.69.143","alert_url":"https://defense.conferdeploy.net/triage?incidentId=ZHGKP3EM&orgId=123","reason":"The application powershell.exe is executing a fileless script or command.","reason_code":"R_FILELESS","process_name":"powershell.exe","device_location":"OFFSITE","created_by_event_id":"5daf0f2c4edb11ebb2828b41ebaf3867","threat_indicators":[{"process_name":"powershell.exe","sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","ttps":["MODIFY_MEMORY_PROTECTION"]},{"process_name":"powershell.exe","sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","ttps":["MITRE_T1059_CMD_LINE_OR_SCRIPT_INTER"]},{"process_name":"powershell.exe","sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","ttps":["FILELESS"]},{"process_name":"powershell.exe","sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","ttps":["MITRE_T1057_PROCESS_DISCOVERY"]},{"process_name":"powershell.exe","sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","ttps":["CODE_DROP"]},{"process_name":"powershell.exe","sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","ttps":["ENUMERATE_PROCESSES"]}],"threat_cause_actor_sha256":"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53","threat_cause_actor_name":"powershell.exe","threat_cause_actor_process_pid":"3292-132541831999374961-0","threat_cause_reputation":"COMMON_WHITE_LIST","threat_cause_threat_category":"NON_MALWARE","threat_cause_vector":"UNKNOWN","threat_cause_cause_event_id":"5daf0f344edb11ebb2828b41ebaf3867","blocked_threat_category":"UNKNOWN","not_blocked_threat_category":"NON_MALWARE","kill_chain_status":["DELIVER_EXPLOIT"],"run_state":"RAN","policy_applied":"NOT_APPLIED"}

packages/carbon_black_cloud/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json

