Add event IDs 4797, 5379, 5380, 5381, and 5382 #34294

MakoWish · 2023-01-17T19:11:44Z

Type of change

Enhancement

What does this PR do?

This PR adds event parsing to the Security Ingest Pipeline for Winlogbeat for Event ID's 4797, 5379, 5380, 5381, and 5382.

Why is it important?

These Event ID's are quite common in our environment, so ensuring the correct event.action is populated will help identify the nature of the event at a quick glance.

Checklist

I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

Closes Missing Parsing for Event IDs 4797, 5379, 5380, 5381, and 5382 #34293

mergify · 2023-01-17T19:12:19Z

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @MakoWish? 🙏.
For such, you'll need to label your PR with:

The upcoming major version of the Elastic Stack
The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

elasticmachine · 2023-01-17T19:16:50Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-01-19T21:10:56.228+0000
Duration: 39 min 59 sec

Test stats 🧪

Test	Results
Failed	0
Passed	336
Skipped	0
Total	336

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

elasticmachine · 2023-01-17T21:19:26Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

efd6 · 2023-01-17T21:19:36Z

/test

efd6

Are you able to provide events (as individual evtx) for these event types?

MakoWish · 2023-01-17T22:28:13Z

I was able to grab some of them, but they contain sensitive usernames, hostnames, etc. Do you have a location I can send them to you out of the public eye?

efd6 · 2023-01-17T22:46:40Z

I think we could get around needing the evtx if we start from the XML by exporting this from the event viewer. This would mean that we can include the data in the tree without leaking your secrets if you scrub before letting us have the data. Does that sound reasonable to you?

MakoWish · 2023-01-17T23:16:54Z

Attaching five scrubbed sample events for each of the Event ID's.
4797_5379_5380_5381_5382.zip

MakoWish · 2023-01-17T23:57:03Z

Can we back-port this?

efd6 · 2023-01-18T01:27:14Z

This is an enhancement, so we will not back-port.

Tests cases mechanically derived from user-provided XML scrubbed event data.

efd6 · 2023-01-18T03:04:39Z

It looks like there needs to be some additional changes to make sure that things like related.host and related.user are properly updated for these event types. There are hooks in the security.yml file that allow this to be done by adding the appropriate event ID to the filter array.

efd6 · 2023-01-18T03:04:44Z

/test

…o add_event_ids

MakoWish · 2023-01-18T16:32:50Z

I don't see any processors that would add related.hosts, so I just focused on those that would add to related.user.

efd6 · 2023-01-18T23:41:26Z

/test

efd6 · 2023-01-18T23:52:58Z

/test

efd6 · 2023-01-19T00:52:20Z

x-pack/winlogbeat/module/security/ingest/security.yml

@@ -2604,7 +2639,7 @@ processors:
              "4750", "4751", "4752", "4753", "4754", "4755", "4756", "4757",
              "4758", "4759", "4760", "4761", "4762", "4763", "4764", "4767",
              "4781", "4798", "4799", "4817", "4904", "4905", "4907", "4912",
-              "4648"].contains(ctx.event.code)) {
+              "4648", "4797"].contains(ctx.event.code)) {


Is there a reason not to include the other types here? They also appear to have SubjectUserName fields.

There was not. I had added them to the related user appending, but I forgot to add them to "Copy Subject User from Event Data" script. Since event 4797 also has a TargetUserName, I also just added that one to the "Copy Target User to Target" script.

mergify · 2023-01-19T02:05:22Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b add_event_ids upstream/add_event_ids
git merge upstream/main
git push upstream add_event_ids

…o add_event_ids

efd6 · 2023-01-19T21:09:39Z

/test

efd6

Thanks

jamiehynds · 2023-01-23T18:21:51Z

@efd6 could mappings for these events be applied to the system.security pipeline for agent, to ensure alignment between the winlogbeat and agent pipelines?

MakoWish · 2023-01-23T19:48:49Z

@jamiehynds , please see #5085 that mirrors these changes to the Security Integration for Elastic Agent.

jamiehynds · 2023-01-24T09:33:46Z

Thanks @MakoWish, I missed that one. Thanks for all your recent contributions and collaboration!

MakoWish · 2023-01-24T15:38:52Z

Thanks @MakoWish, I missed that one.

Didn't miss it. I created it after your comment. 👍

Tests cases mechanically derived from user-provided XML scrubbed event data. Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

MakoWish added 2 commits January 17, 2023 12:03

Add event IDs 4797, 5379, 5380, 5381, and 5382

42814f7

Add event IDs 4797, 5379, 5380, 5381, and 5382

b141ece

MakoWish requested a review from a team as a code owner January 17, 2023 19:11

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jan 17, 2023

mergify bot assigned MakoWish Jan 17, 2023

efd6 added enhancement Winlogbeat Team:Security-External Integrations backport-skip Skip notification from the automated backport with mergify 8.7-candidate labels Jan 17, 2023

botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jan 17, 2023

efd6 reviewed Jan 17, 2023

View reviewed changes

add tests cases for new event types

b33cbc7

Tests cases mechanically derived from user-provided XML scrubbed event data.

