[microsoft_dhcp] Add event.reason (long descriptions) to each event (DHCPv4) #7100

nicpenning · 2023-07-21T15:49:21Z

Enhancement

What does this PR do?

This will add the Meaning that is found in the DHCPv4 logs into event.reason as follows:

Event ID Meaning
00 The log was started.
01 The log was stopped.
02 The log was temporarily paused due to low disk space.
10 A new IP address was leased to a client.
11 A lease was renewed by a client.
12 A lease was released by a client.
13 An IP address was found to be in use on the network.
14 A lease request could not be satisfied because the scope's address pool was exhausted.
15 A lease was denied.
16 A lease was deleted.
17 A lease was expired and DNS records for an expired leases have not been deleted.
18 A lease was expired and DNS records were deleted.
20 A BOOTP address was leased to a client.
21 A dynamic BOOTP address was leased to a client.
22 A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted.
23 A BOOTP IP address was deleted after checking to see it was not in use.
24 IP address cleanup operation has began.
25 IP address cleanup statistics.
30 DNS update request to the named DNS server.
31 DNS update failed.
32 DNS update successful.
33 Packet dropped due to NAP policy.
34 DNS update request failed.as the DNS update request queue limit exceeded.
35 DNS update request failed.
36 Packet dropped because the server is in failover standby role or the hash of the client ID does not match.
50+ Codes above 50 are used for Rogue Server Detection information.

The 50+ event code descriptions are found here: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd183591(v=ws.10)#dhcp-server-logs-server-authorization-events

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

elasticmachine · 2023-07-21T15:52:59Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-07-31T19:35:45.575+0000
Duration: 15 min 57 sec

Test stats 🧪

Test	Results
Failed	0
Passed	6
Skipped	0
Total	6

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

efd6 · 2023-07-23T21:57:27Z

/test

efd6 · 2023-07-23T21:59:06Z

For the commit message, can you provide a link for the messages that are below 50? Up-page of the link provided, there are some of them listed, but not the entirety. Do MS have a single canonical location for these details?

elasticmachine · 2023-07-23T22:12:44Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`1/1`)	💚
Files	100.0% (`3/3`)	💚
Classes	100.0% (`3/3`)	💚
Methods	100.0% (`24/24`)	💚
Lines	98.69% (`678/687`)	❕
Conditionals	100.0% (`0/0`)	💚

nicpenning · 2023-07-23T23:03:29Z

For the commit message, can you provide a link for the messages that are below 50? Up-page of the link provided, there are some of them listed, but not the entirety. Do MS have a single canonical location for these details?

Interestingly enough, I could not find an extensive list from Microsoft. The full list lives in the eventog itself at the beginning of each log file when they get created each day.

Does that help?

efd6 · 2023-07-24T00:21:09Z

Thanks, Nic. Yes that will do for the commit message. I'm surprised that Microsoft don't provide adequate documentation.

nicpenning · 2023-07-24T00:52:45Z

No problem. I tried to find it on their GitHub docs but these docs are fairly old and haven't made it to GH. If I ever do find it I will report accordingly.

efd6

Minor nit then LGTM

packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-log.log-expected.json

packages/microsoft_dhcp/data_stream/log/sample_event.json

nicpenning · 2023-07-24T02:14:07Z

Sounds good. I appreciate your thoroughness!

nicpenning · 2023-07-24T16:42:06Z

Anything else needed for this to be merged?

nicpenning · 2023-07-26T20:06:40Z

I fixed the merge conflicts. Can someone please review? Thanks!

packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-log.log-expected.json

packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcp.yml

andrewkroh · 2023-07-26T21:17:04Z

/test

nicpenning · 2023-07-29T04:47:20Z

Any last items on this? I think we are close.

nicpenning · 2023-07-31T15:19:07Z

👀 - I had to bump the version again because other changes were made. Could this please be review again? Thanks!

andrewkroh · 2023-07-31T19:35:33Z

/test

elasticmachine · 2023-07-31T19:54:20Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

elasticmachine · 2023-07-31T20:20:46Z

Package microsoft_dhcp - 1.17.0 containing this change is available at https://epr.elastic.co/search?package=microsoft_dhcp

nicpenning added 5 commits July 21, 2023 10:42

Update sample_event.json

79402db

Update test-log.log-expected.json

8acfde1

Update dhcp.yml

0320895

Update ecs.yml

c2f3c9c

Update README.md

5fa44fc

nicpenning requested a review from a team as a code owner July 21, 2023 15:49

nicpenning added 2 commits July 21, 2023 10:50

Update changelog.yml

bbb46ff

Update manifest.yml

adaec4d

nicpenning changed the title ~~[microsoft_dhcp] Add event.reason (long descriptions) to each event DHCPv4~~ [microsoft_dhcp] Add event.reason (long descriptions) to each event (DHCPv4) Jul 21, 2023

efd6 reviewed Jul 24, 2023

View reviewed changes

packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-log.log-expected.json Outdated Show resolved Hide resolved

packages/microsoft_dhcp/data_stream/log/sample_event.json Show resolved Hide resolved

nicpenning added 3 commits July 26, 2023 14:56

Update changelog.yml

178a334

Merge branch 'main' into dhcp-descriptions

dcd04d0

update pipeline

bf4c435

andrewkroh reviewed Jul 26, 2023

View reviewed changes

packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-log.log-expected.json Outdated Show resolved Hide resolved

andrewkroh reviewed Jul 26, 2023

View reviewed changes

packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcp.yml Outdated Show resolved Hide resolved

nicpenning added 2 commits July 31, 2023 10:30

Merge branch 'main' into dhcp-descriptions

6ba37e3

Update manifest.yml

4d9ec9e

andrewkroh approved these changes Jul 31, 2023

View reviewed changes

andrewkroh added Team:Security-External Integrations Integration:microsoft_dhcp Microsoft DHCP labels Jul 31, 2023

andrewkroh merged commit 7840448 into elastic:main Jul 31, 2023
1 check passed

nicpenning deleted the dhcp-descriptions branch August 1, 2023 15:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[microsoft_dhcp] Add event.reason (long descriptions) to each event (DHCPv4) #7100

[microsoft_dhcp] Add event.reason (long descriptions) to each event (DHCPv4) #7100

nicpenning commented Jul 21, 2023

elasticmachine commented Jul 21, 2023 •

edited

Loading

Build stats

Test stats 🧪

efd6 commented Jul 23, 2023

efd6 commented Jul 23, 2023

elasticmachine commented Jul 23, 2023 •

edited

Loading

nicpenning commented Jul 23, 2023

efd6 commented Jul 24, 2023

nicpenning commented Jul 24, 2023

efd6 left a comment

nicpenning commented Jul 24, 2023

nicpenning commented Jul 24, 2023

nicpenning commented Jul 26, 2023

andrewkroh commented Jul 26, 2023

nicpenning commented Jul 29, 2023

nicpenning commented Jul 31, 2023 •

edited

Loading

andrewkroh commented Jul 31, 2023

elasticmachine commented Jul 31, 2023

elasticmachine commented Jul 31, 2023

[microsoft_dhcp] Add event.reason (long descriptions) to each event (DHCPv4) #7100

[microsoft_dhcp] Add event.reason (long descriptions) to each event (DHCPv4) #7100

Conversation

nicpenning commented Jul 21, 2023

What does this PR do?

Checklist

elasticmachine commented Jul 21, 2023 • edited Loading

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

efd6 commented Jul 23, 2023

efd6 commented Jul 23, 2023

elasticmachine commented Jul 23, 2023 • edited Loading

🌐 Coverage report

nicpenning commented Jul 23, 2023

efd6 commented Jul 24, 2023

nicpenning commented Jul 24, 2023

efd6 left a comment

Choose a reason for hiding this comment

nicpenning commented Jul 24, 2023

nicpenning commented Jul 24, 2023

nicpenning commented Jul 26, 2023

andrewkroh commented Jul 26, 2023

nicpenning commented Jul 29, 2023

nicpenning commented Jul 31, 2023 • edited Loading

andrewkroh commented Jul 31, 2023

elasticmachine commented Jul 31, 2023

elasticmachine commented Jul 31, 2023

elasticmachine commented Jul 21, 2023 •

edited

Loading

elasticmachine commented Jul 23, 2023 •

edited

Loading

nicpenning commented Jul 31, 2023 •

edited

Loading