Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

system,windows: add parent process ID to process creation events #2966

Merged
merged 8 commits into from
Apr 27, 2022
Merged

system,windows: add parent process ID to process creation events #2966

merged 8 commits into from
Apr 27, 2022

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented Apr 1, 2022 •
edited
Loading

What does this PR do?

This adds the parent's process ID to event 4688 on Windows (create process).

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • Review each commit individually for comfort.

How to test this PR locally

This can be tested with elastic-package in the system and windows packages.

Related issues

Screenshots

@efd6 efd6 self-assigned this Apr 1, 2022
@efd6 efd6 requested a review from a team as a code owner April 1, 2022 03:09
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@efd6 efd6 requested a review from a team April 1, 2022 03:10
@elasticmachine
Copy link

elasticmachine commented Apr 1, 2022 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-04-06T02:03:01.112+0000

  • Duration: 15 min 57 sec

Test stats 🧪

Test Results
Failed 0
Passed 396
Skipped 0
Total 396

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@jsoriano jsoriano requested a review from a team April 1, 2022 08:36
@andrewkroh andrewkroh mentioned this pull request Apr 5, 2022
Merged
4 tasks
@andrewkroh
Copy link
Member

@elastic/integrations Can we please get a review on this as it touches both the system and windows integrations.

@jsoriano
Copy link
Member

Can someone from @elastic/elastic-agent-data-plane please take a look to the changes on system and windows integrations?

kaiyan-sheng
kaiyan-sheng approved these changes Apr 27, 2022
View reviewed changes
Copy link
Contributor

@kaiyan-sheng kaiyan-sheng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@efd6 efd6 merged commit 2e413ea into elastic:main Apr 27, 2022
@efd6 efd6 deleted the winppid branch April 27, 2022 22:09
@andrewkroh andrewkroh mentioned this pull request May 11, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@r00tu53r r00tu53r r00tu53r left review comments

@kaiyan-sheng kaiyan-sheng kaiyan-sheng approved these changes

@andrewkroh andrewkroh andrewkroh approved these changes

@cmacknz cmacknz cmacknz approved these changes

Assignees

@efd6 efd6

Labels
enhancement New feature or request Integration:system System Integration:windows Windows
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@efd6 @elasticmachine @andrewkroh @jsoriano @cmacknz @kaiyan-sheng @r00tu53r