Skip to content

Commit 04ce8a5

Browse files
jannitenadriansrmarc-gr
authored
[Winlogbeat] ECS 1.9 user.changes.*, user.effective.*, user.target.* (#26509)
* Add Winlogbeat Security Module Doc * ECS 1.9 new user fields * Add Documentation * Update x-pack/winlogbeat/module/security/config/winlogbeat-security.js Co-authored-by: Adrian Serrano <adrisr83@gmail.com> * Update x-pack/winlogbeat/module/security/config/winlogbeat-security.js Co-authored-by: Adrian Serrano <adrisr83@gmail.com> * Suggeted changes by adriansr * Regenerate golden files * Fix changelog and remove ~/go/src/github.com/elastic/integrations/packages/cisco_meraki values * Fix typo * Regenerate test files * Check for empty values on target user Co-authored-by: Adrian Serrano <adrisr83@gmail.com> Co-authored-by: Marc Guasch <marc.guasch@elastic.co>
1 parent e6de79f commit 04ce8a5

28 files changed

Lines changed: 217 additions & 35 deletions

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -449,6 +449,7 @@ for a few releases. Please use other tools provided by Elastic to fetch data fro
449449
- Protect against accessing undefined variables in Sysmon module. {issue}22219[22219] {pull}22236[22236]
450450
- Protect against accessing an undefined variable in Security module. {pull}22937[22937]
451451
- Tolerate faults when Windows Event Log session is interrupted {issue}27947[27947] {pull}28191[28191]
452+
- Add ECS 1.9 new users fields {pull}26509[26509]
452453

453454
*Functionbeat*
454455

‎x-pack/winlogbeat/module/security/config/winlogbeat-security.js‎

Lines changed: 83 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1907,14 +1907,14 @@ var security = (function () {
19071907

19081908
var copyTargetUser = function(evt) {
19091909
var targetUserId = evt.Get("winlog.event_data.TargetUserSid");
1910+
if (!targetUserId) targetUserId = evt.Get("winlog.event_data.TargetSid");
19101911
if (targetUserId) {
19111912
if (evt.Get("user.id")) evt.Put("user.target.id", targetUserId);
19121913
else evt.Put("user.id", targetUserId);
19131914
}
1914-
19151915
var targetUserName = evt.Get("winlog.event_data.TargetUserName");
19161916
if (targetUserName) {
1917-
if (/.@*/.test(targetUserName)) {
1917+
if (targetUserName.indexOf('@')>0) {
19181918
targetUserName = targetUserName.split('@')[0];
19191919
}
19201920

@@ -1930,6 +1930,71 @@ var security = (function () {
19301930
}
19311931
}
19321932

1933+
var removeIfEmptyOrHyphen = function(evt, key) {
1934+
var val = evt.Get(key);
1935+
if (!val || val === "-") {
1936+
evt.Delete(key);
1937+
return true;
1938+
}
1939+
return false;
1940+
}
1941+
1942+
var copyTargetUserToEffective = new processor.Chain()
1943+
.Convert({
1944+
fields: [
1945+
{from: "winlog.event_data.TargetUserSid", to: "user.effective.id"},
1946+
{from: "winlog.event_data.TargetUserName", to: "user.effective.name"},
1947+
{from: "winlog.event_data.TargetDomainName", to: "user.effective.domain"},
1948+
],
1949+
ignore_missing: true,
1950+
})
1951+
.Add(function(evt) {
1952+
var user = evt.Get("winlog.event_data.TargetUserName");
1953+
if (user) {
1954+
if (user.indexOf('@')>0) {
1955+
user = user.split('@')[0];
1956+
evt.Put('user.effective.name', user);
1957+
}
1958+
}
1959+
})
1960+
.Add(function(evt) {
1961+
if (!removeIfEmptyOrHyphen(evt, "user.effective.name")) {
1962+
evt.AppendTo("related.user", evt.Get("user.effective.name"));
1963+
}
1964+
removeIfEmptyOrHyphen(evt, "user.effective.domain");
1965+
removeIfEmptyOrHyphen(evt, "user.effective.id");
1966+
})
1967+
.Build();
1968+
1969+
var copyTargetUserToTarget = new processor.Chain()
1970+
.Convert({
1971+
fields: [
1972+
{from: "winlog.event_data.TargetSid", to: "user.target.id"},
1973+
{from: "winlog.event_data.TargetUserName", to: "user.target.name"},
1974+
{from: "winlog.event_data.TargetDomainName", to: "user.target.domain"},
1975+
],
1976+
ignore_missing: true,
1977+
})
1978+
.Add(function(evt) {
1979+
var user = evt.Get("winlog.event_data.TargetUserName");
1980+
if (user) {
1981+
if (user.indexOf('@')>0) {
1982+
user = user.split('@')[0];
1983+
evt.Put('user.target.name', user);
1984+
}
1985+
evt.AppendTo('related.user', user);
1986+
}
1987+
})
1988+
.Add(function(evt) {
1989+
if (!removeIfEmptyOrHyphen(evt, "user.target.name")) {
1990+
evt.AppendTo("related.user", evt.Get("user.target.name"));
1991+
}
1992+
removeIfEmptyOrHyphen(evt, "user.target.domain");
1993+
removeIfEmptyOrHyphen(evt, "user.target.id");
1994+
})
1995+
.Build();
1996+
1997+
19331998
var copyMemberToUser = function(evt) {
19341999
var member = evt.Get("winlog.event_data.MemberName");
19352000
if (!member) {
@@ -1940,6 +2005,11 @@ var security = (function () {
19402005

19412006
evt.AppendTo("related.user", userName);
19422007
evt.Put("user.target.name", userName);
2008+
2009+
var domainName = member.split(',')[3];
2010+
if (domainName) {
2011+
evt.Put("user.target.domain", domainName.replace('DC=', '').replace('dc=', ''));
2012+
}
19432013
}
19442014

19452015
var copyTargetUserToGroup = new processor.Chain()
@@ -2130,10 +2200,11 @@ var security = (function () {
21302200

21312201
// Handles both 4648
21322202
var event4648 = new processor.Chain()
2133-
.Add(copyTargetUser)
2203+
.Add(copySubjectUser)
21342204
.Add(copySubjectUserLogonId)
21352205
.Add(renameCommonAuthFields)
21362206
.Add(addEventFields)
2207+
.Add(copyTargetUserToEffective)
21372208
.Add(function(evt) {
21382209
var user = evt.Get("winlog.event_data.SubjectUserName");
21392210
if (user) {
@@ -2173,16 +2244,8 @@ var security = (function () {
21732244
.Add(copySubjectUser)
21742245
.Add(copySubjectUserLogonId)
21752246
.Add(renameNewProcessFields)
2247+
.Add(copyTargetUserToEffective)
21762248
.Add(addEventFields)
2177-
.Add(function(evt) {
2178-
var user = evt.Get("winlog.event_data.TargetUserName");
2179-
if (user) {
2180-
var res = /^-$/.test(user);
2181-
if (!res) {
2182-
evt.AppendTo('related.user', user);
2183-
}
2184-
}
2185-
})
21862249
.Build();
21872250

21882251
var event4689 = new processor.Chain()
@@ -2206,10 +2269,7 @@ var security = (function () {
22062269
.Add(renameCommonAuthFields)
22072270
.Add(addUACDescription)
22082271
.Add(addEventFields)
2209-
.Add(function(evt) {
2210-
var user = evt.Get("winlog.event_data.TargetUserName");
2211-
evt.AppendTo('related.user', user);
2212-
})
2272+
.Add(copyTargetUserToTarget)
22132273
.Build();
22142274

22152275
var userRenamed = new processor.Chain()
@@ -2221,6 +2281,12 @@ var security = (function () {
22212281
evt.AppendTo('related.user', userNew);
22222282
var userOld = evt.Get("winlog.event_data.OldTargetUserName");
22232283
evt.AppendTo('related.user', userOld);
2284+
if (userOld) {
2285+
evt.Put('user.target.name', userOld);
2286+
}
2287+
if (userNew) {
2288+
evt.Put('user.changes.name', userNew);
2289+
}
22242290
})
22252291
.Build();
22262292

@@ -2359,6 +2425,7 @@ var security = (function () {
23592425
.Add(copySubjectUserLogonId)
23602426
.Add(renameCommonAuthFields)
23612427
.Add(addEventFields)
2428+
.Add(copyTargetUserToTarget)
23622429
.Add(function(evt) {
23632430
var oldSd = evt.Get("winlog.event_data.OldSd");
23642431
var newSd = evt.Get("winlog.event_data.NewSd");

‎x-pack/winlogbeat/module/security/test/testdata/4746.evtx.golden.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
3939
"name": "at_adm",
4040
"target": {
41+
"domain": "SAAS",
4142
"group": {
4243
"domain": "TEST",
4344
"id": "S-1-5-21-1717121054-434620538-60925301-2903",

‎x-pack/winlogbeat/module/security/test/testdata/4747.evtx.golden.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
3939
"name": "at_adm",
4040
"target": {
41+
"domain": "SAAS",
4142
"group": {
4243
"domain": "TEST",
4344
"id": "S-1-5-21-1717121054-434620538-60925301-2903",

‎x-pack/winlogbeat/module/security/test/testdata/4751.evtx.golden.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
3939
"name": "at_adm",
4040
"target": {
41+
"domain": "SAAS",
4142
"group": {
4243
"domain": "TEST",
4344
"id": "S-1-5-21-1717121054-434620538-60925301-2904",

‎x-pack/winlogbeat/module/security/test/testdata/4752.evtx.golden.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
3939
"name": "at_adm",
4040
"target": {
41+
"domain": "SAAS",
4142
"group": {
4243
"domain": "TEST",
4344
"id": "S-1-5-21-1717121054-434620538-60925301-2904",

‎x-pack/winlogbeat/module/security/test/testdata/4761.evtx.golden.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
3939
"name": "at_adm",
4040
"target": {
41+
"domain": "SAAS",
4142
"group": {
4243
"domain": "TEST",
4344
"id": "S-1-5-21-1717121054-434620538-60925301-2905",

‎x-pack/winlogbeat/module/security/test/testdata/4762.evtx.golden.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
3939
"name": "at_adm",
4040
"target": {
41+
"domain": "SAAS",
4142
"group": {
4243
"domain": "TEST",
4344
"id": "S-1-5-21-1717121054-434620538-60925301-2905",

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4768.evtx.golden.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
},
3232
"user": {
3333
"domain": "TEST.SAAS",
34+
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
3435
"name": "at_adm"
3536
},
3637
"winlog": {

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
"port": 53366
3131
},
3232
"user": {
33+
"id": "S-1-5-21-1717121054-434620538-60925301-3057",
3334
"name": "MPUIG"
3435
},
3536
"winlog": {

0 commit comments

Comments
 (0)