[Windows] Sysmon Event ID 26: FileDeleteDetected (File Delete logged) is mapping Process Hashes instead of File Hashes#8879
[Windows] Sysmon Event ID 26: FileDeleteDetected (File Delete logged) is mapping Process Hashes instead of File Hashes#8879efd6 merged 12 commits intoelastic:mainfrom nicpenning:patch-1
Conversation
|
I did not run tests but am curious to see if it passes them. Surgically updated expected tests, changelog, manifest and of course pipeline. Not ideal but won't have access to a IDE for awhile. Feel free to rip and replace as needed. 🧑🏻⚕️ |
|
Pinging @elastic/elastic-agent (Team:Elastic-Agent) |
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
|
/test |
efd6
left a comment
There was a problem hiding this comment.
Tests pass locally after the changelog is fixed.
...s/data_stream/forwarded/_dev/test/pipeline/test-sysmon-operational-events.json-expected.json
Outdated
Show resolved
Hide resolved
Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
packages/windows/changelog.yml
Outdated
| @@ -1,4 +1,9 @@ | |||
| # newer versions go on top | |||
| - version: "1.44.0" | |||
There was a problem hiding this comment.
I think this requires discussion; if this is a breaking change, then the version should be bumped in major. ISTM that it is a bug though.
There was a problem hiding this comment.
Ahh yeah - I just said breaking because if dashboards, rules and other resource used these fields in error then they will no longer be working, hence broken. But it was a stretch. I am good with this being a bug and we increment a minor. I am happy with whatever you think is best.
There was a problem hiding this comment.
I went ahead and went the bugfix route. If this isn't ideal, then we can go enhancement and leave it at the 1.44 and update the category as needed.
|
/test |
🚀 Benchmarks reportTo see the full report comment with |
|
/test |
efd6
left a comment
There was a problem hiding this comment.
Logic LGTM. Leaving decision of breaking change/bug fix categorization to elastic-agent team.
|
@nicpenning Would you mind resolving the conflict? |
|
Yes. How does it look now? |
|
/test |
💚 Build Succeeded
|
Should resolve #8878
Proposed commit message
Fix file hash parsing for file delete detected
Checklist
changelog.ymlfile.Author's Checklist
To be continued... More work needed before merging. This was a quick PR to show potential changes.