Alerts are hard to parse - change to JSON

Motivation

I want to parse the alerts of fibratus to ingest them into my own project.
For that i need information like alert/detection ID, category, severity, threat name etc.
I parse the windows event logs, as in https://www.fibratus.io/#/alerts/senders/eventlog.

The relevant information is separated by newlines, whitespace, and colons.

Like this:

  <EventData>
    <Data>Suspicious access to the hosts file

Suspicious process C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe accessed the hosts file for potential tampering


Severity: medium

System events involved in this alert:

	Event #1:

		Seq: 1748233
		Pid: 4324
		Tid: 10840

Additionally, some information is stored with UTF8 arrows like "directory_table_base➜ 530c7000, domain➜ DESKTOP-C0HF6MF, exe➜ C:\Program Files (x86)".

This makes it hard to write a parser to extract the information.

Feature

Either change, or make an option which changes the output to JSON:

Like this:

  <EventData>
    <Data>
{
"title": "Suspicious access to the hosts file"
"threat": "Suspicious process C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe accessed the hosts file for potential tampering"
"severity": "medium",
"events": [
        {
		"Seq": 1748233,
		"Pid": 4324,
		"Tid": 10840,
...

Make sure that additional data like callstacks are nicely integrated.

Alternatives

XML or whatever.

Additional context

While the event logs in the current state are nicely human readable, it should be machine readable first.

My ugly LLM generated fibratus log parser: https://github.com/dobin/DetonatorAgent/blob/main/EdrPlugins/FibratusEdrPlugin.cs#L208

I need output like the following example: https://detonator.r00ted.ch/submissions/9

@dobin

Hi @dobin ,

Thanks for raising the issue. I agree that this deserves a special configuration knob to permit encoding alerts in an alternative format.
We'll try to squeeze this into the next big 3.0.0 release.

Just to confirm, we're planning to include an additional flag under alertsenders: eventlog, let's say, format. By default, it will equal a human-readable representation, but you could change it to json and have all alerts reported in JSON format.

Does this sound acceptable?

Having a flag completely works for me yes. I just need the data :-)

@dobin

Hey @dobin,

I just pushed the pull request #566, which will be incorporated in version 3.0.0. I hope this will address your needs. The resulting JSON has the following layout:

