[Osquery_manager] ARP Cache artifact saved query

[tomsonpl]

ARP Cache Artifact

The ARP (Address Resolution Protocol) Cache artifact provides enriched network neighbor information by combining ARP cache entries with local network interface details. This comprehensive view is essential for investigating network communications, detecting ARP spoofing attacks, and understanding complete source-to-destination network endpoint relationships.

---

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
9	ARP Cache	✅	All	arp_cache_elastic	b2c3d4e5	ARP cache with local interface details (local IP, local MAC). Equivalent to Windows.Network.ArpCache artifact

---

One query works in all platforms

---

🪟 ARP Cache with Local Interface Information

Description

Retrieves enriched ARP cache entries with local interface details including local IP addresses and MAC addresses. Combines ARP cache data with network interface configuration to provide complete neighbor relationship context. This enriched view helps investigate network communications, detect ARP spoofing, and understand both source and destination network endpoints. Equivalent to Windows.Network.ArpCache artifact functionality.

Detection Focus:

• Network neighbor relationships with complete endpoint context
• ARP spoofing detection through comprehensive cache analysis
• Local and remote MAC address correlation
• Network interface to ARP entry mapping
• Persistent vs. active ARP entries identification
• IPv4 and IPv6 neighbor cache monitoring

Result

Returns comprehensive ARP cache entries including:

• Remote IP addresses and MAC addresses
• Local interface IP addresses and MAC addresses
• Interface names for network context
• Entry persistence status (Active/Persistent)
• Address family identification (IPv4/IPv6)

Platform

all

Interval

3600 seconds (1 hour)

Query ID

arp_cache_elastic

ECS Field Mappings

• destination.ip → RemoteAddress
• destination.mac → RemoteMACAddress
• host.ip → LocalAddress
• host.mac → LocalMAC
• network.name → InterfaceName
• network.type → AddressFamily
• tags → Store

SQL Query

-- ARP Cache with Local Interface Information
-- Provides complete network neighbor context by joining ARP cache with interface details
-- Source: arp_cache + interface_details + interface_addresses tables
-- Equivalent to Windows.Network.ArpCache artifact

WITH arp_entries AS (
    SELECT
        a.address AS RemoteAddress,
        a.mac AS RemoteMACAddress,
        a.interface AS InterfaceName,
        CASE
            WHEN a.permanent = '1' THEN 'Persistent'
            ELSE 'Active'
        END AS Store,
        CASE
            WHEN a.address LIKE '%:%' THEN 'ipv6'
            ELSE 'ipv4'
        END AS AddressFamily
    FROM arp_cache a
),
local_interfaces AS (
    SELECT
        id.interface,
        id.mac AS LocalMAC,
        ia.address AS LocalAddress
    FROM interface_details id
    LEFT JOIN interface_addresses ia ON id.interface = ia.interface
    WHERE id.mac IS NOT NULL
        AND ia.address IS NOT NULL
)
SELECT
    ae.RemoteAddress,
    ae.RemoteMACAddress,
    ae.InterfaceName,
    ae.Store,
    ae.AddressFamily,
    li.LocalAddress,
    li.LocalMAC
FROM arp_entries ae
LEFT JOIN local_interfaces li ON ae.InterfaceName = li.interface
ORDER BY ae.InterfaceName, ae.RemoteAddress;

---

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 883a2ea

cc @tomsonpl

[ferullo]

I think you need to consider the address family when joining in the final table. Without the addition I added in this diff I saw two rows for each RemoteAddress, one with the IPv4 LocalAddress for the interface and one with the IPv6 LocalAddress.

WITH arp_entries AS (
 SELECT 
 a.address AS RemoteAddress,
 a.mac AS RemoteMACAddress,
 a.interface AS InterfaceName,

 CASE 
 WHEN a.permanent = '1' THEN 'Persistent'
 ELSE 'Active'
 END AS Store,

 CASE
 WHEN a.address LIKE '%:%' THEN 'ipv6'
 ELSE 'ipv4'
 END AS AddressFamily

 FROM arp_cache a
),
local_interfaces AS (
 SELECT 
 id.interface,
 id.mac AS LocalMAC,
- ia.address AS LocalAddress
+ ia.address AS LocalAddress,
+ CASE
+ WHEN
+ ia.address LIKE '%:%' THEN 'ipv6'
+ ELSE 'ipv4'
 END AS AddressFamily
 FROM interface_details id
 LEFT JOIN interface_addresses ia ON id.interface = ia.interface
 WHERE id.mac IS NOT NULL
 AND ia.address IS NOT NULL
)
SELECT 
 ae.RemoteAddress,
 ae.RemoteMACAddress,
 ae.InterfaceName,
 ae.Store,
 ae.AddressFamily,
 li.LocalAddress,
 li.LocalMAC
FROM arp_entries ae
-LEFT JOIN local_interfaces li ON ae.InterfaceName = li.interface
+LEFT JOIN local_interfaces li ON ae.InterfaceName = li.interface AND ae.AddressFamily = li.AddressFamily
ORDER BY ae.InterfaceName, ae.RemoteAddress

[ferullo]

I think this and host.mac should be source.* fields. host says

ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken.

I typically think of host as information about the collector, not the actual collected data. I wonder what the ECS team thinks?