Extend user.name mapping to Windows Integration Package #8289

ChriZzn · 2023-10-25T07:10:58Z

Proposed commit message

Adding EventID 4662 and 5136, to use the 'winlog.event_data.SubjectUserName' as user.name and related.user

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Adding EventID 4662 and 5136, to use the winlog.event_data.SubjectUserName as user.name and related.user

elasticmachine · 2023-10-25T07:14:32Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-11-02T21:57:10.916+0000
Duration: 20 min 22 sec

Test stats 🧪

Test	Results
Failed	0
Passed	305
Skipped	0
Total	305

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

elasticmachine · 2023-10-25T07:24:30Z

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

elasticmachine · 2023-10-25T08:36:19Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

leehinman

you will need to update the version number in packages/windows/manifest.yml as well.

packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/security.yml

ChriZzn · 2023-10-30T12:57:54Z

Any Updates on this?

efd6 · 2023-10-30T20:04:36Z

Sorry this was dropped. Please fix the conflict in the system changelog.

ChriZzn · 2023-10-31T05:52:49Z

Hello, should be resolved now, Regards

efd6 · 2023-10-31T05:53:45Z

/test

efd6

Are you able to provide test cases for this? If not, let me know and I will construct ones from the MS docs (here and here, but real cases would be better).

elasticmachine · 2023-10-31T06:14:17Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`11/11`)	💚
Files	93.75% (`15/16`)	👎 -6.25
Classes	93.75% (`15/16`)	👎 -6.25
Methods	78.302% (`166/212`)	👎 -19.067
Lines	93.783% (`8855/9442`)	👎 -1.644
Conditionals	100.0% (`0/0`)	💚

ChriZzn · 2023-10-31T06:37:24Z

Are you able to provide test cases for this? If not, let me know and I will construct ones from the MS docs (here and here, but real cases would be better).

Hi, im sorry i cant provide you test data, because they are from active environments...

efd6 · 2023-11-01T03:46:12Z

Please apply the this patch file and then resolve the conflicts, 0001-add-tests.patch.

cla-checker-service · 2023-11-01T09:30:42Z

💚 CLA has been signed

ChriZzn · 2023-11-01T09:31:10Z

Hi i applied the patch and resolved the conflicts....

efd6 · 2023-11-01T20:53:20Z

The author you've used to apply the patch is making the CLA checker unhappy. Would you please sign the CLA with that name/email address as well?

ChriZzn · 2023-11-02T07:35:01Z

The author you've used to apply the patch is making the CLA checker unhappy. Would you please sign the CLA with that name/email address as well?

Hi, should be signed now with username 'cw', Regards

efd6 · 2023-11-02T07:40:44Z

It will need to match exactly, including the email address.

ChriZzn · 2023-11-02T10:34:33Z

so

It will need to match exactly, including the email address.

Resigned the CLA, please DM me the email/username combo if there are still Problems

efd6 · 2023-11-02T21:56:56Z

/test

leehinman

LGTM

elasticmachine · 2023-11-05T21:13:13Z

Package system - 1.48.0 containing this change is available at https://epr.elastic.co/search?package=system

elasticmachine · 2023-11-05T21:18:07Z

Package windows - 1.42.0 containing this change is available at https://epr.elastic.co/search?package=windows

ChriZzn added 2 commits October 25, 2023 09:03

add additonal eventid

d4cb7d9

Adding EventID 4662 and 5136, to use the winlog.event_data.SubjectUserName as user.name and related.user

Update changelog.yml

3354fb7

ChriZzn requested review from a team as code owners October 25, 2023 07:10

ChriZzn requested review from rdner and leehinman October 25, 2023 07:10

pierrehilbert added the Team:Elastic-Agent Label for the Agent team label Oct 25, 2023

Update changelog.yml

6728790

jamiehynds added Team:Security-External Integrations Integration:windows Windows and removed Team:Elastic-Agent Label for the Agent team labels Oct 25, 2023

leehinman requested changes Oct 25, 2023

View reviewed changes

packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/security.yml Show resolved Hide resolved

