x-pack/winlogbeat: fix Kerberos ticket StatusDescription case-sensitivity - #51681
Conversation
…line winlog.event_data.Status is matched case-sensitively against a lookup table whose hex keys are all upper case (e.g. 0x1B), so a lower-case value like 0x1b silently fails to resolve StatusDescription. Normalize the lookup with toUpperCase(), mirroring how TicketEncryptionType is already normalized a few processors above. Reported in elastic/sdh-beats#7310
botelastic
Bot
added
the
needs_team
|
This pull request doesn't have a |
🤖 GitHub commentsJust comment with:
|
|
This pull request does not have a backport label.
To fixup this pull request, you need to add the backport labels for the needed
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis change updates the winlogbeat Security ingest pipeline so Kerberos ticket status descriptions are looked up using a normalized ChangesRelated issues: 1782933214 Related PRs: None provided Suggested labels: bug-fix, winlogbeat, changelog Suggested reviewers: winlogbeat module maintainers Sequence Diagram(s)Not applicable. Poem: 🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@x-pack/winlogbeat/module/security/ingest/security_standard.yml`:
- Line 1056: The StatusDescription lookup in the security_standard ingest script
is using `ctx.winlog.event_data.Status.toUpperCase()`, which changes the `0x`
prefix and prevents matching the `params` keys. Update the `StatusDescription`
assignment to normalize the key the same way as the existing
`TicketEncryptionType` handling in this pipeline, or explicitly preserve the
`0x` prefix while uppercasing only the suffix, so the lookup resolves correctly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: f1c575e9-0320-441c-af64-34581a60a33e
📒 Files selected for processing (2)
changelog/fragments/1782933214-fix-kerberos-status-description-case-sensitivity.yamlx-pack/winlogbeat/module/security/ingest/security_standard.yml
The previous fix uppercased the entire Status string, turning "0x1b" into "0X1B" and "0x0" into "0X0" -- neither matches the params table, whose keys use a lowercase "0x" prefix. Preserve the prefix and uppercase only the hex digits after it.
|
Queued — the merge queue status continues in this comment ↓. |
Merge Queue Status
This pull request spent 47 minutes 25 seconds in the queue, including 46 minutes 28 seconds running CI. Required conditions to merge
|
2 participants
Summary
winlog.event_data.Statusis matched case-sensitively against the Kerberos status code lookup table. Every key with a hex letter is upper case (e.g.0x1B), so a lower-case value like0x1bfails to match andStatusDescriptionis left null..toUpperCase(), mirroring how the neighboringTicketEncryptionTypeprocessor already normalizes case.Reported by a customer in https://github.com/elastic/sdh-beats/issues/7310. The same processor logic is duplicated in
elastic/integrations(systemandwindowspackages); a companion fix is up at elastic/integrations#19919.Test plan
Statusis0x1b(lower case) now populatesStatusDescriptionasKDC_ERR_MUST_USE_USER2USER.Note: I was not able to add a new golden-file regression test for the lower-case case, since the existing tests in
x-pack/winlogbeat/module/security/test/testdata/are driven by binary.evtxfixtures that I don't have tooling to generate here.