@@ -69,7 +69,7 @@
                 "end": "2021-01-04T23:25:58Z",
                 "id": "test1",
                 "kind": "alert",
-                "original": "{\"type\":\"WATCHLIST\",\"id\":\"test1\",\"legacy_alert_id\":\"ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613-BC154984541016AFD2467DF221AA20FD\",\"org_key\":\"ABCD1234\",\"create_time\":\"2021-01-04T23:33:32Z\",\"last_update_time\":\"2021-01-04T23:33:32Z\",\"first_event_time\":\"2021-01-04T23:25:58Z\",\"last_event_time\":\"2021-01-04T23:25:58Z\",\"threat_id\":\"t9101\",\"severity\":7,\"category\":\"WARNING\",\"device_id\":1,\"device_os\":\"WINDOWS\",\"device_name\":\"DESKTOP-001\",\"device_username\":\"test56@demo.com\",\"policy_id\":6525,\"policy_name\":\"default\",\"target_value\":\"MEDIUM\",\"workflow\":{\"state\":\"OPEN\",\"remediation\":\"\",\"last_update_time\":\"2021-01-04T23:32:19Z\",\"comment\":\"\",\"changed_by\":\"Carbon Black\"},\"device_internal_ip\":\"1.128.3.4\",\"device_external_ip\":\"81.2.69.145\",\"alert_url\":\"https://defense.conferdeploy.net/cb/investigate/processes?orgId=123\u0026query=alert_id%3A951d536a-2817-4790-8c97-c2d31624de7c+AND+device_id%3A3775337\u0026searchWindow=ALL\",\"reason_code\":\"Process powershell.exe was detected by the report \\\"Execution - PowerShell Downloading Behaviors Detected\\\" in watchlist \\\"Carbon Black Advanced Threats\\\"\",\"process_name\":\"powershell.exe\",\"threat_indicators\":[{\"process_name\":\"powershell.exe\",\"sha256\":\"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53\",\"ttps\":[\"e41b000e-eb5a-41f4-aa67-1902d186a457-0\"]}],\"threat_cause_actor_sha256\":\"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53\",\"threat_cause_actor_name\":\"powershell.exe\",\"threat_cause_reputation\":\"COMMON_WHITE_LIST\",\"threat_cause_threat_category\":\"RESPONSE_WATCHLIST\",\"threat_cause_vector\":\"UNKNOWN\",\"run_state\":\"RAN\",\"ioc_id\":\"e41b000e-eb5a-41f4-aa67-1902d186a457-0\",\"ioc_hit\":\"(process_cmdline:powershell* AND (process_cmdline:.downloaddata OR process_cmdline:.downloadstring OR process_cmdline:.downloadfile) -process_cmdline:chocolatey.org*) -enriched:true\",\"watchlists\":[{\"id\":\"mrTB06fAQbeNfvl47cQiGg\",\"name\":\"Carbon Black Advanced Threats\"}],\"process_guid\":\"ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613\",\"process_path\":\"c:\\\\windows\\\\system32\\\\windowspowershell\\\\v1.0\\\\powershell.exe\",\"report_name\":\"Execution - PowerShell Downloading Behaviors Detected\",\"report_id\":\"MLRtPcpQGKFh5OE4BT3tQ-e41b000e-eb5a-41f4-aa67-1902d186a457\",\"status\":\"UNRESOLVED\"}",
+                "original": "{\"type\":\"WATCHLIST\",\"id\":\"test1\",\"legacy_alert_id\":\"ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613-BC154984541016AFD2467DF221AA20FD\",\"org_key\":\"ABCD1234\",\"create_time\":\"2021-01-04T23:33:32Z\",\"last_update_time\":\"2021-01-04T23:33:32Z\",\"first_event_time\":\"2021-01-04T23:25:58Z\",\"last_event_time\":\"2021-01-04T23:25:58Z\",\"threat_id\":\"t9101\",\"severity\":7,\"category\":\"WARNING\",\"device_id\":1,\"device_os\":\"WINDOWS\",\"device_name\":\"abc\\\\DESKTOP-001\",\"device_username\":\"xyz\\\\test56@demo.com\",\"policy_id\":6525,\"policy_name\":\"default\",\"target_value\":\"MEDIUM\",\"workflow\":{\"state\":\"OPEN\",\"remediation\":\"\",\"last_update_time\":\"2021-01-04T23:32:19Z\",\"comment\":\"\",\"changed_by\":\"Carbon Black\"},\"device_internal_ip\":\"1.128.3.4\",\"device_external_ip\":\"81.2.69.145\",\"alert_url\":\"https://defense.conferdeploy.net/cb/investigate/processes?orgId=123\u0026query=alert_id%3A951d536a-2817-4790-8c97-c2d31624de7c+AND+device_id%3A3775337\u0026searchWindow=ALL\",\"reason_code\":\"Process powershell.exe was detected by the report \\\"Execution - PowerShell Downloading Behaviors Detected\\\" in watchlist \\\"Carbon Black Advanced Threats\\\"\",\"process_name\":\"powershell.exe\",\"threat_indicators\":[{\"process_name\":\"powershell.exe\",\"sha256\":\"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53\",\"ttps\":[\"e41b000e-eb5a-41f4-aa67-1902d186a457-0\"]}],\"threat_cause_actor_sha256\":\"908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53\",\"threat_cause_actor_name\":\"powershell.exe\",\"threat_cause_reputation\":\"COMMON_WHITE_LIST\",\"threat_cause_threat_category\":\"RESPONSE_WATCHLIST\",\"threat_cause_vector\":\"UNKNOWN\",\"run_state\":\"RAN\",\"ioc_id\":\"e41b000e-eb5a-41f4-aa67-1902d186a457-0\",\"ioc_hit\":\"(process_cmdline:powershell* AND (process_cmdline:.downloaddata OR process_cmdline:.downloadstring OR process_cmdline:.downloadfile) -process_cmdline:chocolatey.org*) -enriched:true\",\"watchlists\":[{\"id\":\"mrTB06fAQbeNfvl47cQiGg\",\"name\":\"Carbon Black Advanced Threats\"}],\"process_guid\":\"ABCD1234-00399b69-000033f0-00000000-1d6e2f0ef087613\",\"process_path\":\"c:\\\\windows\\\\system32\\\\windowspowershell\\\\v1.0\\\\powershell.exe\",\"report_name\":\"Execution - PowerShell Downloading Behaviors Detected\",\"report_id\":\"MLRtPcpQGKFh5OE4BT3tQ-e41b000e-eb5a-41f4-aa67-1902d186a457\",\"status\":\"UNRESOLVED\"}",
                 "severity": 7,
                 "start": "2021-01-04T23:25:58Z",
                 "url": "https://defense.conferdeploy.net/cb/investigate/processes?orgId=123\u0026query=alert_id:951d536a-2817-4790-8c97-c2d31624de7c AND device_id:3775337\u0026searchWindow=ALL"
@@ -81,6 +81,7 @@
                     "1.128.3.4",
                     "81.2.69.145"
                 ],
+                "name": "DESKTOP-001",
                 "os": {
                     "type": "windows"
                 }
@@ -95,7 +96,8 @@
                     "908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53"
                 ],
                 "hosts": [
-                    "DESKTOP-001"
+                    "DESKTOP-001",
+                    "xyz"
                 ],
                 "ip": [
                     "1.128.3.4",
@@ -109,6 +111,7 @@
                 "preserve_original_event"
             ],
             "user": {
+                "domain": "xyz",
                 "name": "test56@demo.com"
             }
         },
@@ -174,6 +177,7 @@
                     "81.2.69.144",
                     "81.2.69.143"
                 ],
+                "name": "DESKTOP-002",
                 "os": {
                     "type": "windows",
                     "version": "Windows 10 x64"
@@ -310,6 +314,7 @@
                     "1.128.3.4",
                     "81.2.69.143"
                 ],
+                "name": "DESKTOP-003",
                 "os": {
                     "type": "windows",
                     "version": "Windows 10 x64"

