Handle events without event_data properly#13571
Conversation
75818c9 to
e102b7a
Compare
|
Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform) |
🚀 Benchmarks reportTo see the full report comment with |
|
💚 Build Succeeded
|
belimawr
left a comment
There was a problem hiding this comment.
Approving the changes in the files owned by @elastic/elastic-agent-data-plane
|
Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform) |
| "NewSdDacl0": "Local system :Access Allowed ([Generic All])", | ||
| "NewSdDacl1": "OW :Access Allowed ([Read Permissions])", | ||
| "NewSdDacl2": "S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628 :Access Allowed ([Generic All])", | ||
| "ObjectName": "-", |
There was a problem hiding this comment.
what resulted in this change ?
There was a problem hiding this comment.
I made the event_data empty values handling consistent across all pipelines that were doing it. So the more complete ones were also removing not only empty or null values, but what it is considered empty by the events context, (-, {0000....0000}, etc). This is the result of a more thorough cleanup of empty fields
|
Package sysmon_linux - 1.8.1 containing this change is available at https://epr.elastic.co/package/sysmon_linux/1.8.1/ |
|
Package system - 1.68.2 containing this change is available at https://epr.elastic.co/package/system/1.68.2/ |
|
Package windows - 2.5.5 containing this change is available at https://epr.elastic.co/package/windows/2.5.5/ |
Proposed commit message
Handle events without event_data properly
Checklist
changelog.ymlfile.Related issues