Filebeat auditd: Fix Top Exec Commands dashboard visualization (#27638)

adriansr · web-flow · commit 02315d973c77 · 2021-08-30T15:48:37.000+02:00
This visualization was expecting an uppercase EXECVE value in
event.action while the ingest pipeline was lowercasing this value.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -303,6 +303,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fixes the Snyk module to work with the new API changes. {pull}27358[27358]
 - Fixes a bug in `http_endpoint` that caused numbers encoded as strings. {issue}27382[27382] {pull}27480[27480]
 - Update indentation for azure filebeat configuration. {pull}26604[26604]
+- Auditd: Fix Top Exec Commands dashboard visualization. {pull}27638[27638]
 
 *Heartbeat*
 
diff --git a/filebeat/module/auditd/_meta/kibana/7/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858-ecs.json b/filebeat/module/auditd/_meta/kibana/7/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858-ecs.json
@@ -7,7 +7,7 @@
                 "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index",
                 "query": {
                     "language": "kuery",
-                    "query": "event.action:EXECVE"
+                    "query": "event.action:execve"
                 }
             }
         },

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@`
`7`	`7`	`"indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index",`
`8`	`8`	`"query": {`
`9`	`9`	`"language": "kuery",`
`10`		`- "query": "event.action:EXECVE"`
	`10`	`+ "query": "event.action:execve"`
`11`	`11`	`}`
`12`	`12`	`}`
`13`	`13`	`},`