MakoWish added 2 commits January 18, 2023 09:22

Add processing for event IDs 4797, 5379, 5380, 5381, and 5382

5eac7eb

Merge branch 'add_event_ids' of https://github.com/MakoWish/beats int…

f8c7830

…o add_event_ids

MakoWish and others added 2 commits January 18, 2023 09:40

Merge branch 'elastic:main' into add_event_ids

26e97f7

update test expectations

f4c943a

fix permission change on security.yml

97ef06b

efd6 reviewed Jan 19, 2023

View reviewed changes

MakoWish and others added 5 commits January 19, 2023 08:55

Add processing for event IDs 4797, 5379, 5380, 5381, and 5382

e7ce24c

Merge branch 'add_event_ids' of https://github.com/MakoWish/beats int…

5535cb0

…o add_event_ids

Merge branch 'master' into add_event_ids

9a2d15d

fix changelog order and references

4765a84

regenerate test expectations

ff19603

efd6 approved these changes Jan 19, 2023

View reviewed changes

efd6 merged commit de99256 into elastic:main Jan 19, 2023

MakoWish mentioned this pull request Jan 23, 2023

[System] Add processing for event ID's 4797, 5379, 5380, 5381, and 5382 elastic/integrations#5085

Closed

MakoWish mentioned this pull request Jan 23, 2023

Add processing of event ID's 5140 and 5145 to mirror Elastic Agent's … #34352

Merged

1 task

efd6 mentioned this pull request Jan 24, 2023

system/security: add mapping for Windows events 4797, 5379, 5380, 5381, and 5382 elastic/integrations#5087

Merged

4 tasks

chrisberkhout pushed a commit that referenced this pull request Jun 1, 2023

Add event IDs 4797, 5379, 5380, 5381, and 5382 (#34294)

cefc4aa

Tests cases mechanically derived from user-provided XML scrubbed event data. Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add event IDs 4797, 5379, 5380, 5381, and 5382 #34294

Add event IDs 4797, 5379, 5380, 5381, and 5382 #34294

MakoWish commented Jan 17, 2023 •

edited

Loading

mergify bot commented Jan 17, 2023

elasticmachine commented Jan 17, 2023 •

edited by jenkins-beats-ci bot

Loading

Build stats

Test stats 🧪

elasticmachine commented Jan 17, 2023

efd6 commented Jan 17, 2023

efd6 left a comment

MakoWish commented Jan 17, 2023

efd6 commented Jan 17, 2023

MakoWish commented Jan 17, 2023

MakoWish commented Jan 17, 2023

efd6 commented Jan 18, 2023

efd6 commented Jan 18, 2023

efd6 commented Jan 18, 2023

MakoWish commented Jan 18, 2023

efd6 commented Jan 18, 2023

efd6 commented Jan 18, 2023

efd6 Jan 19, 2023

MakoWish Jan 19, 2023

mergify bot commented Jan 19, 2023

efd6 commented Jan 19, 2023

efd6 left a comment

jamiehynds commented Jan 23, 2023

MakoWish commented Jan 23, 2023

jamiehynds commented Jan 24, 2023

MakoWish commented Jan 24, 2023

Add event IDs 4797, 5379, 5380, 5381, and 5382 #34294

Add event IDs 4797, 5379, 5380, 5381, and 5382 #34294

Conversation

MakoWish commented Jan 17, 2023 • edited Loading

Type of change

What does this PR do?

Why is it important?

Checklist

Related issues

mergify bot commented Jan 17, 2023

elasticmachine commented Jan 17, 2023 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

🤖 GitHub comments

elasticmachine commented Jan 17, 2023

efd6 commented Jan 17, 2023

efd6 left a comment

Choose a reason for hiding this comment

MakoWish commented Jan 17, 2023

efd6 commented Jan 17, 2023

MakoWish commented Jan 17, 2023

MakoWish commented Jan 17, 2023

efd6 commented Jan 18, 2023

efd6 commented Jan 18, 2023

efd6 commented Jan 18, 2023

MakoWish commented Jan 18, 2023

efd6 commented Jan 18, 2023

efd6 commented Jan 18, 2023

efd6 Jan 19, 2023

Choose a reason for hiding this comment

MakoWish Jan 19, 2023

Choose a reason for hiding this comment

mergify bot commented Jan 19, 2023

efd6 commented Jan 19, 2023

efd6 left a comment

Choose a reason for hiding this comment

jamiehynds commented Jan 23, 2023

MakoWish commented Jan 23, 2023

jamiehynds commented Jan 24, 2023

MakoWish commented Jan 24, 2023

MakoWish commented Jan 17, 2023 •

edited

Loading

elasticmachine commented Jan 17, 2023 •

edited by jenkins-beats-ci bot

Loading