-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Winlogbeat] Add registry and code signature information and ECS categorization fields for sysmon module #18058
[Winlogbeat] Add registry and code signature information and ECS categorization fields for sysmon module #18058
Conversation
Pinging @elastic/siem (Team:SIEM) |
💚 Build SucceededExpand to view the summary
Build stats
Test stats 🧪
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ECS categorizations look good to me
@leehinman , 👍 , still need to add some fields for 1.5 compat (i.e. |
5fac323
to
13e8b6b
Compare
ok, feel free to review again, added in code signature and registry info to the fields we ship |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
…gorization fields for sysmon module (elastic#18058) * [Winlogbeat] Add sysmon module ECS categorization fields * Add registry and code signature information * Add changelog entry * Add baseline registry event json (cherry picked from commit eb3c191)
var event3 = new processor.Chain() | ||
.Add(parseUtcTime) | ||
.AddFields({ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Some of these add_fields
processors are missing targets so the fields are being written as fields.event.category
. Maybe we should set target: event
then use fields: {category: ...
.
I deployed the latest snapshot and the data is our siem dev cluster if you want to see it.
Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Related issues