Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

packages/windows/sysmon_operational: add sysmon event 26 handler #2566

Merged
merged 4 commits into from
Feb 1, 2022
Merged

packages/windows/sysmon_operational: add sysmon event 26 handler #2566

merged 4 commits into from
Feb 1, 2022

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented Jan 25, 2022 •
edited
Loading

What does this PR do?

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

First and third commits are mechanical, second and fourth are semantic.

How to test this PR locally

elastic-package test in the windows package directory.

Related issues

Screenshots

Test event 1:
Screen Shot 2022-01-24 at 15 47 33

Test event 2:
Screen Shot 2022-01-24 at 15 46 54

@elasticmachine
Copy link

elasticmachine commented Jan 25, 2022 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-01-27T06:44:48.377+0000

  • Duration: 19 min 3 sec

  • Commit: 5a7d28f

Test stats 🧪

Test Results
Failed 0
Passed 126
Skipped 0
Total 126

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@marc-gr marc-gr self-requested a review January 26, 2022 10:52
@marc-gr
Copy link
Contributor

marc-gr commented Jan 26, 2022

I think the same change needs to be done in packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/sysmon_operational.yml

@efd6
Copy link
Contributor Author

efd6 commented Jan 26, 2022

PTAL

@efd6 efd6 merged commit 00e134f into elastic:main Feb 1, 2022
@efd6 efd6 deleted the sysmon26 branch February 1, 2022 10:24
eyalkraft pushed a commit to build-security/integrations that referenced this pull request Mar 30, 2022
@efd6
packages/windows/sysmon_operational: add sysmon event 26 handler (ela…
1c17de0 
…stic#2566)

* packages/windows/sysmon_operational: normalise field order and remove event.ingested

* packages/windows/sysmon_operational: add sysmon event 26 handler

* packages/windows/forwarded: normalise field order and remove event.ingested

* packages/windows/forwarded: add sysmon event 26 handler
@andrewkroh andrewkroh mentioned this pull request May 11, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marc-gr marc-gr marc-gr approved these changes

Assignees
No one assigned
Labels
8.1-candidate enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@efd6 @elasticmachine @marc-gr