ChriZzn added 2 commits October 25, 2023 16:19

Update standard.yml

64edc0f

Update changelog.yml

82a29a0

ChriZzn requested a review from a team as a code owner October 25, 2023 14:20

ChriZzn added 5 commits October 25, 2023 16:22

Update security.yml

8dbb795

Update manifest.yml

4c91e75

Update manifest.yml

08f8397

Merge branch 'main' into main

2e5f616

Update manifest.yml

80a8eda

pierrehilbert added the Team:Elastic-Agent Label for the Agent team label Oct 25, 2023

rdner removed their request for review October 30, 2023 11:19

ChriZzn added 2 commits October 31, 2023 06:51

Merge branch 'main' into main

f26ff78

Update manifest.yml

b9bca5d

efd6 reviewed Oct 31, 2023

View reviewed changes

ChriZzn and others added 2 commits November 1, 2023 10:29

Merge branch 'main' into main

2af6a24

apply patch

7b8dc5f

Merge branch 'elastic:main' into main

c852b11

efd6 approved these changes Nov 2, 2023

View reviewed changes

efd6 requested a review from leehinman November 2, 2023 22:35

leehinman approved these changes Nov 3, 2023

View reviewed changes

efd6 merged commit 566ecfa into elastic:main Nov 5, 2023
4 checks passed

w0rk3r mentioned this pull request Jul 8, 2024

[Rule Tuning] Fix event.action conditions - AD Rules elastic/detection-rules#3874

Merged

andrewkroh added the Integration:system System label Jul 22, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Extend user.name mapping to Windows Integration Package #8289

Extend user.name mapping to Windows Integration Package #8289

ChriZzn commented Oct 25, 2023 •

edited

Loading

elasticmachine commented Oct 25, 2023 •

edited

Loading

Build stats

Test stats 🧪

elasticmachine commented Oct 25, 2023

elasticmachine commented Oct 25, 2023

leehinman left a comment

ChriZzn commented Oct 30, 2023

efd6 commented Oct 30, 2023

ChriZzn commented Oct 31, 2023

efd6 commented Oct 31, 2023

efd6 left a comment

elasticmachine commented Oct 31, 2023 •

edited

Loading

ChriZzn commented Oct 31, 2023

efd6 commented Nov 1, 2023

cla-checker-service bot commented Nov 1, 2023 •

edited

Loading

ChriZzn commented Nov 1, 2023

efd6 commented Nov 1, 2023

ChriZzn commented Nov 2, 2023

efd6 commented Nov 2, 2023

ChriZzn commented Nov 2, 2023

efd6 commented Nov 2, 2023

leehinman left a comment

elasticmachine commented Nov 5, 2023

elasticmachine commented Nov 5, 2023

Extend user.name mapping to Windows Integration Package #8289

Extend user.name mapping to Windows Integration Package #8289

Conversation

ChriZzn commented Oct 25, 2023 • edited Loading

Proposed commit message

Checklist

elasticmachine commented Oct 25, 2023 • edited Loading

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

elasticmachine commented Oct 25, 2023

elasticmachine commented Oct 25, 2023

leehinman left a comment

Choose a reason for hiding this comment

ChriZzn commented Oct 30, 2023

efd6 commented Oct 30, 2023

ChriZzn commented Oct 31, 2023

efd6 commented Oct 31, 2023

efd6 left a comment

Choose a reason for hiding this comment

elasticmachine commented Oct 31, 2023 • edited Loading

🌐 Coverage report

ChriZzn commented Oct 31, 2023

efd6 commented Nov 1, 2023

cla-checker-service bot commented Nov 1, 2023 • edited Loading

ChriZzn commented Nov 1, 2023

efd6 commented Nov 1, 2023

ChriZzn commented Nov 2, 2023

efd6 commented Nov 2, 2023

ChriZzn commented Nov 2, 2023

efd6 commented Nov 2, 2023

leehinman left a comment

Choose a reason for hiding this comment

elasticmachine commented Nov 5, 2023

elasticmachine commented Nov 5, 2023

ChriZzn commented Oct 25, 2023 •

edited

Loading

elasticmachine commented Oct 25, 2023 •

edited

Loading

elasticmachine commented Oct 31, 2023 •

edited

Loading

cla-checker-service bot commented Nov 1, 2023 •

edited

Loading