sodhikirti07 · Oct 4, 2023 · Jul 28, 2023 · Aug 15, 2023 · Aug 15, 2023 · Aug 16, 2023
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -36,6 +36,7 @@
 /packages/azure_metrics @elastic/obs-cloud-monitoring
 /packages/barracuda @elastic/security-external-integrations
 /packages/barracuda_cloudgen_firewall @elastic/security-external-integrations
+/packages/beaconing @elastic/ml-ui @elastic/sec-applied-ml
 /packages/beat @elastic/infra-monitoring-ui
 /packages/bitdefender @elastic/security-external-integrations
 /packages/bitwarden @elastic/security-external-integrations

@@ -0,0 +1,5 @@
+- version: "1.0.0"
+  changes:
+    - description: Initial release of package (with Serverless support)
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/7418
@@ -0,0 +1,33 @@
+# Network Beaconing Identification
+
+The Network Beaconing Identification package consists of a framework to identify beaconing activity in your environment. The framework surfaces significant indicators of compromise (IoCs) for threat hunters and analysts to use as a starting point for an investigation in addition to helping them monitor network traffic for beaconing activities. 
+This package is licensed under Elastic License 2.0. 
+
+## Installation
+
+You can install the Network Beaconing Identification package via **Management > Integrations > Network Beaconing Identification**.
+
+To inspect the installed assets, you can navigate to **Stack Management > Data > Transforms**.
+
+| Transform name            | Purpose| 	Source index  | Destination index       | Alias |
+|---------------------------|--------|----------------|-------------------------|------------|
+| beaconing.pivot_transform |	Flags beaconing activity in your environment| 	logs-*        | 	ml_beaconing-[version] | ml_beaconing.all |
+
+For additional information on the transform's inner workings and the signals it generates, refer to [this blog post](https://www.elastic.co/security-labs/identifying-beaconing-malware-using-elastic).
+
+**Note**: When querying the destination index to enquire about beaconing activities, we advise using the alias for the destination index (`ml_beaconing.all`). In the event that the underlying package is upgraded, the alias will aid in maintaining the previous findings.
+
+## Dashboards
+
+The **Network Beaconing Identification** has three dashboards: 
+* **Network Beaconing**: The main dashboard to monitor beaconing activity
+* **Beaconing Drilldown**: Drilldown into relevant event logs and some statistics related to the beaconing activity
+* **Hosts Affected Over Time By Process Name**: Monitor the spread of beaconing processes across hosts in your environment
+
+For the dashboards to work as expected, the following settings need to be configured in Kibana. 
+1. Ensure the pivot transform is installed and running.
+2. Go to **Management > Stack Management > Kibana > Data Views**. Click on **Create data view** button and enable **Allow hidden and system indices** under the **Show Advanced settings**.
+3. Create a data view with the following settings:
+    - Index pattern : `ml_beaconing.all`
+    - Name: `ml_beaconing`
+    - Custom data view ID: `ml_beaconing`
@@ -0,0 +1,8 @@
+---
+processors:
+  - fingerprint:
+      fields:
+        - '@timestamp'
+        - _id
+      method: SHA-256
+      target_field: _id
@@ -0,0 +1,46 @@
+- name: host.name
+  type: keyword
+- name: process.name
+  type: keyword
+- name: beacon_stats.autocovariance
+  type: float
+- name: beacon_stats.beaconing_score
+  type: long
+- name: beacon_stats.counts_percentiles
+  type: float
+- name: beacon_stats.destination_bytes_percentiles
+  type: float
+- name: beacon_stats.destination_ips
+  type: keyword
+- name: beacon_stats.interval
+  type: long
+- name: beacon_stats.is_beaconing
+  type: boolean
+- name: beacon_stats.low_count_variation
+  type: boolean
+- name: beacon_stats.low_destination_bytes_variation
+  type: boolean
+- name: beacon_stats.low_source_bytes_variation
+  type: boolean
+- name: beacon_stats.max_autocovariance_period
+  type: long
+- name: beacon_stats.mean_counts
+  type: float
+- name: beacon_stats.mean_destination_bytes
+  type: float
+- name: beacon_stats.mean_source_bytes
+  type: float
+- name: beacon_stats.non_empty_buckets
+  type: long
+- name: beacon_stats.periodic
+  type: boolean
+- name: beacon_stats.source_bytes_percentiles
+  type: float
+- name: beacon_stats.std_dev_destination_bytes
+  type: float
+- name: beacon_stats.std_dev_source_bytes
+  type: float
+- name: beacon_stats.variance_counts
+  type: float
+- name: '@timestamp'
+  type: date