Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] Improve ECS field mapping for auditd module #16280

Merged
merged 2 commits into from
Feb 14, 2020

Conversation

leehinman
Copy link
Contributor

  • event.kind
  • event.type
  • event.category
  • container.name
  • container.runtime
  • process.args_count
  • process.exit_code
  • process.working_directory

Closes #16153

@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@leehinman leehinman added the needs_backport PR is waiting to be backported to other branches. label Feb 12, 2020
@leehinman leehinman changed the title Improve ECS field mapping for auditd module [Filebeat] Improve ECS field mapping for auditd module Feb 12, 2020
Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice 👍

- event.kind
- event.type
- event.category
- container.name
- container.runtime
- process.args_count
- process.exit_code
- process.working_directory

Closes elastic#16153
@leehinman leehinman merged commit 43463f1 into elastic:master Feb 14, 2020
leehinman added a commit to leehinman/beats that referenced this pull request Feb 14, 2020
* Improve ECS field mapping for auditd module

- event.kind
- event.type
- event.category
- container.name
- container.runtime
- process.args_count
- process.exit_code
- process.working_directory

Closes elastic#16153

(cherry picked from commit 43463f1)
@leehinman leehinman deleted the 16153_audit_ecs_1.4 branch February 14, 2020 21:19
leehinman added a commit that referenced this pull request Feb 19, 2020
* Improve ECS field mapping for auditd module

- event.kind
- event.type
- event.category
- container.name
- container.runtime
- process.args_count
- process.exit_code
- process.working_directory

Closes #16153

(cherry picked from commit 43463f1)
kvch pushed a commit to kvch/beats that referenced this pull request Feb 20, 2020
* Improve ECS field mapping for auditd module

- event.kind
- event.type
- event.category
- container.name
- container.runtime
- process.args_count
- process.exit_code
- process.working_directory

Closes elastic#16153
andrewkroh pushed a commit to andrewkroh/beats that referenced this pull request May 6, 2020
* Improve ECS field mapping for auditd module

- event.kind
- event.type
- event.category
- container.name
- container.runtime
- process.args_count
- process.exit_code
- process.working_directory

Closes elastic#16153

(cherry picked from commit 43463f1)
@andrewkroh andrewkroh added v7.8.0 and removed needs_backport PR is waiting to be backported to other branches. labels May 6, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Filebeat] Upgrade auditd module to ECS 1.4
4 participants