Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ECS 1.8 session and map user and groups #86

Merged
merged 15 commits into from
Feb 3, 2021
Merged

Add ECS 1.8 session and map user and groups #86

merged 15 commits into from
Feb 3, 2021

Commits on Jan 20, 2021

  1. aucoalesce: ECS user and group mapping 

    Add ECS user and group fields to aucoalesce.Event.

Update normalizations to enable population of ECS user.* and group.*
fields from event data (entity.*, object.*, uids and raw data).

Also refactors the user/group ID lookup as sometimes it's necessary to
lookup a user/group ID from a name.
    @adriansr
    adriansr committed Jan 20, 2021
    Configuration menu
    Copy the full SHA
    91952da View commit details
    Browse the repository at this point in the history

  2. Fix mistake

    @adriansr
    adriansr committed Jan 20, 2021
    Configuration menu
    Copy the full SHA
    1cb7f34 View commit details
    Browse the repository at this point in the history

Commits on Jan 21, 2021

  1. Multi-user support for AUDIT_LOGIN

    @adriansr
    adriansr committed Jan 21, 2021
    Configuration menu
    Copy the full SHA
    6cff2ac View commit details
    Browse the repository at this point in the history

  2. Support AUDIT_LOGIN from kernels <3.14

    @adriansr
    adriansr committed Jan 21, 2021
    Configuration menu
    Copy the full SHA
    2507d6f View commit details
    Browse the repository at this point in the history

  3. Rename actor.* to subject.* to align with normalizations yml

    @adriansr
    adriansr committed Jan 21, 2021
    Configuration menu
    Copy the full SHA
    117b2ab View commit details
    Browse the repository at this point in the history

Commits on Jan 24, 2021

  1. Fix ecs struct encoding and update README samples

    @adriansr
    adriansr committed Jan 24, 2021
    Configuration menu
    Copy the full SHA
    bb3682b View commit details
    Browse the repository at this point in the history

  2. Update ECS reference in README to v1.8

    @adriansr
    adriansr committed Jan 24, 2021
    Configuration menu
    Copy the full SHA
    897c3d4 View commit details
    Browse the repository at this point in the history

  3. Add changelog entry

    @adriansr
    adriansr committed Jan 24, 2021
    Configuration menu
    Copy the full SHA
    2b8c647 View commit details
    Browse the repository at this point in the history

Commits on Jan 25, 2021

  1. Update test files

    @adriansr
    adriansr committed Jan 25, 2021
    Configuration menu
    Copy the full SHA
    e5c1ed2 View commit details
    Browse the repository at this point in the history

  2. Support ECS session category

    @adriansr
    adriansr committed Jan 25, 2021
    Configuration menu
    Copy the full SHA
    61b4ffa View commit details
    Browse the repository at this point in the history

  3. Fix implicit rune to string conversion warning 

    Nit: Fixes an implicit rune to string conversion warning emitted by vet.

There was no bug, but the implicit conversion is deprecated starting in
Go 1.15.

> rule/rule.go:367:29: conversion from untyped int to string yields a string of one rune, not a string of digits (did you mean fmt.Sprint(x)?)
    @adriansr
    adriansr committed Jan 25, 2021
    Configuration menu
    Copy the full SHA
    6e80636 View commit details
    Browse the repository at this point in the history

  4. Update changelog

    @adriansr
    adriansr committed Jan 25, 2021
    Configuration menu
    Copy the full SHA
    8e0720d View commit details
    Browse the repository at this point in the history

Commits on Jan 27, 2021

  1. Add AUDIT_SOFTWARE_UPDATE from filebeat auditd/log

    @adriansr
    adriansr committed Jan 27, 2021
    Configuration menu
    Copy the full SHA
    11ee0db View commit details
    Browse the repository at this point in the history

Commits on Feb 2, 2021

  1. Map to group.* instead of group.target.* 

    group.target is not defined by ECS.
    @adriansr
    adriansr committed Feb 2, 2021
    Configuration menu
    Copy the full SHA
    f3af093 View commit details
    Browse the repository at this point in the history

  2. Update README.md

    @adriansr
    adriansr committed Feb 2, 2021
    Configuration menu
    Copy the full SHA
    9113b6a View commit details
    Browse the repository at this point in the history