windows: reconcile forwarded event pipelines with their non-forwarded equivalents#7374
windows: reconcile forwarded event pipelines with their non-forwarded equivalents#7374efd6 merged 1 commit intoelastic:mainfrom
Conversation
32915eb to
08cc775
Compare
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
🌐 Coverage report
|
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
08cc775 to
41528cc
Compare
kcreddy
left a comment
There was a problem hiding this comment.
Minor suggestions. LGTM 👍🏼
There was a problem hiding this comment.
Should these also have a condition when these fields don't already exist?
such as if: ctx.user?.name == null or ctx.user?.domain == null ?
Because these are already being set earlier in the pipeline. Maybe that way we can remove ignore_failure
There was a problem hiding this comment.
I'd prefer to leave those changes for a future PR. This is just to get the datastreams into consensus.
There was a problem hiding this comment.
| if: ctx.event.code == "255" && ctx.winlog?.event_data?.ID != null && ctx.winlog?.event_data?.ID != "" | |
| if: ctx.event.code == "255" && ctx.winlog?.event_data?.ID != null && ctx.winlog.event_data.ID != "" |
Same for the other ifs in this pipeline.
41528cc to
df5430b
Compare
df5430b to
a4658db
Compare
|
Package windows - 1.35.0 containing this change is available at https://epr.elastic.co/search?package=windows |
What does this PR do?
See title.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots