Add URL Connection logging ETW provider
Reported by
jness123...@gmail.com,
Feb 27 2018
|
||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.167 Safari/537.36 Steps to reproduce the problem: Feature request: Add a Chrome ETW provider to emit each UI-entered URLs before they get passed down to lower network layers. Windows offers this already for applications that use the built-in WinINet and WebIO libraries but it would be great to get visibility into Chrome as well since it uses its own networking libraries. What is the expected behavior? We would like visibility into every URL fetched by Chrome. In an enterprise environment with a web proxy, it is difficult from an individual instrumented endpoint to discover which URLs are fetched. Logging network connections works ok to get the remote IP address but when a proxy is set the destination IP address is always the proxy, not the real destination address. We build an endpoint detection, response, and forensics product (veramine.com) that attempts to detect and log attacker activity on each host. We can learn a lot about attack behavior from network connection logging but it is difficult to correlate to individual processes in a proxy environment so we would like to have an ETW provider to gain visibility. The WinInet and WebIO ETW providers may provide good examples of the kind of visibility we would like. Here are those GUIDs: GUID MICROSOFT_WINDOWS_WINET = { 0x43d1a55c, 0x76d6, 0x4f7e, { 0x99, 0x5c, 0x64, 0xc7, 0x11, 0xe5, 0xca, 0xfe } }; GUID MICROSOFT_WINDOWS_WEBIO = { 0x50b3e73c, 0x9370, 0x461d,{ 0xbb, 0x9f, 0x26, 0xf3, 0x2d, 0x68, 0x88, 0x7d } }; What went wrong? This is a feature request to provide additional visibility into Chrome behavior. Did this work before? No Chrome version: 64.0.3282.167 Channel: stable OS Version: Windows 7 Flash Version: Bruce Dawson from the Chrome for Windows team suggested that we open this feature request. We would be very grateful for this kind of support from Chrome to provide enterprise customers better visibility into endpoint behavior.
,
Feb 27 2018
Adding a couple of people who have ETW knowledge in Chrome. Context: https://twitter.com/jness/status/968599895950045185
,
Feb 28 2018
As per coment #0, this feature request, hence adding appropriate labels
,
Mar 8 2018
,
Apr 13 2018
,
Aug 3
This bug has an owner, thus, it's been triaged. Changing status to "assigned". |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by jness123...@gmail.com
, Feb 27 2018352 KB
352 KB View Download