Skip to content

system/security: add mapping for Windows events 4797, 5379, 5380, 5381, and 5382#5087

Merged
efd6 merged 1 commit intoelastic:mainfrom
efd6:5085-system-security
Jan 26, 2023
Merged

system/security: add mapping for Windows events 4797, 5379, 5380, 5381, and 5382#5087
efd6 merged 1 commit intoelastic:mainfrom
efd6:5085-system-security

Conversation

@efd6
Copy link
Copy Markdown
Contributor

@efd6 efd6 commented Jan 24, 2023 •
edited
Loading

What does this PR do?

This brings the system security data stream into parity with winlogbeat after elastic/beats#34294.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Run

elastic-package test

in the system packages root.

Related issues

Screenshots

@efd6 efd6 requested a review from a team January 24, 2023 00:51
@efd6 efd6 self-assigned this Jan 24, 2023
@efd6 efd6 force-pushed the 5085-system-security branch from 6c13866 to b2d9839 Compare January 24, 2023 00:52
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jan 24, 2023 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-01-24T02:27:46.959+0000

  • Duration: 16 min 49 sec

Test stats 🧪

Test Results
Failed 0
Passed 194
Skipped 0
Total 194

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@efd6 efd6 force-pushed the 5085-system-security branch from b2d9839 to 26df615 Compare January 24, 2023 02:27
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jan 24, 2023

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (3/3) 💚
Files 100.0% (4/4) 💚
Classes 100.0% (4/4) 💚
Methods 60.759% (48/79) 👎 -39.241
Lines 99.533% (2771/2784) 👍 17.378
Conditionals 100.0% (0/0) 💚

@efd6 efd6 marked this pull request as ready for review January 24, 2023 02:54
@efd6 efd6 requested a review from a team as a code owner January 24, 2023 02:54
@efd6 efd6 requested review from belimawr and rdner January 24, 2023 02:54
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jan 24, 2023

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@rdner
Copy link
Copy Markdown
Member

rdner commented Jan 24, 2023

@efd6 Could you add more information about how it was tested ("How to test PR locally" in the description)?

@efd6
Copy link
Copy Markdown
Contributor Author

efd6 commented Jan 26, 2023

@rdner PTAL

@efd6 efd6 merged commit 11657e2 into elastic:main Jan 26, 2023
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jan 26, 2023

Package system - 1.23.0 containing this change is available at https://epr.elastic.co/search?package=system

@nicpenning
Copy link
Copy Markdown
Contributor

nicpenning commented Jan 27, 2023

Thank you!!

@efd6 efd6 deleted the 5085-system-security branch February 5, 2025 22:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rdner rdner rdner approved these changes

@andrewkroh andrewkroh andrewkroh approved these changes

@belimawr belimawr Awaiting requested review from belimawr belimawr was automatically assigned from elastic/elastic-agent-data-plane

Assignees

@efd6 efd6

Labels

enhancement New feature or request Integration:system System

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@efd6 @elasticmachine @rdner @nicpenning @andrewkroh