Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cherry-pick #18012 to 7.x: [Auditbeat] File Integrity ECS update #18267

Merged
merged 2 commits into from
May 5, 2020
Merged

Cherry-pick #18012 to 7.x: [Auditbeat] File Integrity ECS update #18267

merged 2 commits into from
May 5, 2020

Conversation

andrewstucki
Copy link
Contributor

@andrewstucki andrewstucki commented May 5, 2020 •
edited by zube bot
Loading

Cherry-pick of PR #18012 to 7.x branch. Original message:

What does this PR do?

Updates ECS fields to be 1.5 (categorization) compatible. It also adds some basic mime-type detection for the given files and a couple of fields that we could have shipped previously.

So, added fields:

  • event.kind
  • event.category
  • event.type
  • file.mime_type
  • file.extension
  • file.drive_letter

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

[Auditbeat] File Integrity ECS update (elastic#18012)
50b424e 
* Add extension, mime_type and drive_letter

* run go mod vendor

* Add ECS categorization fields

* mage fmt

* Update hash and NOTICE

* Update test

* Run mage vendor

* Add changelog entry

* Extract isASCIILetter

* switch over to godoc style comment

(cherry picked from commit 56ba9d0)
@andrewstucki andrewstucki requested a review from a team as a code owner May 5, 2020 19:33
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 5, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@andrewstucki andrewstucki removed the needs_team Indicates that the issue/PR needs a Team:* label label May 5, 2020
@elasticmachine
Copy link
Collaborator

elasticmachine commented May 5, 2020 •
edited
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview stats

Expand to view the summary

Build stats

Test stats 🧪

Test Results
Failed 0
Passed 5877
Skipped 891
Total 6768

@andrewstucki andrewstucki merged commit f58b33c into elastic:7.x May 5, 2020
@andrewstucki andrewstucki deleted the backport_18012_7.x branch May 5, 2020 23:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@leehinman leehinman leehinman approved these changes

Assignees
No one assigned
Labels
backport review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@andrewstucki @elasticmachine @leehinman