Skip to content

[System] Add processing for event ID's 4797, 5379, 5380, 5381, and 5382#5085

Closed
MakoWish wants to merge 1 commit intoelastic:mainfrom
MakoWish:add_event_ids
Closed

[System] Add processing for event ID's 4797, 5379, 5380, 5381, and 5382#5085
MakoWish wants to merge 1 commit intoelastic:mainfrom
MakoWish:add_event_ids

Conversation

@MakoWish
Copy link
Copy Markdown
Contributor

@MakoWish MakoWish commented Jan 23, 2023 •
edited
Loading

Type of change

  • Enhancement

What does this PR do?

This PR adds event parsing to the System Integration's Security Ingest Pipeline for Event ID's 4797, 5379, 5380, 5381, and 5382. This PR is mirroring recent changes to Winlogbeat parsing in PR #34294

Why is it important?

These Event ID's are quite common in our environment, so ensuring the correct event.action is populated will help identify the nature of the event at a quick glance.

Related issues

@MakoWish MakoWish requested a review from a team as a code owner January 23, 2023 19:44
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jan 23, 2023

❕ Build Aborted

The PR is not allowed to run in the CI yet

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Start Time: 2023-01-23T19:44:48.819+0000

  • Duration: 3 min 51 sec

Steps errors 2

Expand to view the steps failures

Load a resource file from a library
  • Took 0 min 0 sec . View more details here
  • Description: approval-list/elastic/integrations.yml
Error signal
  • Took 0 min 0 sec . View more details here
  • Description: githubApiCall: The REST API call https://api.github.com/orgs/elastic/members/MakoWish return the message : java.lang.Exception: httpRequest: Failure connecting to the service https://api.github.com/orgs/elastic/members/MakoWish : httpRequest: Failure connecting to the service https://api.github.com/orgs/elastic/members/MakoWish : Code: 404Error: {"message":"User does not exist or is not a member of the organization","documentation_url":"https://docs.github.com/rest/reference/orgs#check-organization-membership-for-a-user"}

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

This was referenced Jan 23, 2023
Merged
Merged
@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jan 24, 2023 •
edited
Loading

@MakoWish If you don't mind, I'll send an alternative proposal since there is more here to do than just updating the pipeline.

@efd6 efd6 mentioned this pull request Jan 24, 2023
Merged
4 tasks
@andrewkroh andrewkroh changed the title Add processing for event ID's 4797, 5379, 5380, 5381, and 5382 [System] Add processing for event ID's 4797, 5379, 5380, 5381, and 5382 Jan 26, 2023
@efd6 efd6 closed this in #5087 Jan 26, 2023
@MakoWish MakoWish deleted the add_event_ids branch January 26, 2023 20:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fearful-symmetry fearful-symmetry Awaiting requested review from fearful-symmetry fearful-symmetry was automatically assigned from elastic/elastic-agent-data-plane

@faec faec Awaiting requested review from faec faec was automatically assigned from elastic/elastic-agent-data-plane

Assignees

No one assigned

Labels

Integration:system System

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@MakoWish @elasticmachine @efd6 @andrewkroh