Skip to content

Commit da6dd9d

Browse files
leehinmanleehinman
authored
[Winlogbeat] Set host.name to computername (#14625)
* Set host.name to computername - set host.name to computer name for windows events and sysmon - Add info about libbeat #14407 dependency Fixes #13706
1 parent 82cda7a commit da6dd9d

19 files changed

Lines changed: 695 additions & 0 deletions

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
276276
*Winlogbeat*
277277

278278
- Fix data race affecting config validation at startup. {issue}13005[13005]
279+
- Set host.name to computername in Windows event logs & sysmon. Requires {pull}14407[14407] in libbeat to work {issue}13706[13706]
279280

280281
*Functionbeat*
281282

‎winlogbeat/eventlog/eventlog.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ func (e Record) ToEvent() beat.Event {
134134
m.Put("event.code", e.EventIdentifier.ID)
135135
m.Put("event.provider", e.Provider.Name)
136136
addOptional(m, "event.action", e.Task)
137+
addOptional(m, "host.name", e.Computer)
137138

138139
m.Put("event.created", time.Now())
139140

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2012r2-logon.evtx.golden.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@
1111
"provider": "Microsoft-Windows-Security-Auditing",
1212
"type": "authentication_success"
1313
},
14+
"host": {
15+
"name": "vagrant-2012-r2"
16+
},
1417
"log": {
1518
"level": "information"
1619
},
@@ -83,6 +86,9 @@
8386
"provider": "Microsoft-Windows-Security-Auditing",
8487
"type": "authentication_success"
8588
},
89+
"host": {
90+
"name": "vagrant-2012-r2"
91+
},
8692
"log": {
8793
"level": "information"
8894
},
@@ -155,6 +161,9 @@
155161
"provider": "Microsoft-Windows-Security-Auditing",
156162
"type": "authentication_success"
157163
},
164+
"host": {
165+
"name": "vagrant-2012-r2"
166+
},
158167
"log": {
159168
"level": "information"
160169
},
@@ -230,6 +239,9 @@
230239
"provider": "Microsoft-Windows-Security-Auditing",
231240
"type": "authentication_success"
232241
},
242+
"host": {
243+
"name": "vagrant-2012-r2"
244+
},
233245
"log": {
234246
"level": "information"
235247
},
@@ -302,6 +314,9 @@
302314
"provider": "Microsoft-Windows-Security-Auditing",
303315
"type": "authentication_success"
304316
},
317+
"host": {
318+
"name": "vagrant-2012-r2"
319+
},
305320
"log": {
306321
"level": "information"
307322
},
@@ -374,6 +389,9 @@
374389
"provider": "Microsoft-Windows-Security-Auditing",
375390
"type": "authentication_success"
376391
},
392+
"host": {
393+
"name": "vagrant-2012-r2"
394+
},
377395
"log": {
378396
"level": "information"
379397
},
@@ -446,6 +464,9 @@
446464
"provider": "Microsoft-Windows-Security-Auditing",
447465
"type": "authentication_success"
448466
},
467+
"host": {
468+
"name": "vagrant-2012-r2"
469+
},
449470
"log": {
450471
"level": "information"
451472
},
@@ -518,6 +539,9 @@
518539
"provider": "Microsoft-Windows-Security-Auditing",
519540
"type": "authentication_success"
520541
},
542+
"host": {
543+
"name": "vagrant-2012-r2"
544+
},
521545
"log": {
522546
"level": "information"
523547
},
@@ -590,6 +614,9 @@
590614
"provider": "Microsoft-Windows-Security-Auditing",
591615
"type": "authentication_success"
592616
},
617+
"host": {
618+
"name": "vagrant-2012-r2"
619+
},
593620
"log": {
594621
"level": "information"
595622
},
@@ -665,6 +692,9 @@
665692
"provider": "Microsoft-Windows-Security-Auditing",
666693
"type": "authentication_success"
667694
},
695+
"host": {
696+
"name": "vagrant-2012-r2"
697+
},
668698
"log": {
669699
"level": "information"
670700
},
@@ -737,6 +767,9 @@
737767
"provider": "Microsoft-Windows-Security-Auditing",
738768
"type": "authentication_success"
739769
},
770+
"host": {
771+
"name": "vagrant-2012-r2"
772+
},
740773
"log": {
741774
"level": "information"
742775
},
@@ -812,6 +845,9 @@
812845
"provider": "Microsoft-Windows-Security-Auditing",
813846
"type": "authentication_success"
814847
},
848+
"host": {
849+
"name": "vagrant-2012-r2"
850+
},
815851
"log": {
816852
"level": "information"
817853
},
@@ -884,6 +920,9 @@
884920
"provider": "Microsoft-Windows-Security-Auditing",
885921
"type": "authentication_success"
886922
},
923+
"host": {
924+
"name": "vagrant-2012-r2"
925+
},
887926
"log": {
888927
"level": "information"
889928
},
@@ -956,6 +995,9 @@
956995
"provider": "Microsoft-Windows-Security-Auditing",
957996
"type": "authentication_success"
958997
},
998+
"host": {
999+
"name": "vagrant-2012-r2"
1000+
},
9591001
"log": {
9601002
"level": "information"
9611003
},
@@ -1028,6 +1070,9 @@
10281070
"provider": "Microsoft-Windows-Security-Auditing",
10291071
"type": "authentication_success"
10301072
},
1073+
"host": {
1074+
"name": "vagrant-2012-r2"
1075+
},
10311076
"log": {
10321077
"level": "information"
10331078
},
@@ -1100,6 +1145,9 @@
11001145
"provider": "Microsoft-Windows-Security-Auditing",
11011146
"type": "authentication_success"
11021147
},
1148+
"host": {
1149+
"name": "vagrant-2012-r2"
1150+
},
11031151
"log": {
11041152
"level": "information"
11051153
},
@@ -1172,6 +1220,9 @@
11721220
"provider": "Microsoft-Windows-Security-Auditing",
11731221
"type": "authentication_success"
11741222
},
1223+
"host": {
1224+
"name": "vagrant-2012-r2"
1225+
},
11751226
"log": {
11761227
"level": "information"
11771228
},
@@ -1244,6 +1295,9 @@
12441295
"provider": "Microsoft-Windows-Security-Auditing",
12451296
"type": "authentication_failure"
12461297
},
1298+
"host": {
1299+
"name": "vagrant-2012-r2"
1300+
},
12471301
"log": {
12481302
"level": "information"
12491303
},

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016-4672.evtx.golden.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
"module": "security",
99
"provider": "Microsoft-Windows-Security-Auditing"
1010
},
11+
"host": {
12+
"name": "vagrant-2016"
13+
},
1114
"log": {
1215
"level": "information"
1316
},

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016-logoff.evtx.golden.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
"module": "security",
99
"provider": "Microsoft-Windows-Security-Auditing"
1010
},
11+
"host": {
12+
"name": "WIN-41OB2LO92CR"
13+
},
1114
"log": {
1215
"level": "information"
1316
},
@@ -58,6 +61,9 @@
5861
"module": "security",
5962
"provider": "Microsoft-Windows-Security-Auditing"
6063
},
64+
"host": {
65+
"name": "WIN-41OB2LO92CR"
66+
},
6167
"log": {
6268
"level": "information"
6369
},

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4720_Account_Created.evtx.golden.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
"module": "security",
99
"provider": "Microsoft-Windows-Security-Auditing"
1010
},
11+
"host": {
12+
"name": "WIN-41OB2LO92CR"
13+
},
1114
"log": {
1215
"level": "information"
1316
},
@@ -81,6 +84,9 @@
8184
"module": "security",
8285
"provider": "Microsoft-Windows-Security-Auditing"
8386
},
87+
"host": {
88+
"name": "WIN-41OB2LO92CR"
89+
},
8490
"log": {
8591
"level": "information"
8692
},

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4722_Account_Enabled.evtx.golden.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
"module": "security",
99
"provider": "Microsoft-Windows-Security-Auditing"
1010
},
11+
"host": {
12+
"name": "WIN-41OB2LO92CR"
13+
},
1114
"log": {
1215
"level": "information"
1316
},
@@ -62,6 +65,9 @@
6265
"module": "security",
6366
"provider": "Microsoft-Windows-Security-Auditing"
6467
},
68+
"host": {
69+
"name": "WIN-41OB2LO92CR"
70+
},
6571
"log": {
6672
"level": "information"
6773
},

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4723_Password_Change.evtx.golden.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
"module": "security",
99
"provider": "Microsoft-Windows-Security-Auditing"
1010
},
11+
"host": {
12+
"name": "WIN-41OB2LO92CR"
13+
},
1114
"log": {
1215
"level": "information"
1316
},
@@ -63,6 +66,9 @@
6366
"module": "security",
6467
"provider": "Microsoft-Windows-Security-Auditing"
6568
},
69+
"host": {
70+
"name": "WIN-41OB2LO92CR"
71+
},
6672
"log": {
6773
"level": "information"
6874
},

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4724_Password_Reset.evtx.golden.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
"module": "security",
99
"provider": "Microsoft-Windows-Security-Auditing"
1010
},
11+
"host": {
12+
"name": "WIN-41OB2LO92CR"
13+
},
1114
"log": {
1215
"level": "information"
1316
},
@@ -62,6 +65,9 @@
6265
"module": "security",
6366
"provider": "Microsoft-Windows-Security-Auditing"
6467
},
68+
"host": {
69+
"name": "WIN-41OB2LO92CR"
70+
},
6571
"log": {
6672
"level": "information"
6773
},

‎x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4725_Account_Disabled.evtx.golden.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
"module": "security",
99
"provider": "Microsoft-Windows-Security-Auditing"
1010
},
11+
"host": {
12+
"name": "WIN-41OB2LO92CR"
13+
},
1114
"log": {
1215
"level": "information"
1316
},
@@ -62,6 +65,9 @@
6265
"module": "security",
6366
"provider": "Microsoft-Windows-Security-Auditing"
6467
},
68+
"host": {
69+
"name": "WIN-41OB2LO92CR"
70+
},
6571
"log": {
6672
"level": "information"
6773
},

0 commit comments

Comments
 (0)