{
  "id": "64af2e2e-2309-4079-9c0f-985f1dd930f5",
  "title": "Suspicious Vault client DLL load",
  "severity": "high",
  "text": "Suspicious process C:\\WINDOWS\\system32\\VaultCmd.exe loaded the Credential Vault Client DLL for potential credentials harvesting\n",
  "description": "Identifies loading of the Vault client DLL by an unusual process. Adversaries can abuse the functions provided \nby the Credential Vault Client Library to enumerate or harvest saved credentials.\n",
  "labels": {
    "subtechnique.id": "T1555.004",
    "subtechnique.name": "Windows Credential Manager",
    "subtechnique.ref": "https://attack.mitre.org/techniques/T1555/004/",
    "tactic.id": "TA0006",
    "tactic.name": "Credential Access",
    "tactic.ref": "https://attack.mitre.org/tactics/TA0006/",
    "technique.id": "T1555",
    "technique.name": "Credentials from Password Stores",
    "technique.ref": "https://attack.mitre.org/techniques/T1555/"
  },
  "events": [
    {
      "name": "CreateProcess",
      "category": "process",
      "timestamp": "2026-01-17T17:06:13.8418922+01:00",
      "params": {
        "cmdline": "\"C:\\WINDOWS\\system32\\VaultCmd.exe\" \"/listcreds:Windows Credentials\" /all",
        "directory_table_base": "5c3e0000",
        "domain": "OSIRIS",
        "exe": "C:\\WINDOWS\\system32\\VaultCmd.exe",
        "exit_status": "Success",
        "flags": "",
        "kproc": "ffffad8248c4d080",
        "name": "VaultCmd.exe",
        "pid": 1192,
        "ppid": 16776,
        "real_ppid": 16776,
        "session_id": 1,
        "sid": "S-1-5-21-2271034452-2606270099-984871569-1001",
        "start_time": "2026-01-17 17:06:13.8418922 +0100 CET",
        "token_elevation_type": "FULL",
        "token_integrity_level": "HIGH",
        "token_is_elevated": true,
        "username": "archbunny"
      },
      "callstack": "0xfffff805ea9e0534 C:\\WINDOWS\\system32\\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff805ea8d312d C:\\WINDOWS\\system32\\ntoskrnl.exe!KeAddProcessorAffinityEx+0x74d|0xfffff805ea91d312 C:\\WINDOWS\\system32\\ntoskrnl.exe!FsRtlAreNamesEqual+0x5b2|0xfffff805eaf4345e C:\\WINDOWS\\system32\\ntoskrnl.exe!PsAcquireProcessExitSynchronization+0x130e|0xfffff805eaf43194 C:\\WINDOWS\\system32\\ntoskrnl.exe!PsAcquireProcessExitSynchronization+0x1044|0xfffff805eae9caed C:\\WINDOWS\\system32\\ntoskrnl.exe!RtlFreeAnsiString+0x181d|0xfffff805eb0c2b5e C:\\WINDOWS\\system32\\ntoskrnl.exe!CcMdlRead+0x6abe|0xfffff805eacb5655 C:\\WINDOWS\\system32\\ntoskrnl.exe!setjmpex+0x91d5|0x7fff650c35d4 C:\\Windows\\System32\\ntdll.dll!ZwCreateUserProcess|0x7fff625061da C:\\Windows\\System32\\KernelBase.dll!CreateProcessInternalW|0x7fff62503836 C:\\Windows\\System32\\KernelBase.dll!CreateProcessW|0x7fff62e3c6d4 C:\\Windows\\System32\\kernel32.dll!CreateProcessW|0x7fff44f51876 C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\22f4d83e48c2201947e262d4bca638b9\\System.ni.dll!?|0x7fff44eb3c89 C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\22f4d83e48c2201947e262d4bca638b9\\System.ni.dll!?|0x7fff44eb35f9 C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\22f4d83e48c2201947e262d4bca638b9\\System.ni.dll!?|0x7ffeece57359 C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\ba138601d2c08733806b218620e45e0b\\System.Management.Automation.ni.dll!?|0x7ffeecd6ba1a C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\ba138601d2c08733806b218620e45e0b\\System.Management.Automation.ni.dll!?|0x7ffeece18d8d C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\ba138601d2c08733806b218620e45e0b\\System.Management.Automation.ni.dll!?|0x7ffeece18a4b C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\ba138601d2c08733806b218620e45e0b\\System.Management.Automation.ni.dll!?|0x7ffeecef005f C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\ba138601d2c08733806b218620e45e0b\\System.Management.Automation.ni.dll!?|0x7ffee95d5031 unbacked!?",
