Keylogging (Win32k ETW) API Event metrics

[AsuNa-jp]

Change Summary

Adds new metrics fields for the keylogging events (ETW Win32k API Event provider).

Endpoint.metrics.system_impact.win32k_events.week_idle_ms
Endpoint.metrics.system_impact.win32k_events.week_ms

Release Target

These events are diagnostic in 8.10 and will be released in a future version.

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• If this is a metadata change, I also updated both transform destination schemas to match

[AsuNa-jp]

Hi @parkiino @patrykkopycinski! I think this PR is ready to be merged, but please let me know if I need any modifications or something.

[pzl]

@AsuNa-jp can you please add example values for these new fields to package/endpoint/data_stream/metrics/sample_event.json?

It is run as part of automated testing, equivalent to adding tests for the mapping changes. The document is indexed and verifies that any fields in the sample_event.json has a mapping entry, and that the types match.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-08-04T13:48:45.741+0000

• Duration: 8 min 32 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[AsuNa-jp]

@pzl

It is run as part of automated testing, equivalent to adding tests for the mapping changes.
Thanks for letting me know about above.

I added the nessesary fields and values in the sample_event.json. Furthermore, I also found missing fields and values (the following), so I added these to the sample_event.json too.

• Endpoint.metrics.system_impact.cred_access_events.week_ms
• Endpoint.metrics.system_impact.threat_intelligence_events.week_ms

I think it is now ready to be merged, but if I need any additional fixes, please feel free to let me know.

[pzl]

looks great, thanks for adding that. you're good to merge whenever you're ready

[elasticmachine]

Package endpoint - 8.10.0 containing this change is available at https://epr.elastic.co/search?package=endpoint