Fix powershell error on events 40961 and 40962#10792
Conversation
|
Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform) |
leehinman
left a comment
There was a problem hiding this comment.
missing changes to manifest.yml that match the change in changelog.yml
| description: Remove all empty values from event_data. | ||
| lang: painless | ||
| source: ctx?.winlog?.event_data?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals("")); | ||
| if: ctx?.winlog?.event_data != null |
There was a problem hiding this comment.
For sure we need to add this to:
forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml
but it probably applies to:
powershell/elasticsearch/ingest_pipeline/default.ymlsysmon_operational/elasticsearch/ingest_pipeline/default.ymlforwarded/elasticsearch/ingest_pipeline/powershell.ymlforwarded/elasticsearch/ingest_pipeline/sysmon_operational.yml
Do you happen to have any sample events you could add to powershell_operational/_dev/test/pipeline/test-events.json ? That way the tests will catch this if we break it in the future.
There was a problem hiding this comment.
@leehinman Thanks for the tips. I was able to find sample events for powershell_operational and added them to tests. I also made the analogous fix powershell and sysmon_operational as you'd suggested, but was unable to create real events that would trigger the issue for those.
|
Hi @bjmcnic - a customer has been in touch looking for an update on this PR. Their main focus is 40961 and 40962 event support within the |
|
@jamiehynds I added the tests for |
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
applocker_msi_and_script |
9433.96 | 7462.69 | -1971.27 (-20.9%) | 💔 |
applocker_packaged_app_deployment |
14705.88 | 11904.76 | -2801.12 (-19.05%) | 💔 |
powershell_operational |
4347.83 | 2976.19 | -1371.64 (-31.55%) | 💔 |
To see the full report comment with /test benchmark fullreport
💚 Build Succeeded
History
cc @bjmcnic |
|
leehinman
left a comment
There was a problem hiding this comment.
LGTM. Thanks for adding the test cases.
|
Package windows - 2.0.2 containing this change is available at https://epr.elastic.co/search?package=windows |
Fix pipeline_error for powershell_operational events 40961 and 40962.
Fix pipeline_error for powershell_operational events 40961 and 40962.
Proposed commit message
Fix pipeline_error for powershell_operational events 40961 and 40962.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots