Update security telemetry allowlist. (#103471)

pjhampton · kibanamachine · commit 70ed37d1d956 · 2021-06-29T09:24:33.000Z
diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts
@@ -41,6 +41,7 @@ describe('TelemetryEventsSender', () => {
             version: '100',
           },
           file: {
+            extension: '.exe',
             size: 3,
             created: 0,
             path: 'X',
@@ -72,6 +73,7 @@ describe('TelemetryEventsSender', () => {
             name: 'foo.exe',
             nope: 'nope',
             executable: null, // null fields are never allowlisted
+            working_directory: '/some/usr/dir',
           },
           Target: {
             process: {
@@ -101,6 +103,7 @@ describe('TelemetryEventsSender', () => {
             version: '100',
           },
           file: {
+            extension: '.exe',
             size: 3,
             created: 0,
             path: 'X',
@@ -126,6 +129,7 @@ describe('TelemetryEventsSender', () => {
           },
           process: {
             name: 'foo.exe',
+            working_directory: '/some/usr/dir',
           },
           Target: {
             process: {
diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
@@ -307,6 +307,7 @@ const allowlistProcessFields: AllowlistFields = {
     },
   },
   thread: true,
+  working_directory: true,
 };
 
 // Allow list for event-related fields, which can also be nested under events[]
@@ -322,6 +323,7 @@ const allowlistBaseEventFields: AllowlistFields = {
   },
   event: true,
   file: {
+    extension: true,
     name: true,
     path: true,
     size: true,
