Skip to content

Cherry-pick #22217 to 7.x: [Winlogbeat] Add pe fields to Sysmon module#22231

Merged
leehinman merged 1 commit intoelastic:7.xfrom
leehinman:backport_22217_7.x
Nov 3, 2020
Merged

Cherry-pick #22217 to 7.x: [Winlogbeat] Add pe fields to Sysmon module#22231
leehinman merged 1 commit intoelastic:7.xfrom
leehinman:backport_22217_7.x

Conversation

@leehinman
Copy link
Copy Markdown
Contributor

@leehinman leehinman commented Oct 28, 2020 •
edited by zube bot
Loading

Cherry-pick of PR #22217 to 7.x branch. Original message:

What does this PR do?

adds following fields to Sysmon ProcessCreate and LoadImage events

  • file.pe.company
  • file.pe.description
  • file.pe.file_version
  • file.pe.original_file_name
  • file.pe.product
  • process.pe.company
  • process.pe.description
  • process.pe.file_version
  • process.pe.original_file_name
  • process.pe.product

Why is it important?

pe.original_file_name is especially useful in determining if file has
been renamed since it was signed

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

go test

Related issues

@leehinman leehinman requested a review from a team as a code owner October 28, 2020 14:56
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Oct 28, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Oct 28, 2020

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Oct 28, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Oct 28, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #22231 updated]

  • Start Time: 2020-10-29T14:11:22.841+0000

  • Duration: 39 min 11 sec

Test stats 🧪

Test Results
Failed 0
Passed 92
Skipped 0
Total 92

@marc-gr
Copy link
Copy Markdown
Contributor

marc-gr commented Oct 29, 2020

I think you might need to re generate the test files for this branch

@leehinman
Add pe fields to Sysmon module (elastic#22217)
7257505 
- ProcessCreate event
- LoadImage event

Closes elastic#17335

(cherry picked from commit 310dbf6)
@leehinman leehinman merged commit 75662cc into elastic:7.x Nov 3, 2020
@zube zube bot removed the [zube]: Done label Feb 2, 2021
@leehinman leehinman deleted the backport_22217_7.x branch May 14, 2021 14:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marc-gr marc-gr marc-gr approved these changes

Assignees

No one assigned

Labels

backport

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@leehinman @elasticmachine @marc-gr