Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Windows] Add event.category and event.type to Sysmon Operational #5980

Merged
merged 1 commit into from
Apr 25, 2023

Conversation

kcreddy
Copy link
Contributor

@kcreddy kcreddy commented Apr 24, 2023

What does this PR do?

Adds event.category and event.type to Sysmon Operational pipeline which were missed when new EventIDs were incorporated in #4038

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Related issues

@kcreddy kcreddy self-assigned this Apr 24, 2023
@kcreddy kcreddy added bug Something isn't working Integration:Windows labels Apr 24, 2023
@kcreddy kcreddy force-pushed the 5976-windows_sysmon-add-event-values branch from faf0d68 to 97aa995 Compare April 24, 2023 13:00
@elasticmachine
Copy link

elasticmachine commented Apr 24, 2023

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-04-24T13:01:25.676+0000

  • Duration: 17 min 24 sec

Test stats 🧪

Test Results
Failed 0
Passed 129
Skipped 0
Total 129

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (4/4) 💚
Files 87.5% (7/8) 👎 -12.5
Classes 87.5% (7/8) 👎 -12.5
Methods 83.516% (76/91) 👎 -12.136
Lines 92.803% (5145/5544) 👍 3.141
Conditionals 100.0% (0/0) 💚

@kcreddy kcreddy marked this pull request as ready for review April 24, 2023 13:51
@kcreddy kcreddy requested review from a team as code owners April 24, 2023 13:51
@kcreddy kcreddy requested review from rdner and cmacknz April 24, 2023 13:51
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

Copy link
Contributor

@bhapas bhapas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kcreddy kcreddy merged commit 7bc8e23 into elastic:main Apr 25, 2023
@kcreddy kcreddy deleted the 5976-windows_sysmon-add-event-values branch April 25, 2023 07:18
@elasticmachine
Copy link

Package windows - 1.20.1 containing this change is available at https://epr.elastic.co/search?package=windows

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Integration:Windows
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Windows] Sysmon Operational missing event.category and event.type
3 participants