packages/carbon_black_cloud/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

@@ -80,6 +80,16 @@ processors:
       field: json.device_name
       target_field: host.hostname
       ignore_missing: true
+  - grok:
+      field: host.hostname
+      patterns:
+        - '^(%{DATA:user.domain})\\(%{GREEDYDATA:host.hostname})$'
+      ignore_missing: true
+      ignore_failure: true
+  - set:
+      field: host.name
+      value: "{{{host.hostname}}}"
+      ignore_failure: true
   - append:
       field: host.ip
       value: "{{{json.device_internal_ip}}}"
@@ -96,6 +106,12 @@ processors:
       field: json.device_username
       target_field: user.name
       ignore_missing: true
+  - grok:
+      field: user.name
+      patterns:
+        - '^(%{DATA:user.domain})\\(%{GREEDYDATA:user.name})$'
+      ignore_missing: true
+      ignore_failure: true
   - append:
       field: related.ip
       value: 
@@ -104,11 +120,14 @@ processors:
       allow_duplicates: false
   - append:
       field: related.user
-      value: "{{{user.name}}}"
+      value: 
+        - "{{{user.name}}}"
       allow_duplicates: false
   - append:
       field: related.hosts
-      value: "{{{host.hostname}}}"
+      value: 
+        - "{{{host.hostname}}}"
+        - "{{{user.domain}}}"
       allow_duplicates: false
   - append:
       field: related.hash

packages/carbon_black_cloud/data_stream/alert/fields/ecs.yml

@@ -22,6 +22,8 @@
   name: host.id
 - external: ecs
   name: host.ip
+- external: ecs
+  name: host.name
 - external: ecs
   name: host.os.type
 - external: ecs
@@ -42,5 +44,7 @@
   name: related.user
 - external: ecs
   name: tags
+- external: ecs
+  name: user.domain
 - external: ecs
   name: user.name