      "proc": {
        "pid": 1192,
        "tid": 3916,
        "ppid": 16776,
        "name": "VaultCmd.exe",
        "exe": "C:\\WINDOWS\\system32\\VaultCmd.exe",
        "cmdline": "\"C:\\WINDOWS\\system32\\VaultCmd.exe\" \"/listcreds:Windows Credentials\" /all",
        "parent_name": "powershell.exe",
        "parent_cmdline": "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
        "sid": "S-1-5-21-2271034452-2606270099-984871569-1001",
        "username": "archbunny",
        "domain": "OSIRIS",
        "session_id": 1,
        "integrity_level": "HIGH",
        "is_wow64": false,
        "is_packaged": false,
        "is_protected": false,
        "ancestors": [
          "powershell.exe (16776)",
          "WindowsTerminal.exe (6080)",
          "explorer.exe (7688)"
        ]
      }
    },
    {
      "name": "LoadImage",
      "category": "image",
      "timestamp": "2026-01-17T17:06:13.8517121+01:00",
      "params": {
        "base_address": "7fff42800000",
        "checksum": 336202,
        "default_address": "7fff42800000",
        "file_path": "C:\\Windows\\System32\\vaultcli.dll",
        "image_size": 323584,
        "is_dll": true,
        "is_dotnet": false,
        "is_driver": false,
        "is_exec": false,
        "pid": 1192,
        "signature_level": "AUTHENTICODE",
        "signature_type": "CATALOG_CACHED"
      },
      "callstack": "0xfffff805ea9e0534 C:\\WINDOWS\\system32\\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff805ea8d312d C:\\WINDOWS\\system32\\ntoskrnl.exe!KeAddProcessorAffinityEx+0x74d|0xfffff805ea91d312 C:\\WINDOWS\\system32\\ntoskrnl.exe!FsRtlAreNamesEqual+0x5b2|0xfffff805eaef7f48 C:\\WINDOWS\\system32\\ntoskrnl.exe!PsReferenceProcessFilePointer+0x848|0xfffff805eaef7bbb C:\\WINDOWS\\system32\\ntoskrnl.exe!PsReferenceProcessFilePointer+0x4bb|0xfffff805eaeda620 C:\\WINDOWS\\system32\\ntoskrnl.exe!NtAllocateVirtualMemory+0x5570|0xfffff805eae90f2b C:\\WINDOWS\\system32\\ntoskrnl.exe!NtMapViewOfSection+0xc7b|0xfffff805eae904fd C:\\WINDOWS\\system32\\ntoskrnl.exe!NtMapViewOfSection+0x24d|0xfffff805eacb5655 C:\\WINDOWS\\system32\\ntoskrnl.exe!setjmpex+0x91d5|0x7fff650c20c4 C:\\Windows\\System32\\ntdll.dll!ZwMapViewOfSection|0x7fff64f653db C:\\Windows\\System32\\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff64f64e1e C:\\Windows\\System32\\ntdll.dll!RtlAppendUnicodeStringToString|0x7fff64f684cc C:\\Windows\\System32\\ntdll.dll!RtlInsertElementGenericTableFullAvl|0x7fff64f63c3c C:\\Windows\\System32\\ntdll.dll!RtlGetFullPathName_UstrEx|0x7fff64fd41ba C:\\Windows\\System32\\ntdll.dll!TpSetWaitEx|0x7fff64fd5180 C:\\Windows\\System32\\ntdll.dll!RtlSetThreadSubProcessTag|0x7fff64fd63c1 C:\\Windows\\System32\\ntdll.dll!RtlSetThreadSubProcessTag|0x7fff62e2e8d7 C:\\Windows\\System32\\kernel32.dll!BaseThreadInitThunk|0x7fff64fec53c C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart",
      "proc": {
        "pid": 1192,
        "tid": 17448,
        "ppid": 16776,
        "name": "VaultCmd.exe",
        "exe": "C:\\WINDOWS\\system32\\VaultCmd.exe",
        "cmdline": "\"C:\\WINDOWS\\system32\\VaultCmd.exe\" \"/listcreds:Windows Credentials\" /all",
        "parent_name": "powershell.exe",
        "parent_cmdline": "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
        "sid": "S-1-5-21-2271034452-2606270099-984871569-1001",
        "username": "archbunny",
        "domain": "OSIRIS",
        "session_id": 1,
        "integrity_level": "HIGH",
        "is_wow64": false,
        "is_packaged": false,
        "is_protected": false,
        "ancestors": [
          "powershell.exe (16776)",
          "WindowsTerminal.exe (6080)",
          "explorer.exe (7688)"
        ]
      }
    }
  ]
}

