Skip to content

[Windows] Add event.category and event.type to Sysmon Operational #5980

Merged
kcreddy merged 1 commit intoelastic:mainfrom
kcreddy:5976-windows_sysmon-add-event-values
Apr 25, 2023
Merged

[Windows] Add event.category and event.type to Sysmon Operational #5980
kcreddy merged 1 commit intoelastic:mainfrom
kcreddy:5976-windows_sysmon-add-event-values

Conversation

@kcreddy
Copy link
Copy Markdown
Contributor

@kcreddy kcreddy commented Apr 24, 2023

What does this PR do?

Adds event.category and event.type to Sysmon Operational pipeline which were missed when new EventIDs were incorporated in #4038

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Related issues

@kcreddy kcreddy self-assigned this Apr 24, 2023
@kcreddy kcreddy added bug Something isn't working, use only for issues Integration:windows Windows labels Apr 24, 2023
@kcreddy kcreddy force-pushed the 5976-windows_sysmon-add-event-values branch from faf0d68 to 97aa995 Compare April 24, 2023 13:00
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 24, 2023 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-04-24T13:01:25.676+0000

  • Duration: 17 min 24 sec

Test stats 🧪

Test Results
Failed 0
Passed 129
Skipped 0
Total 129

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 24, 2023

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (4/4) 💚
Files 87.5% (7/8) 👎 -12.5
Classes 87.5% (7/8) 👎 -12.5
Methods 83.516% (76/91) 👎 -12.136
Lines 92.803% (5145/5544) 👍 3.141
Conditionals 100.0% (0/0) 💚

@kcreddy kcreddy marked this pull request as ready for review April 24, 2023 13:51
@kcreddy kcreddy requested review from a team as code owners April 24, 2023 13:51
@kcreddy kcreddy requested review from cmacknz and rdner April 24, 2023 13:51
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 24, 2023

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

bhapas
bhapas approved these changes Apr 25, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@bhapas bhapas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kcreddy kcreddy merged commit 7bc8e23 into elastic:main Apr 25, 2023
@kcreddy kcreddy deleted the 5976-windows_sysmon-add-event-values branch April 25, 2023 07:18
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 25, 2023

Package windows - 1.20.1 containing this change is available at https://epr.elastic.co/search?package=windows

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bhapas bhapas bhapas approved these changes

@rdner rdner Awaiting requested review from rdner rdner is a code owner automatically assigned from elastic/elastic-agent-data-plane

@cmacknz cmacknz Awaiting requested review from cmacknz cmacknz is a code owner automatically assigned from elastic/elastic-agent-data-plane

Assignees

@kcreddy kcreddy

Labels

bug Something isn't working, use only for issues Integration:windows Windows

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Windows] Sysmon Operational missing event.category and event.type

3 participants

@kcreddy @elasticmachine @bhapas