packages/carbon_black_cloud/data_stream/alert/sample_event.json

@@ -1,9 +1,9 @@
 {
     "@timestamp": "2020-11-17T22:05:13.000Z",
     "agent": {
-        "ephemeral_id": "3102b667-53be-4efc-b035-9d72bef2853f",
+        "ephemeral_id": "56053d91-103c-4c77-8f15-0a1006a80102",
         "hostname": "docker-fleet-agent",
-        "id": "1465e432-24f3-456b-98ab-e79cdc8d86f6",
+        "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0",
         "name": "docker-fleet-agent",
         "type": "filebeat",
         "version": "7.17.0"
@@ -57,17 +57,17 @@
         "version": "8.0.0"
     },
     "elastic_agent": {
-        "id": "1465e432-24f3-456b-98ab-e79cdc8d86f6",
+        "id": "4f53bc01-9d14-4e27-b716-9b41958e11e0",
         "snapshot": false,
         "version": "7.17.0"
     },
     "event": {
         "agent_id_status": "verified",
-        "created": "2022-04-05T10:25:54.372Z",
+        "created": "2022-04-14T11:46:13.154Z",
         "dataset": "carbon_black_cloud.alert",
         "end": "2020-11-17T22:02:16Z",
         "id": "test1",
-        "ingested": "2022-04-05T10:25:57Z",
+        "ingested": "2022-04-14T11:46:14Z",
         "kind": "alert",
         "original": "{\"alert_url\":\"https://defense-eap01.conferdeploy.net/alerts?orgId=1889976\",\"category\":\"WARNING\",\"create_time\":\"2020-11-17T22:05:13Z\",\"device_external_ip\":\"81.2.69.143\",\"device_id\":2,\"device_internal_ip\":\"81.2.69.144\",\"device_location\":\"UNKNOWN\",\"device_name\":\"DESKTOP-002\",\"device_os\":\"WINDOWS\",\"device_os_version\":\"Windows 10 x64\",\"device_username\":\"test34@demo.com\",\"first_event_time\":\"2020-11-17T22:02:16Z\",\"id\":\"test1\",\"last_event_time\":\"2020-11-17T22:02:16Z\",\"last_update_time\":\"2020-11-17T22:05:13Z\",\"legacy_alert_id\":\"C8EB7306-AF26-4A9A-B677-814B3AF69720\",\"org_key\":\"ABCD6X3T\",\"policy_applied\":\"APPLIED\",\"policy_id\":6997287,\"policy_name\":\"Standard\",\"product_id\":\"0x5406\",\"product_name\":\"U3 Cruzer Micro\",\"reason\":\"Access attempted on unapproved USB device SanDisk U3 Cruzer Micro (SN: 0875920EF7C2A304). A Deny Policy Action was applied.\",\"reason_code\":\"6D578342-9DE5-4353-9C25-1D3D857BFC5B:DCAEB1FA-513C-4026-9AB6-37A935873FBC\",\"run_state\":\"DID_NOT_RUN\",\"sensor_action\":\"DENY\",\"serial_number\":\"0875920EF7C2A304\",\"severity\":3,\"target_value\":\"MEDIUM\",\"threat_cause_cause_event_id\":\"FCEE2AF0-D832-4C9F-B988-F11B46028C9E\",\"threat_cause_threat_category\":\"NON_MALWARE\",\"threat_cause_vector\":\"REMOVABLE_MEDIA\",\"threat_id\":\"t5678\",\"type\":\"DEVICE_CONTROL\",\"vendor_id\":\"0x0781\",\"vendor_name\":\"SanDisk\",\"workflow\":{\"changed_by\":\"Carbon Black\",\"comment\":\"\",\"last_update_time\":\"2020-11-17T22:02:16Z\",\"remediation\":\"\",\"state\":\"OPEN\"}}",
         "reason": "Access attempted on unapproved USB device SanDisk U3 Cruzer Micro (SN: 0875920EF7C2A304). A Deny Policy Action was applied.",
@@ -82,6 +82,7 @@
             "81.2.69.144",
             "81.2.69.143"
         ],
+        "name": "DESKTOP-002",
         "os": {
             "type": "windows",
             "version": "Windows 10 x64"