Skip to content

x-pack/winlogbeat/module/sysmon: Add event.category and event.type to Sysmon#35193

Merged
kcreddy merged 4 commits intoelastic:mainfrom
kcreddy:5976-windows_sysmon-add-event-values
Apr 25, 2023
Merged

x-pack/winlogbeat/module/sysmon: Add event.category and event.type to Sysmon#35193
kcreddy merged 4 commits intoelastic:mainfrom
kcreddy:5976-windows_sysmon-add-event-values

Conversation

@kcreddy
Copy link
Copy Markdown
Contributor

@kcreddy kcreddy commented Apr 24, 2023 •
edited
Loading

What does this PR do?

Why is it important?

Helps with creating detection rules on ECS fields event.category and event.type

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

Use cases

Screenshots

Logs

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Apr 24, 2023
@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Apr 24, 2023

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @kcreddy? 🙏.
For such, you'll need to label your PR with:

  • The upcoming major version of the Elastic Stack
  • The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Apr 24, 2023 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-04-25T05:43:53.196+0000

  • Duration: 38 min 8 sec

Test stats 🧪

Test Results
Failed 0
Passed 930
Skipped 9
Total 939

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@kcreddy
Copy link
Copy Markdown
Contributor Author

kcreddy commented Apr 24, 2023

/test

@kcreddy kcreddy marked this pull request as ready for review April 24, 2023 15:14
@kcreddy kcreddy requested a review from a team as a code owner April 24, 2023 15:14
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Apr 24, 2023
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Apr 24, 2023

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@kcreddy kcreddy merged commit 8bb171b into elastic:main Apr 25, 2023
mergify bot pushed a commit that referenced this pull request Apr 25, 2023
@kcreddy @mergify
x-pack/winlogbeat/module/sysmon: Add event.category and event.type to…
14fde0d 
… Sysmon (#35193)

* Add event.category and event.type to Sysmon

* Add changelog

* mage update

(cherry picked from commit 8bb171b)
@mergify mergify bot mentioned this pull request Apr 25, 2023
Closed
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
@kcreddy
x-pack/winlogbeat/module/sysmon: Add event.category and event.type to…
304f79d 
… Sysmon (elastic#35193)

* Add event.category and event.type to Sysmon

* Add changelog

* mage update
chrisberkhout pushed a commit that referenced this pull request Jun 1, 2023
@kcreddy @chrisberkhout
x-pack/winlogbeat/module/sysmon: Add event.category and event.type to…
4c504e4 
… Sysmon (#35193)

* Add event.category and event.type to Sysmon

* Add changelog

* mage update
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@P1llus P1llus P1llus approved these changes

Assignees

@kcreddy kcreddy

Labels

8.8-candidate backport-v8.7.0 Automated backport with mergify bugfix Winlogbeat

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Windows] Sysmon Operational missing event.category and event.type

3 participants

@kcreddy @elasticmachine @P1llus