[Windows] Prevent pipeline failure in Windows AppLocker/EXE and DLL logs when signed by common name. by BrendanNurmi · Pull Request #17188 · elastic/integrations

BrendanNurmi · 2026-02-02T06:24:43Z

Proposed commit message

Prevent pipeline failure in Windows AppLocker/EXE and DLL logs when signed by common name.

At present the Windows Integration for AppLocker/EXE and DLL logs fails when the Fully Qualified Binary Name is a Common Name (CN).

This results in the below.

{
    "error": {
      "message": [
        "Provided Grok expressions do not match field value: [CN=58D26209-1D57-482C-B403-B655571B5C7B\\\\DOLBYACCESSOEM\\\\DOLBYACCESSOEM.EXE\\\\1.0.0.00]"
      ]
  }
}

To address this:

Grok pattern added to support the Common Name and mapping it into a temp field, tmp.file.x509.subject.common_name.
The temp field, tmp.file.x509.subject.common_name, is then append the field into the x509.subject.common_name as per the ECS.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Using the Pipeline Testing Guide

Additional tests have been added to validate the grok parsing to capture the failing events.

Related issues

Screenshots

…igned by common name only.

elasticmachine · 2026-02-02T13:01:31Z

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

….subject.common_name into esc fields

elasticmachine · 2026-02-04T07:12:56Z

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

packages/windows/changelog.yml

Adding link to current PR.

adrianchen-es · 2026-02-09T02:57:12Z

@VihasMakwana Could you please let @BrendanNurmi know if there is anything needed for this fix?

VihasMakwana · 2026-02-09T14:51:24Z

packages/windows/data_stream/applocker_exe_and_dll/elasticsearch/ingest_pipeline/default.yml

+  - append:
+      field: file.x509.subject.common_name
+      value: "{{tmp.file.x509.subject.common_name}}"
+      ignore_failure: true


@BrendanNurmi IMO we should set ignore_empty_values to true here.
Right now, the pipeline will set file.x509.subject.common_name to "" if any of the other patterns match.
Enabling ignore_empty_values will not cause empty fields on your ES.

You'll also need to update test-events-applocker-exe-8003.json-expected.json.

Suggested change

ignore_failure: true

ignore_failure: true

ignore_empty_values: true

Thanks for the feedback, added for all appends, retested.

I've added it for all since the FQBN can be just the CN or the locality and/or CN could also not be present within the FQBN.

b@pi5-a:~/integrations/packages/windows/data_stream/applocker_exe_and_dll$ elastic-package test pipeline Run pipeline tests for the package 2026/02/09 22:43:27 INFO elastic-package v0.118.0 version-hash 816ceecf (build time: 2025-12-30T13:03:37Z) 2026/02/09 22:43:27 INFO elastic-stack: 9.2.3 --- Test results for package: windows - START --- ╭─────────┬───────────────────────────────────┬───────────┬─────────────────────────────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮ │ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │ ├─────────┼───────────────────────────────────┼───────────┼─────────────────────────────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤ │ windows │ applocker_exe_and_dll │ pipeline │ (ingest pipeline warnings test-events-applocker-exe-8003-common-name.json) │ PASS │ 546.253384ms │ │ windows │ applocker_exe_and_dll │ pipeline │ (ingest pipeline warnings test-events-applocker-exe-8003.json) │ PASS │ 455.685091ms │ │ windows │ applocker_exe_and_dll │ pipeline │ test-events-applocker-exe-8003-common-name.json │ PASS │ 283.37205ms │ │ windows │ applocker_exe_and_dll │ pipeline │ test-events-applocker-exe-8003.json │ PASS │ 213.922322ms │

@BrendanNurmi Looks like ignore_empty_values was only added in 9.x+ versions of ElasticSearch. Could you please revert this change and remove ignore_empty_values?

I'll address this later with a "breaking" change.

For now, let's just revert to the previous version.
Sorry for inconvenience. I had no idea about it 😓

You're all good, I should have tested a backport against v8, i'm still learning here, at least the cicd caught it.

VihasMakwana

I have asked a question related to the append processor. Looks good otherwise.

adrianchen-es · 2026-02-09T23:23:24Z

@nfritts , Could please you have a look at/help with a reviewer from your team?

marc-gr · 2026-02-10T13:41:36Z

/test

VihasMakwana · 2026-02-10T14:09:51Z

@BrendanNurmi Could you run elastic-package build in the integrations/packages/windows directory and commit the changes?

BrendanNurmi · 2026-02-10T15:11:15Z

Recommitted; apologies, I missed this one.

VihasMakwana · 2026-02-11T10:37:56Z

/test

VihasMakwana · 2026-02-11T11:05:01Z

@BrendanNurmi Could you take a look https://github.com/elastic/integrations/pull/17188/changes#r2792665842?

…his will work for both 8 & 9.

BrendanNurmi · 2026-02-11T11:45:58Z

Should be fixed; I've updated the pipeline, removed the extra comment from the changelog and corrected the test cases.

