Winlogbeat: Experimental API support missing event data types

[theodiefenthal]

With the experimental API, the winlog renderer currently supports 19 EventData data types, whereas MS spec lists 24 types: https://docs.microsoft.com/de-de/windows/win32/api/winevt/ne-winevt-evt_variant_type

The missing ones are:

- EvtVarTypeAnsiString 	A null-terminated ANSI string.
- EvtVarTypeBinary 	A hexadecimal binary value.
- EvtVarTypeSizeT 	An unsigned 32-bit or 64-bit integer value that contains a pointer address.
- EvtVarTypeSysTime 	A SYSTEMTIME value.
- EvtVarTypeEvtXml 	A null-terminated Unicode string that contains XML.

It would be great to support those as well. I'm currently stuck with a local (unimportant) event containing binary data but expect further issues with Windows security events 4698-4702. I currently don't have one on my dev machine, but they contain a data field in XML (TaskContentNew) which I expect is also not parseable as data attribute in the current version but holds important data within the XML.

Here is the unimportant event with the EvtVarTypeBinary attribute, collected with the stable API into kafka:

{
  "@timestamp": "2020-06-07T23:12:13.205Z",
  "@metadata": {
    "beat": "winlogbeat",
    "type": "_doc",
    "version": "7.2.0",
    "topic": "winevents"
  },
  "event": {
    "original": "\u003cEvent xmlns\u003d\u0027http://schemas.microsoft.com/win/2004/08/events/event\u0027\u003e\u003cSystem\u003e\u003cProvider Name\u003d\u0027dokan1\u0027/\u003e\u003cEventID Qualifiers\u003d\u002716390\u0027\u003e1\u003c/EventID\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e0\u003c/Task\u003e\u003cKeywords\u003e0x80000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime\u003d\u00272020-06-07T23:12:13.205194300Z\u0027/\u003e\u003cEventRecordID\u003e637256\u003c/EventRecordID\u003e\u003cChannel\u003eSystem\u003c/Channel\u003e\u003cComputer\u003eTheo\u003c/Computer\u003e\u003cSecurity/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData\u003e\u003c/Data\u003e\u003cData\u003eMounting disk device.\u003c/Data\u003e\u003cBinary\0D000030000028003000040001000140000000050000000700000000000000000003000000000000\u003c/Binary\u003e\u003c/EventData\u003e\u003cRenderingInfo Culture\u003d\u0027de-DE\u0027\u003e\u003cMessage\u003eMounting disk device.\u003c/Message\u003e\u003cLevel\u003eInformationen\u003c/Level\u003e\u003cTask\u003e\u003c/Task\u003e\u003cOpcode\u003e\u003c/Opcode\u003e\u003cChannel\u003e\u003c/Channel\u003e\u003cProvider\u003e\u003c/Provider\u003e\u003cKeywords\u003e\u003cKeyword\u003eKlassisch\u003c/Keyword\u003e\u003c/Keywords\u003e\u003c/RenderingInfo\u003e\u003c/Event\u003e",
    "kind": "event",
    "code": 1,
    "created": "2020-06-23T16:22:18.669Z"
  },
  "log": {
    "level": "informationen"
  },
  "message": "Mounting disk device.",
  "ecs": {
    "version": "1.0.0"
  },
  "host": {
    "name": "Theo",
    "hostname": "Theo",
    "architecture": "x86_64",
    "os": {
      "kernel": "10.0.18362.900 (WinBuild.160101.0800)",
      "build": "18363.900",
      "platform": "windows",
      "version": "10.0",
      "family": "windows",
      "name": "Windows 10 Pro"
    },
    "id": "doesItMatter"
  },
  "agent": {
    "version": "7.2.0",
    "type": "winlogbeat",
    "ephemeral_id": "doesItMatter",
    "hostname": "Theo",
    "id": "doesItMatter"
  },
  "winlog": {
    "keywords": [
      "Klassisch"
    ],
    "channel": "System",
    "task": "",
    "api": "wineventlog",
    "event_data": {
      "param2": "Mounting disk device.",
      "Binary": "0D000030000028003000040001000140000000050000000700000000000000000003000000000000"
    },
    "provider_name": "dokan1",
    "computer_name": "Theo",
    "record_id": 637256,
    "event_id": 1
  }
}

Guess its from either Cryptomator or from VeraCrypt on my computer.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[andrewkroh]

Good catch, we'll definitely need to add those types so those fields are not dropped. And we'll want to add some evtx test files that contain those variant types.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)