Skip to content

[system] Add Windows Firewall events#6534

Merged
ishleenk17 merged 23 commits intoelastic:mainfrom
LaZyDK:system-security-filtering-platform
Jul 19, 2023
Merged

[system] Add Windows Firewall events#6534
ishleenk17 merged 23 commits intoelastic:mainfrom
LaZyDK:system-security-filtering-platform

Conversation

@LaZyDK
Copy link
Copy Markdown
Contributor

@LaZyDK LaZyDK commented Jun 12, 2023 •
edited
Loading

What does this PR do?

Add Windows Firewall connection and packet drop events.

  • Add tests for event codes: 5152, 5156, 5157, 5158
  • Add source ECS fields
  • Add destination ECS fields
  • Add network ECS fields

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Related issues

@LaZyDK LaZyDK requested a review from a team as a code owner June 12, 2023 06:14
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jun 12, 2023 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-07-19T10:35:02.448+0000

  • Duration: 16 min 47 sec

Test stats 🧪

Test Results
Failed 0
Passed 151
Skipped 0
Total 151

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@jamiehynds jamiehynds requested a review from a team June 12, 2023 11:05
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jun 12, 2023

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

efd6
efd6 reviewed Jun 13, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the source of the events?

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jun 13, 2023

/test

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jun 13, 2023 •
edited
Loading

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (3/3) 💚
Files 100.0% (4/4) 💚
Classes 100.0% (4/4) 💚
Methods 63.415% (52/82) 👎 -28.252
Lines 99.863% (2924/2928) 👍 3.301
Conditionals 100.0% (0/0) 💚

@LaZyDK
Copy link
Copy Markdown
Contributor Author

LaZyDK commented Jun 13, 2023

What is the source of the events?

Events from the system.security dataset from one of our clusters where these audits have been enabled by GPO.

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jun 13, 2023

Thanks. We'll note that as "User-provided test cases" in the commit message.

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jun 13, 2023

/test

@LaZyDK
Copy link
Copy Markdown
Contributor Author

LaZyDK commented Jun 13, 2023

@efd6 Anything I need to do about BuildKite failing? I have not seen that one fail before.

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jun 13, 2023

It looks like it's not properly configured yet, so no.

@LaZyDK
Copy link
Copy Markdown
Contributor Author

LaZyDK commented Jun 13, 2023

Resolved conflicts. Ready to test.

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jun 13, 2023

/test

@LaZyDK
Copy link
Copy Markdown
Contributor Author

LaZyDK commented Jun 19, 2023

I am ready to fix conflicts if #6528 is pulled before this one :)

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jun 19, 2023

/test

@LaZyDK
Copy link
Copy Markdown
Contributor Author

LaZyDK commented Jun 23, 2023

Any updates?

@ebeahan
Copy link
Copy Markdown
Member

ebeahan commented Jun 23, 2023

/test

@LaZyDK
Copy link
Copy Markdown
Contributor Author

LaZyDK commented Jul 6, 2023

Ready for test

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jul 7, 2023

/test

@LaZyDK
Copy link
Copy Markdown
Contributor Author

LaZyDK commented Jul 7, 2023

@efd6 Resolved conflicts again.
Can we merge this before the next conflicts or is anything in the way of that?

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jul 10, 2023

@LaZyDK I'm afraid it's not under my control. We don't own this package.

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jul 10, 2023

/test

@jamiehynds
Copy link
Copy Markdown

jamiehynds commented Jul 12, 2023

@SubhrataK as the codeowners, could someone from your team please review/merge this PR. It's adding Windows Firewall Events to the Windows Security Events datastream in the System package.

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Jul 12, 2023

/test

ishleenk17
ishleenk17 approved these changes Jul 14, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@ishleenk17 ishleenk17 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@LaZyDK
Copy link
Copy Markdown
Contributor Author

LaZyDK commented Jul 18, 2023

Resolved conflicts and ran tests again. Ready to merge after CI tests.

@LaZyDK
Copy link
Copy Markdown
Contributor Author

LaZyDK commented Jul 19, 2023

@SubhrataK or @ishleenk17 I resolved conflicts again. Waiting for a merge.

@ishleenk17
Copy link
Copy Markdown
Member

ishleenk17 commented Jul 19, 2023

@SubhrataK or @ishleenk17 I resolved conflicts again. Waiting for a merge.

Will merge it once the CI passes. Thanks

@ishleenk17 ishleenk17 merged commit 7bf8692 into elastic:main Jul 19, 2023
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jul 19, 2023

Package system - 1.38.0 containing this change is available at https://epr.elastic.co/search?package=system

@nicpenning
Copy link
Copy Markdown
Contributor

nicpenning commented Jul 19, 2023 •
edited
Loading

I am of the opinion this needs to go to the Windows integration. What are your guys thoughts?

My plan was to introduce this data stream after we can get through AppLocker, but @LaZyDK beat me to it 😃

Update: Disregard, I suppose this is due to the Security channel being in the System channel anyways.

I will put my thoughts together in an issue for my reasons that System, Security and Application should also live in the Windows integration for simplifying managing windows event logs.

Thanks for the PR here!

@nicpenning
Copy link
Copy Markdown
Contributor

nicpenning commented Jul 19, 2023

Also, thanks for fixing that improper PR link, you da man!

@LaZyDK LaZyDK deleted the system-security-filtering-platform branch August 7, 2023 07:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@efd6 efd6 efd6 approved these changes

@ishleenk17 ishleenk17 ishleenk17 approved these changes

Assignees

No one assigned

Labels

Integration:system System

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@LaZyDK @elasticmachine @efd6 @ebeahan @jamiehynds @ishleenk17 @nicpenning @andrewkroh