Both complete without error:

elastic-package build
elastic-package test

VihasMakwana · 2026-02-11T12:56:42Z

/test

elastic-vault-github-plugin-prod · 2026-02-11T13:21:56Z

🚀 Benchmarks report

Package `windows` 👍(5) 💚(1) 💔(4)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
`windows_defender`	9615.38	7575.76	-2039.62 (-21.21%)	💔
`powershell_operational`	3086.42	1605.65	-1480.77 (-47.98%)	💔
`applocker_exe_and_dll`	5747.13	4166.67	-1580.46 (-27.5%)	💔
`applocker_packaged_app_execution`	12820.51	9900.99	-2919.52 (-22.77%)	💔

To see the full report comment with /test benchmark fullreport

elasticmachine · 2026-02-11T13:22:00Z

💚 Build Succeeded

Buildkite Build
Commit: 38f4960

History

💔 Build #37963 failed 82029cc
💔 Build #37848 failed 9c542d7

cc @marc-gr

elastic-vault-github-plugin-prod · 2026-02-11T13:55:10Z

Package windows - 3.4.1 containing this change is available at https://epr.elastic.co/package/windows/3.4.1/

…ogs when signed by common name. (elastic#17188) * Resolve defect where grok failure occurs because applocker event is signed by common name only. * Changelog entry, updating manifest with new version and add file.x509.subject.common_name into esc fields * Update changelog.yml Adding link to current PR. * ignore_emtpy_values to prevent empty fields. * Adding exported field reference. * Removing the ignore_empty_values as it doesn't function pre v9, and this will work for both 8 & 9. * Update changelog to remove the part that no longer exists. --------- Co-authored-by: Vihas Makwana <121151420+VihasMakwana@users.noreply.github.com>

Resolve defect where grok failure occurs because applocker event is s…

1512db7

…igned by common name only.

BrendanNurmi requested a review from a team as a code owner February 2, 2026 06:24

andrewkroh added Integration:windows Windows Team:Security-Windows Platform Security Windows Platform team [elastic/sec-windows-platform] labels Feb 2, 2026

andrewkroh added the bugfix Pull request that fixes a bug issue label Feb 2, 2026

Changelog entry, updating manifest with new version and add file.x509…

79108ea

….subject.common_name into esc fields

BrendanNurmi requested a review from a team as a code owner February 4, 2026 06:29

BrendanNurmi requested review from mauri870 and orestisfl February 4, 2026 06:29

pierrehilbert added the Team:Elastic-Agent-Data-Plane Agent Data Plane team [elastic/elastic-agent-data-plane] label Feb 4, 2026

pierrehilbert requested review from VihasMakwana and removed request for orestisfl February 4, 2026 07:13

adrianchen-es requested review from a team and removed request for a team February 8, 2026 23:58

adrianchen-es reviewed Feb 9, 2026

View reviewed changes

packages/windows/changelog.yml Outdated Show resolved Hide resolved

Update changelog.yml

9df5d63

Adding link to current PR.

adrianchen-es removed the request for review from a team February 9, 2026 02:55

mauri870 approved these changes Feb 9, 2026

View reviewed changes

VihasMakwana reviewed Feb 9, 2026

View reviewed changes

ignore_emtpy_values to prevent empty fields.

9c542d7

marc-gr self-assigned this Feb 10, 2026

marc-gr approved these changes Feb 10, 2026

View reviewed changes

VihasMakwana approved these changes Feb 10, 2026

View reviewed changes

Adding exported field reference.

cf7a276

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Feb 10, 2026

Merge branch 'main' into main

82029cc

VihasMakwana enabled auto-merge (squash) February 11, 2026 05:26

BrendanNurmi added 2 commits February 11, 2026 11:38

Removing the ignore_empty_values as it doesn't function pre v9, and t…

d37ae06

…his will work for both 8 & 9.

Merge branch 'main' of github.com:BrendanNurmi/integrations

7022f22

auto-merge was automatically disabled February 11, 2026 11:41
Head branch was pushed to by a user without write access

BrendanNurmi and others added 2 commits February 11, 2026 11:43

Update changelog to remove the part that no longer exists.

7c4fb22

Merge branch 'main' into main

38f4960

VihasMakwana merged commit 4246837 into elastic:main Feb 11, 2026
10 checks passed

	ignore_failure: true
	ignore_failure: true
	ignore_empty_values: true

Conversation

BrendanNurmi commented Feb 2, 2026

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

elasticmachine commented Feb 2, 2026

Uh oh!

elasticmachine commented Feb 4, 2026

Uh oh!

Uh oh!

adrianchen-es commented Feb 9, 2026

Uh oh!

VihasMakwana Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BrendanNurmi Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

VihasMakwana Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

BrendanNurmi Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

VihasMakwana left a comment

Choose a reason for hiding this comment

Uh oh!

adrianchen-es commented Feb 9, 2026

Uh oh!

marc-gr commented Feb 10, 2026

Uh oh!

VihasMakwana commented Feb 10, 2026

Uh oh!

BrendanNurmi commented Feb 10, 2026

Uh oh!

VihasMakwana commented Feb 11, 2026

Uh oh!

VihasMakwana commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BrendanNurmi commented Feb 11, 2026

Uh oh!

VihasMakwana commented Feb 11, 2026

Uh oh!

elastic-vault-github-plugin-prod bot commented Feb 11, 2026

🚀 Benchmarks report

Package windows 👍(5) 💚(1) 💔(4)

Uh oh!

elasticmachine commented Feb 11, 2026

💚 Build Succeeded

History

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Feb 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

VihasMakwana Feb 9, 2026 •

edited

Loading

VihasMakwana commented Feb 11, 2026 •

edited

Loading

Package `windows` 👍(5) 💚(1) 💔(4)