Skip to content

Commit 9f399c7

Browse files
marc-grmarc-gr
committed
Change event.code and winlog.event_id type
1 parent 188345d commit 9f399c7

111 files changed

Lines changed: 694 additions & 692 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -533,6 +533,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
533533
- Add source.ip validation for event ID 4778 in the Security module. {issue}19627[19627]
534534
- Protect against accessing undefined variables in Sysmon module. {issue}22219[22219] {pull}22236[22236]
535535
- Protect against accessing an undefined variable in Security module. {pull}22937[22937]
536+
- Change `event.code` and `winlog.event_id` from int to keyword. {pull}25176[25176]
536537

537538
*Functionbeat*
538539

‎libbeat/processors/decode_xml_wineventlog/processor.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,8 +139,9 @@ func fields(evt winevent.Event) (common.MapStr, common.MapStr) {
139139

140140
ecs := common.MapStr{}
141141

142+
eventCode, _ := win.GetValue("event_id")
143+
ecs.Put("event.code", eventCode)
142144
ecs.Put("event.kind", "event")
143-
ecs.Put("event.code", evt.EventIdentifier.ID)
144145
ecs.Put("event.provider", evt.Provider.Name)
145146
winevent.AddOptional(ecs, "event.action", evt.Task)
146147
winevent.AddOptional(ecs, "host.name", evt.Computer)

‎libbeat/processors/decode_xml_wineventlog/processor_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ func TestProcessor(t *testing.T) {
5555
Output: common.MapStr{
5656
"event": common.MapStr{
5757
"action": "Special Logon",
58-
"code": uint32(4672),
58+
"code": "4672",
5959
"kind": "event",
6060
"outcome": "success",
6161
"provider": "Microsoft-Windows-Security-Auditing",
@@ -71,7 +71,7 @@ func TestProcessor(t *testing.T) {
7171
"outcome": "success",
7272
"activity_id": "{ffb23523-1f32-0000-c335-b2ff321fd701}",
7373
"level": "information",
74-
"event_id": uint32(4672),
74+
"event_id": "4672",
7575
"provider_name": "Microsoft-Windows-Security-Auditing",
7676
"record_id": uint64(11303),
7777
"computer_name": "vagrant",
@@ -129,7 +129,7 @@ func TestProcessor(t *testing.T) {
129129
"outcome": "success",
130130
"activity_id": "{ffb23523-1f32-0000-c335-b2ff321fd701}",
131131
"level": "information",
132-
"event_id": uint32(4672),
132+
"event_id": "4672",
133133
"provider_name": "Microsoft-Windows-Security-Auditing",
134134
"record_id": uint64(11303),
135135
"computer_name": "vagrant",

‎winlogbeat/eventlog/eventlog.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,9 @@ func (e Record) ToEvent() beat.Event {
9292
// ECS data
9393
m.Put("event.created", time.Now())
9494

95+
eventCode, _ := win.GetValue("event_id")
96+
m.Put("event.code", eventCode)
9597
m.Put("event.kind", "event")
96-
m.Put("event.code", e.EventIdentifier.ID)
9798
m.Put("event.provider", e.Provider.Name)
9899

99100
rename(m, "winlog.outcome", "event.outcome")

‎winlogbeat/sys/winevent/event.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ func (e Event) Fields() common.MapStr {
9898
win := common.MapStr{}
9999

100100
AddOptional(win, "channel", e.Channel)
101-
AddOptional(win, "event_id", e.EventIdentifier.ID)
101+
AddOptional(win, "event_id", fmt.Sprint(e.EventIdentifier.ID))
102102
AddOptional(win, "provider_name", e.Provider.Name)
103103
AddOptional(win, "record_id", e.RecordID)
104104
AddOptional(win, "task", e.Task)