The event data format in Eventlog Viewer:

Looking good. That fulfills my requirement.

But, the callstack is a bit chunky, a long string (here with inserted newlines):

      "callstack": 
        "0xfffff805ea9e0534 
         C:\\WINDOWS\\system32\\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff805ea8d312d 
         C:\\WINDOWS\\system32\\ntoskrnl.exe!KeAddProcessorAffinityEx+0x74d|0xfffff805ea91d312 
         C:\\WINDOWS\\system32\\ntoskrnl.exe!FsRtlAreNamesEqual+0x5b2|0xfffff805eaf4345e
         ..."

Does the first address have a special purpose? It has no string associated with it. But the thing is parseable if i need to.

To store it a bit more accessible, something like this could be useful, but not mandatory - add it as an array instead of a string:

"callstack": [
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff805ea8d312d"
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!KeAddProcessorAffinityEx+0x74d|0xfffff805ea91d312"
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!FsRtlAreNamesEqual+0x5b2|0xfffff805eaf4345e"
....

Makes sense. I'll nuke the return address from the callstack summary and append each frame as a separate string to the callstack array.

@dobin

@dobin This is the layout of the callstack field after proposed adjustments:

 "callstack": [
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!PsIsThreadTerminating",
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!KeAddProcessorAffinityEx",
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!FsRtlAreNamesEqual",
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!PsAcquireProcessExitSynchronization",
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!PsAcquireProcessExitSynchronization",
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!RtlFreeAnsiString",
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!CcMdlRead",
        "C:\\WINDOWS\\system32\\ntoskrnl.exe!setjmpex",
        "C:\\Windows\\System32\\ntdll.dll!ZwCreateUserProcess",
        "C:\\Windows\\System32\\KernelBase.dll!CreateProcessInternalW",
        "C:\\Windows\\System32\\KernelBase.dll!CreateProcessW",
        "C:\\Windows\\System32\\kernel32.dll!CreateProcessW",
        "C:\\Windows\\System32\\windows.storage.dll!HideExtension",
        "C:\\Windows\\System32\\windows.storage.dll!App_IsLFNAware",
        "C:\\Windows\\System32\\windows.storage.dll!Global_WindowsStorage_csIconCache",
        "C:\\Windows\\System32\\windows.storage.dll!CheckSmartScreenWithAltFile",
        "C:\\Windows\\System32\\windows.storage.dll!CheckSmartScreenWithAltFile",
        "C:\\Windows\\System32\\windows.storage.dll!CheckSmartScreenWithAltFile",
        "C:\\Windows\\System32\\windows.storage.dll!CheckSmartScreenWithAltFile",
        "C:\\Windows\\System32\\windows.storage.dll!CheckSmartScreenWithAltFile",
        "C:\\Windows\\System32\\windows.storage.dll!CViewSettings_CreateInstance",
        "C:\\Windows\\System32\\windows.storage.dll!SHCoCreateInstanceWorker",
        "C:\\Windows\\System32\\shell32.dll!SHAppBarMessage",
        "C:\\Windows\\System32\\shell32.dll!SHAppBarMessage",
        "C:\\Windows\\System32\\shell32.dll!SHCreateDrvExtIcon",
        "C:\\Windows\\System32\\shell32.dll!SHFormatDrive",
        "C:\\Windows\\System32\\windows.storage.dll!ICI2ICIX",
        "C:\\Windows\\System32\\windows.storage.dll!STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage",
        "C:\\Windows\\System32\\windows.storage.dll!STORAGE_CreateStorageItemFromShellItem_FullTrustCaller_ForPackage",
        "C:\\Windows\\System32\\shell32.dll!SHCreateDrvExtIcon",
        "C:\\Windows\\System32\\shell32.dll!SHFormatDrive",
        "C:\\Windows\\System32\\windows.storage.dll!GetSelectionStateFromItemArray",
        "C:\\Windows\\System32\\windows.storage.dll!RealShellExecuteW",
        "C:\\Windows\\System32\\windows.storage.dll!RealShellExecuteW",
        "C:\\Windows\\System32\\windows.storage.dll!CViewSettings_CreateInstance",
        "C:\\Windows\\System32\\windows.storage.dll!CFileOperationRecorder_CreateInstance",
        "C:\\Windows\\System32\\windows.storage.dll!ShellExecuteExW",
        "C:\\Windows\\System32\\Taskbar.dll!?",
        "C:\\Windows\\System32\\Taskbar.dll!?",
        "C:\\Windows\\System32\\Taskbar.dll!?",
        "C:\\Windows\\System32\\Taskbar.dll!DllGetActivationFactory",
        "C:\\Windows\\System32\\SHCore.dll!Ordinal234",
        "C:\\Windows\\System32\\kernel32.dll!BaseThreadInitThunk",
        "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart"
      ],

Hm. I like the previous one more:
C:\\WINDOWS\\system32\\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff805ea8d312d

Even tho the offset / absolute address is rarely used, it does points exactly to the precise address - if someone would want to use it. Only giving the module name is removing "relevant" information.

My issue was with the lonely return address without module, which makes it inconsistent, and makes parsing harder:

      "callstack": 
        "0xfffff805ea9e0534 <-------- no module? 
         C:\\WINDOWS\\system32\\ntoskrnl.exe!PsIsThreadTerminating+0x1f4|0xfffff805ea8d312d 
         C:\\WINDOWS\\system32\\ntoskrnl.exe!KeAddProcessorAffinityEx+0x74d|0xfffff805ea91d312 
         C:\\WINDOWS\\system32\\ntoskrnl.exe!FsRtlAreNamesEqual+0x5b2|0xfffff805eaf4345e
         ..."

Callstack return address is predictable (meaning, it is always present). Unlikely, the offset exists only for kernel addresses. Do you agree if we just add the return address?

The +0x1f4? Could have been useful, but not really for kernel addresses.

Only the return address is good.

@dobin

@dobin Fibratus 3.0.0 has been released with this feature in. Sorry for the delay.

Download: https://fibratus.io/downloads

For documentation purposes, here is the relevant config section:

# =============================== Alert senders ========================================

# Alert senders deal with emitting alerts via different channels.
alertsenders:

  eventlog:
     # Specifies the eventlog record format for the alert. Can be pretty|json
    format: json

Parser updated dobin/DetonatorAgent@ffeacdc

Works very well.

@dobin

@dobin Looks awesome! Thanks for you patience.

Could we use Detonator Agent to improve Fibratus detection blind spots? Like, increasing coverage on techniques malware rely on and Fibratus can't currently detect?

Navigation Menu

Repository navigation

Alerts are hard to parse - change to JSON #564

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Alerts are hard to parse - change to JSON #564

Description

Activity

rabbitstack commented on Jan 14, 2026

dobin commented on Jan 14, 2026

rabbitstack commented on Jan 17, 2026

dobin commented on Jan 17, 2026

rabbitstack commented on Jan 18, 2026

rabbitstack commented on Jan 25, 2026

dobin commented on Jan 26, 2026

rabbitstack commented on Jan 26, 2026

dobin commented on Jan 27, 2026

rabbitstack commented on Apr 22, 2026

dobin commented on Apr 25, 2026

rabbitstack commented on Apr 25, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions