Activity data
The following data points are common to various types of different activity. Data points that are specific to a single activity are described in that context.
Activity type (activity)
Indicating what activity is taking place, one of the activity types.
"activity":"SESS_START"
Admin email (adm_email)
Email of the administrator interacting with the Keystrike admin panel.
"adm_email": "[email protected]"
Client ID (cli_id)
A UUID (Universally Unique Identifier), that uniquely identifies a single Keystrike client. A client is unique per user and per device - UUID (user_id, dev_id).
"cli_id": "68eaeb11-477e-53cf-a352-d25edd985362"
Client certificate (cli_cert)
The public key of the client encoded in Z85 format.
"cli_cert": "k)dv*a(FJ/\u003e)41p\u003c\u003c.rKIh)p:jra@s(dSLFF]n*y...."
Client connection ID (cli_conn_id)
The connection ID provides detailed information, for low level forensics and troubleshooting, it has three parts to it, split by a hyphen (-). Client connection ID and Terminator connection ID follow the same principles.
The first part identifies the operating system (e.g. Windows) session, it represents the time this session started, by the Unix epoch (the number of seconds that have elapsed since January 1, 1970).
The second part is a random ID, unique for each run of the KeystrikeClientWorker process that is running.
The third part is a counter of connections made by this run of the KeystrikeClientWorker process, starting at 1 and counting on.
How to interpret:
- If it is exactly the same in two activities, those activities happened in the same connection to the Keystrike Dispatch.
- If only the last, third part is different, it is the same OS session, same run of the KeystrikeClientWorker, but a different connection to Dispatch.
- If only the first part is the same, it is the same OS session, but another run of the KeystrikeClientWorker.
"cli_conn_id": "1715944317_1-zorMqlbqCu-1"
Client status (cli_status)
The client status when the activity is generated.
Device ID (dev_id)
A unique device ID originating from the device running the client or terminator respectively.
"dev_id":"173e340e-9c31-4756-941b-a909412c095e"
Device name (dev_name)
The device name originating from the device running the client or terminator respectively.
"dev_name":"KSTS01"
Entity (entity)
The type of entity being managed in the admin panel. One of the following:
- ADMIN
- INSTALL_TOKEN
- RECOVERY_CODE
- SSO
- TERMINATOR
- TERMINATOR_GROUP
- WEBHOOK
"entity":"ADMIN"
IP address (ip)
The external IP address of the client or terminator that is connecting
"ip": "123.456.58.01"
Node version (node_ver)
The version of the Keystrike client or terminator that is connecting.
"node_ver": "1.0.0"
Operating System (os_name)
The operating system running on the client or terminator in question.
"os_name":"Microsoft Windows Server 2022 Datacenter"
Operating System User ID (os_user_id)
The operating system's ID of the user account, picked up both on client and terminator devices.
For Windows devices this is the Security Identifier (SID), which can either be local to the device if the user is not on domain or from Active Directory for a domain user.
"os_user_id": "S-1-5-21-3623811015-3361044348-30300820-1013"
For Mac and Linux this is in a simpler format e.g.
"os_user_id": "1058"
Remote IP address (remote_ip)
The remote IP address (remote_ip) refers to the IP address of a user or device that is connected to the terminator machine and is triggering the alert
For instance, in the case of an attacker accessing a server via Remote Desktop Protocol (RDP), the remote_ip would be the IP address detected by the server as the origin of the connection. This information can help identify the source of the attack.
However, it's important to note that attackers often use methods such as VPNs or proxies to disguise their actual IP addresses, making it difficult to determine their true location.
"remote_ip": "123.456.58.01"
Remote method (remote_method)
The method or protocol used for remote access.
Typically RDP, but can be e.g. TeamViewer, Splashtop, GoToMyPC
Session ID (sess_id)
A randomly generated string identifying a single session between a client and a terminator.
"sess_id":"q4xmB4BJJ6"
Time (time)
Every line in the activity log starts with a timestamp in ISO 8601 format, e.g.
"time": "2023-11-21T13:19:58Z"
This is a consistent format for dates and times, making it easy to understand and process across different countries and systems.
The format typically looks like "YYYY-MM-DDTHH:MM:SSZ" for Coordinated Universal Time (UTC), where the 'T' separates the date and time, and the 'Z' indicates Zulu time, which is another term for UTC.
Terminator ID (trm_id)
A UUID (Universally Unique Identifier), that uniquely identifies a single Keystrike terminator. A terminator is unique per device and terminator type - UUID (dev_id, trm_type).
"trm_id": "0c074926-402a-593b-9cc6-9e9467eeaec6"
Terminator connection ID (trm_conn_id)
The connection ID provides detailed information, for low level forensics and troubleshooting, it has three parts to it, split by a hyphen (-). Client connection ID and Terminator connection ID follow the same principles.
The first part identifies the operating system (e.g. Windows or Linux) session, it represents the time this session started, by the Unix epoch (the number of seconds that have elapsed since January 1, 1970).
The second part is a random ID, unique for each run of the KeystrikeTerminatorWorker process that is running. One such process is run per user remoting in to the device.
The third part is a counter of connections made by this run of the KeystrikeTerminatorWorker process, starting at 1 and counting on.
How to interpret:
- If it is exactly the same in two activities, those activities happened in the same connection to the Keystrike Dispatch.
- If only the last, third part is different, it is the same OS session, same run of the KeystrikeTerminatorWorker, but a different connection to Dispatch.
- If only the first part is the same, it is the same OS session, but another run of the KeystrikeTerminatorWorker.
"trm_conn_id": "1715967581_2-plnDh2ZzWd-1"
Terminator remote session ID (trm_rmtsess_id)
The remote session ID provides detailed information, for low level forensics and troubleshooting.
It identifies the active remote session, and is in two parts
- First part represents the time this remote session started, by the Unix epoch (the number of seconds that have elapsed since January 1, 1970).
- The second part is a random ID, unique for each TRM_RMTSESS_START activity.
How to interpret:
- If the first part of the trm_conn_id is the same in two activities, but the trm_retsess_id is different - two different remote connections were made into the same OS session.
"trm_rmtsess_id": "1744196758-pk5UxPlMBA"
Terminator status (trm_status)
The terminator's status when the activity is generated.
Terminator type (trm_type)
Depending on the target system's operating environment and the protocol in use, different types of terminators are deployed to protect the target system. This parameter specifies the type of terminator being utilized in the given context.
Currently, the following types of terminators are supported:
- RDS (Remote Desktop Services): For Windows systems, enabling graphical remote desktop connections.
- SSH (Secure Shell): For Linux systems, providing command-line access.
"trm_type": "RDS"
Terminator username (trm_uname)
The local username on the terminator machine. This name is typically the same as the user_id. However if user mapping is involved for this user, the user_id is the mapped version of the terminator username.
"trm_uname": "acme\\johndoe_admin"
User mapping (user_map)
Indicates what type of user mapping was used to map the terminator device user account to a Keystrike client user.
Possible values are
- PREDEFINED - See details on predefined user mapping.
- DIRECT- If no mapping was required, since the user is the same on client and terminator side.
- DYNAMIC - Dynamic user mapping was used. If this is the first connection to this terminator account or it is set to remap on every connection, the mapping window is shown after this activity is recorded, so there is no user_id/uname in the activity.
- NO_MATCH - There is no mapping possible from this terminator user account to a known Keystrike user. In this case there will not be any user_id nor uname in the activity either, and alerts are generated for any user input.
User ID (user_id)
A UUID (Universally Unique Identifier), that uniquely identifies a Keystrike user.
Only end-users of a Keystrike client are registered as Keystrike users.
Indicates what user profile was involved in this activity.
"user_id": "12301e1b-3122-56af-88ad-caea2df60e42"
Username (uname)
The end-users fully qualified username involved in this activity. Username and user ID (above) always come in pairs.
Username is typically in the format userdomain\\username, including double backslash as backslash needs to be escaped out in JSON format.
"uname": "acme\\johndoe"
User status (usr_status)
The user status when the activity is generated.