‎winlogbeat/tests/system/test_wineventlog.py‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -68,11 +68,10 @@ def test_read_unknown_event_id(self):
6868
wineventlog - Read unknown event ID
6969
"""
7070
msg = "Unknown event ID"
71-
event_id = 1111
72-
self.write_event_log(msg, eventID=event_id)
71+
self.write_event_log(msg, eventID=1111)
7372
evts = self.read_events()
7473
self.assertTrue(len(evts), 1)
75-
self.assert_common_fields(evts[0], eventID=event_id, extra={
74+
self.assert_common_fields(evts[0], eventID="1111", extra={
7675
"winlog.keywords": ["Classic"],
7776
"winlog.opcode": "Info",
7877
})
@@ -199,10 +198,10 @@ def test_query_event_id(self):
199198
]
200199
}, expected_events=4)
201200
self.assertTrue(len(evts), 4)
202-
self.assertEqual(evts[0]["winlog.event_id"], 50)
203-
self.assertEqual(evts[1]["winlog.event_id"], 100)
204-
self.assertEqual(evts[2]["winlog.event_id"], 175)
205-
self.assertEqual(evts[3]["winlog.event_id"], 200)
201+
self.assertEqual(evts[0]["winlog.event_id"], "50")
202+
self.assertEqual(evts[1]["winlog.event_id"], "100")
203+
self.assertEqual(evts[2]["winlog.event_id"], "175")
204+
self.assertEqual(evts[3]["winlog.event_id"], "200")
206205

207206
def test_query_level_single(self):
208207
"""
@@ -270,8 +269,8 @@ def test_query_ignore_older(self):
270269
]
271270
})
272271
self.assertTrue(len(evts), 1)
273-
self.assertEqual(evts[0]["winlog.event_id"], 10)
274-
self.assertEqual(evts[0]["event.code"], 10)
272+
self.assertEqual(evts[0]["winlog.event_id"], "10")
273+
self.assertEqual(evts[0]["event.code"], "10")
275274

276275
def test_query_provider(self):
277276
"""

‎winlogbeat/tests/system/winlogbeat.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ def read_registry(self, requireBookmark=False):
135135

136136
return event_logs
137137

138-
def assert_common_fields(self, evt, msg=None, eventID=10, sid=None,
138+
def assert_common_fields(self, evt, msg=None, eventID="10", sid=None,
139139
level="information", extra=None):
140140

141141
assert host_name(evt["winlog.computer_name"]).lower() == host_name(platform.node()).lower()

‎x-pack/winlogbeat/module/powershell/test/testdata/400.evtx.golden.json‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"category": [
77
"process"
88
],
9-
"code": 400,
9+
"code": "400",
1010
"kind": "event",
1111
"module": "powershell",
1212
"provider": "PowerShell",
@@ -46,7 +46,7 @@
4646
"api": "wineventlog",
4747
"channel": "Windows PowerShell",
4848
"computer_name": "vagrant",
49-
"event_id": 400,
49+
"event_id": "400",
5050
"keywords": [
5151
"Classic"
5252
],
@@ -63,7 +63,7 @@
6363
"category": [
6464
"process"
6565
],
66-
"code": 400,
66+
"code": "400",
6767
"kind": "event",
6868
"module": "powershell",
6969
"provider": "PowerShell",
@@ -105,7 +105,7 @@
105105
"api": "wineventlog",
106106
"channel": "Windows PowerShell",
107107
"computer_name": "vagrant",
108-
"event_id": 400,
108+
"event_id": "400",
109109
"keywords": [
110110
"Classic"
111111
],
@@ -122,7 +122,7 @@
122122
"category": [
123123
"process"
124124
],
125-
"code": 400,
125+
"code": "400",
126126
"kind": "event",
127127
"module": "powershell",
128128
"provider": "PowerShell",
@@ -162,7 +162,7 @@
162162
"api": "wineventlog",
163163
"channel": "Windows PowerShell",
164164
"computer_name": "vagrant",
165-
"event_id": 400,
165+
"event_id": "400",
166166
"keywords": [
167167
"Classic"
168168
],
@@ -179,7 +179,7 @@
179179
"category": [
180180
"process"
181181
],
182-
"code": 400,
182+
"code": "400",
183183
"kind": "event",
184184
"module": "powershell",
185185
"provider": "PowerShell",
@@ -213,7 +213,7 @@
213213
"api": "wineventlog",
214214
"channel": "Windows PowerShell",
215215
"computer_name": "vagrant",
216-
"event_id": 400,
216+
"event_id": "400",
217217
"keywords": [
218218
"Classic"
219219
],

‎x-pack/winlogbeat/module/powershell/test/testdata/403.evtx.golden.json‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"category": [
77
"process"
88
],
9-
"code": 403,
9+
"code": "403",
1010
"kind": "event",
1111
"module": "powershell",
1212
"provider": "PowerShell",
@@ -45,7 +45,7 @@
4545
"api": "wineventlog",
4646
"channel": "Windows PowerShell",
4747
"computer_name": "vagrant",
48-
"event_id": 403,
48+
"event_id": "403",
4949
"keywords": [
5050
"Classic"
5151
],
@@ -62,7 +62,7 @@
6262
"category": [
6363
"process"
6464
],
65-
"code": 403,
65+
"code": "403",
6666
"kind": "event",
6767
"module": "powershell",
6868
"provider": "PowerShell",
@@ -102,7 +102,7 @@
102102
"api": "wineventlog",
103103
"channel": "Windows PowerShell",
104104
"computer_name": "vagrant",
105-
"event_id": 403,
105+
"event_id": "403",
106106
"keywords": [
107107
"Classic"
108108
],
@@ -119,7 +119,7 @@
119119
"category": [
120120
"process"
121121
],
122-
"code": 403,
122+
"code": "403",
123123
"kind": "event",
124124
"module": "powershell",
125125
"provider": "PowerShell",
@@ -166,7 +166,7 @@
166166
"api": "wineventlog",
167167
"channel": "Windows PowerShell",
168168
"computer_name": "vagrant",
169-
"event_id": 403,
169+
"event_id": "403",
170170
"keywords": [
171171
"Classic"
172172
],
@@ -183,7 +183,7 @@
183183
"category": [
184184
"process"
185185
],
186-
"code": 403,
186+
"code": "403",
187187
"kind": "event",
188188
"module": "powershell",
189189
"provider": "PowerShell",
@@ -217,7 +217,7 @@
217217
"api": "wineventlog",
218218
"channel": "Windows PowerShell",
219219
"computer_name": "vagrant",
220-
"event_id": 403,
220+
"event_id": "403",
221221
"keywords": [
222222
"Classic"
223223
],

‎x-pack/winlogbeat/module/powershell/test/testdata/4103.evtx.golden.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"category": [
1313
"process"
1414
],
15-
"code": 4103,
15+
"code": "4103",
1616
"kind": "event",
1717
"module": "powershell",
1818
"provider": "Microsoft-Windows-PowerShell",
@@ -94,7 +94,7 @@
9494
"api": "wineventlog",
9595
"channel": "Microsoft-Windows-PowerShell/Operational",
9696
"computer_name": "vagrant",
97-
"event_id": 4103,
97+
"event_id": "4103",
9898
"opcode": "To be used when operation is just executing a method",
9999
"process": {
100100
"pid": 3984,
@@ -119,7 +119,7 @@
119119
"category": [
120120
"process"
121121
],
122-
"code": 4103,
122+
"code": "4103",
123123
"kind": "event",
124124
"module": "powershell",
125125
"provider": "Microsoft-Windows-PowerShell",
@@ -217,7 +217,7 @@
217217
"api": "wineventlog",
218218
"channel": "Microsoft-Windows-PowerShell/Operational",
219219
"computer_name": "vagrant",
220-
"event_id": 4103,
220+
"event_id": "4103",
221221
"opcode": "To be used when operation is just executing a method",
222222
"process": {
223223
"pid": 5032,

0 commit comments

Comments
 (0)