[windows] AppLocker - Add more ECS fields, remove beta flag, add dashboard by nicpenning · Pull Request #7229 · elastic/integrations

nicpenning · 2023-08-02T23:01:29Z

Enhancement

What does this PR do?

This PR extends the initial applocker data stream for exes and dlls by adding some more ECS fields, cleanup of uneeded processors, adds a dashboard and removes the [beta] flag.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

…ashboard_ga

elasticmachine · 2023-08-02T23:05:01Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-08-04T16:12:37.603+0000
Duration: 18 min 9 sec

Test stats 🧪

Test	Results
Failed	0
Passed	135
Skipped	0
Total	135

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

nicpenning · 2023-08-03T00:15:49Z

Any chance I can request @efd6 to assist in reviewing? He did a good job on the initial data stream creation for this Integration and this PR is a continuation of that.

packages/windows/data_stream/applocker_exe_and_dll/elasticsearch/ingest_pipeline/default.yml

nicpenning · 2023-08-03T01:49:17Z

Please let me know what you think about the new fields. In the meanwhile, this should be good to test.

…ashboard_ga

nicpenning · 2023-08-04T00:34:10Z

Just checking in on this 😀

andrewkroh

I think this data fits perfectly with the descriptions for these fields. I thinking we could use these fields instead of winlog.fqbn. WDYT?

file.pe.file_version
file.pe.original_file_name
file.pe.product

...m/applocker_exe_and_dll/_dev/test/pipeline/test-events-applocker-exe-8003.json-expected.json

elasticmachine · 2023-08-04T14:34:18Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

nicpenning · 2023-08-04T15:26:11Z

I think this data fits perfectly with the descriptions for these fields. I thinking we could use these fields instead of winlog.fqbn. WDYT?

file.pe.file_version

file.pe.original_file_name

file.pe.product

Pushed these changes.

andrewkroh · 2023-08-04T15:30:27Z

/test

elasticmachine · 2023-08-04T15:51:17Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`5/5`)	💚
Files	88.889% (`8/9`)	👎 -11.111
Classes	88.889% (`8/9`)	👎 -11.111
Methods	84.158% (`85/101`)	👍 10.825
Lines	92.751% (`5323/5739`)	👎 -7.249
Conditionals	100.0% (`0/0`)	💚

nicpenning · 2023-08-04T15:56:58Z

Thank you, Andrew! Next up, AppLocker MSI/Script data stream 😀

packages/windows/data_stream/applocker_exe_and_dll/elasticsearch/ingest_pipeline/default.yml

…ch/ingest_pipeline/default.yml Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

andrewkroh · 2023-08-04T16:12:21Z

/test

elasticmachine · 2023-08-04T20:22:05Z

Package windows - 1.29.0 containing this change is available at https://epr.elastic.co/search?package=windows

nicpenning added 24 commits July 26, 2023 20:27

Update ecs.yml

3ced19d

Update winlog.yml

75d0320

Update default.yml

d2f443f

Update test-events-applocker-exe-8003.json-expected.json

54115c2

Update default.yml

a9c5a8b

Update test-events-applocker-exe-8003.json

809cb75

Update test-events-applocker-exe-8003.json-expected.json

6b87c71

Merge branch 'elastic:main' into applocker_exe_and_dll_pipeline_and_d…

9ca89d0

…ashboard_ga

Update default.yml

a7aee22

Merge branch 'elastic:main' into applocker_exe_and_dll_pipeline_and_d…

0885814

…ashboard_ga

Add files via upload

0553ee5

Merge branch 'elastic:main' into applocker_exe_and_dll_pipeline_and_d…

25c80cb

…ashboard_ga

Update windows-b28aaad0-2f2d-11ee-acdc-45d0efa0889d.json

08f3355

Update windows-b28aaad0-2f2d-11ee-acdc-45d0efa0889d.json

79cb5a1

Add files via upload

a920bb9

Update manifest.yml

ceda7f3

Update changelog.yml

0495d35

Update README.md

92f16f3

Delete applocker-windows-audit-and-blocked.png

d7cee05

Add files via upload

732a8fc

Update manifest.yml

3cf9a25

Update manifest.yml

6c7a81b

Remove un-needed processing for user name, domain, and sequence

abe0336

Remove event codes from the default

a921a64

nicpenning requested review from a team as code owners August 2, 2023 23:01

nicpenning requested review from fearful-symmetry and rdner August 2, 2023 23:01

Update changelog.yml

35083fa

nicpenning changed the title ~~[windows] Add more ECS fields, remove beta flag, add dashboard~~ [windows] AppLocker - Add more ECS fields, remove beta flag, add dashboard Aug 3, 2023

andrewkroh reviewed Aug 3, 2023

View reviewed changes

packages/windows/data_stream/applocker_exe_and_dll/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved

nicpenning added 3 commits August 2, 2023 20:16

Use more ECS fields for x509 and remove fqbn from root of winlog

beef8f7

Improve naming for FQBN attributes

fdce5d5

Fix dashboard bug and use correct filepath for file name

8d695fd

Merge branch 'elastic:main' into applocker_exe_and_dll_pipeline_and_d…

8086654

…ashboard_ga

nicpenning mentioned this pull request Aug 3, 2023

[windows] AppLocker Events for Windows Integration #6979

Closed

4 tasks

Conform to more ECS fields

9be31a1

andrewkroh reviewed Aug 4, 2023

View reviewed changes

andrewkroh added enhancement New feature or request Integration:windows Windows Team:Security-External Integrations labels Aug 4, 2023

andrewkroh approved these changes Aug 4, 2023

View reviewed changes

andrewkroh reviewed Aug 4, 2023

View reviewed changes

packages/windows/data_stream/applocker_exe_and_dll/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved

nicpenning and others added 3 commits August 4, 2023 11:05

Update packages/windows/data_stream/applocker_exe_and_dll/elasticsear…

439abc3

…ch/ingest_pipeline/default.yml Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

Update default.yml

da0d077

Finish adding anchors - default.yml

c714c27

andrewkroh merged commit b50c740 into elastic:main Aug 4, 2023

nicpenning deleted the applocker_exe_and_dll_pipeline_and_dashboard_ga branch August 4, 2023 21:22

Conversation

nicpenning commented Aug 2, 2023

What does this PR do?

Checklist

Uh oh!

elasticmachine commented Aug 2, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

Uh oh!

nicpenning commented Aug 3, 2023

Uh oh!

Uh oh!

nicpenning commented Aug 3, 2023

Uh oh!

nicpenning commented Aug 4, 2023

Uh oh!

andrewkroh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Aug 4, 2023

Uh oh!

nicpenning commented Aug 4, 2023

Uh oh!

andrewkroh commented Aug 4, 2023

Uh oh!

elasticmachine commented Aug 4, 2023

🌐 Coverage report

Uh oh!

nicpenning commented Aug 4, 2023

Uh oh!

Uh oh!

andrewkroh commented Aug 4, 2023

Uh oh!

elasticmachine commented Aug 4, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

elasticmachine commented Aug 2, 2023 •

edited

Loading