Skip to content

system,windows: add parent process ID to process creation events#2966

Merged
efd6 merged 8 commits intoelastic:mainfrom
efd6:winppid
Apr 27, 2022
Merged

system,windows: add parent process ID to process creation events#2966
efd6 merged 8 commits intoelastic:mainfrom
efd6:winppid

Conversation

@efd6
Copy link
Copy Markdown
Contributor

@efd6 efd6 commented Apr 1, 2022 •
edited
Loading

What does this PR do?

This adds the parent's process ID to event 4688 on Windows (create process).

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • Review each commit individually for comfort.

How to test this PR locally

This can be tested with elastic-package in the system and windows packages.

Related issues

Screenshots

@efd6 efd6 self-assigned this Apr 1, 2022
@efd6 efd6 requested a review from a team as a code owner April 1, 2022 03:09
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 1, 2022

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@efd6 efd6 requested a review from a team April 1, 2022 03:10
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 1, 2022 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-04-06T02:03:01.112+0000

  • Duration: 15 min 57 sec

Test stats 🧪

Test Results
Failed 0
Passed 396
Skipped 0
Total 396

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

r00tu53r
r00tu53r reviewed Apr 1, 2022
View reviewed changes
@jsoriano jsoriano requested a review from a team April 1, 2022 08:36
@andrewkroh andrewkroh mentioned this pull request Apr 5, 2022
Merged
4 tasks
@andrewkroh
Copy link
Copy Markdown
Member

andrewkroh commented Apr 7, 2022

@elastic/integrations Can we please get a review on this as it touches both the system and windows integrations.

@jsoriano
Copy link
Copy Markdown
Member

jsoriano commented Apr 26, 2022

Can someone from @elastic/elastic-agent-data-plane please take a look to the changes on system and windows integrations?

kaiyan-sheng
kaiyan-sheng approved these changes Apr 27, 2022
View reviewed changes
Copy link
Copy Markdown

@kaiyan-sheng kaiyan-sheng left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@efd6 efd6 merged commit 2e413ea into elastic:main Apr 27, 2022
@efd6 efd6 deleted the winppid branch April 27, 2022 22:09
@andrewkroh andrewkroh mentioned this pull request May 11, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cmacknz cmacknz cmacknz approved these changes

@andrewkroh andrewkroh andrewkroh approved these changes

+2 more reviewers

@r00tu53r r00tu53r r00tu53r left review comments

@kaiyan-sheng kaiyan-sheng kaiyan-sheng approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@efd6 efd6

Labels

enhancement New feature or request Integration:system System Integration:windows Windows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@efd6 @elasticmachine @andrewkroh @jsoriano @cmacknz @kaiyan-sheng @r00tu53r