Skip to content

Cherry-pick #18596 to 7.x: [Auditbeat] Update auditbeat ECS mappings#18598

Merged
andrewstucki merged 1 commit intoelastic:7.xfrom
andrewstucki:backport_18596_7.x
May 18, 2020
Merged

Cherry-pick #18596 to 7.x: [Auditbeat] Update auditbeat ECS mappings#18598
andrewstucki merged 1 commit intoelastic:7.xfrom
andrewstucki:backport_18596_7.x

Conversation

@andrewstucki
Copy link
Copy Markdown

@andrewstucki andrewstucki commented May 16, 2020

Cherry-pick of PR #18596 to 7.x branch. Original message:

What does this PR do?

This is the spiritual successor to #18028 -- with the code to do the categorization itself moved into go-libaudit (see elastic/go-libaudit#62).

It adds in ECS categorization fields for a good chunk of auditd-based syscalls and event types.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

[Auditbeat] Update auditbeat ECS mappings (elastic#18596)
c687bf3 
* Update auditbeat ECS mappings

* Add changelog entry

* Rev go-libaudit with build tag fix

(cherry picked from commit bd7414d)
@andrewstucki andrewstucki requested a review from a team as a code owner May 16, 2020 01:30
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 16, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented May 16, 2020

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label May 16, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented May 16, 2020

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

Test stats 🧪

Test Results
Failed 0
Passed 5891
Skipped 902
Total 6793

Steps errors

Expand to view the steps failures

  • Name: Report to Codecov

    • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

    • Result: FAILURE

    • Duration: 2 min 22 sec

    • Start Time: 2020-05-16T01:56:24.185+0000

    • log

@andrewstucki andrewstucki merged commit cfd5139 into elastic:7.x May 18, 2020
@andrewstucki andrewstucki deleted the backport_18596_7.x branch May 18, 2020 18:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marc-gr marc-gr marc-gr approved these changes

Assignees

No one assigned

Labels

backport review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@andrewstucki @elasticmachine @marc-gr