Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Winlogbeat] Add pe fields to Sysmon module #22217

Merged
merged 1 commit into from
Oct 28, 2020
Merged

[Winlogbeat] Add pe fields to Sysmon module #22217

merged 1 commit into from
Oct 28, 2020

Conversation

leehinman
Copy link
Contributor

What does this PR do?

adds following fields to Sysmon ProcessCreate and LoadImage events

  • file.pe.company
  • file.pe.description
  • file.pe.file_version
  • file.pe.original_file_name
  • file.pe.product
  • process.pe.company
  • process.pe.description
  • process.pe.file_version
  • process.pe.original_file_name
  • process.pe.product

Why is it important?

pe.original_file_name is especially useful in determining if file has
been renamed since it was signed

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

go test

Related issues

@leehinman leehinman requested a review from a team as a code owner October 28, 2020 03:08
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Oct 28, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Oct 28, 2020
@leehinman
Add pe fields to Sysmon module
dbbac96 
- ProcessCreate event
- LoadImage event

Closes elastic#17335
@leehinman leehinman force-pushed the 17335_winlogbeat_pe_orig_filename branch from e172dcb to dbbac96 Compare October 28, 2020 03:12
@elasticmachine
Copy link
Collaborator

elasticmachine commented Oct 28, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [marc-gr commented: jenkins run tests]

  • Start Time: 2020-10-28T13:12:43.269+0000

  • Duration: 24 min 56 sec

Test stats 🧪

Test Results
Failed 0
Passed 92
Skipped 0
Total 92

Steps errors 1

Expand to view the steps failures

  • Name: Compress

    • Description: tar --exclude=test-build-artifacts-x-pack/winlogbeat-Lint-linux && ubuntu-18.tgz -czf test-build-artifacts-x-pack/winlogbeat-Lint-linux && ubuntu-18.tgz .

    • Duration: 0 min 0 sec

    • Start Time: 2020-10-28T13:27:41.155+0000

    • log

@marc-gr
Copy link
Contributor

marc-gr commented Oct 28, 2020

jenkins run tests

@leehinman leehinman merged commit 310dbf6 into elastic:master Oct 28, 2020
@leehinman leehinman mentioned this pull request Oct 28, 2020
Merged
3 tasks
@leehinman leehinman added v7.11.0 and removed needs_backport PR is waiting to be backported to other branches. labels Oct 28, 2020
@leehinman leehinman deleted the 17335_winlogbeat_pe_orig_filename branch October 28, 2020 15:00
leehinman added a commit to leehinman/beats that referenced this pull request Oct 29, 2020
@leehinman
Add pe fields to Sysmon module (elastic#22217)
7257505 
- ProcessCreate event
- LoadImage event

Closes elastic#17335

(cherry picked from commit 310dbf6)
v1v added a commit to v1v/beats that referenced this pull request Oct 29, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/windows-7-64
3f9b862 
* upstream/master: (93 commits)
  Update commands used in the quick start (elastic#22248)
  Add interval documentation to `monitor` metricset (elastic#22152)
  [CI] enable x-pack/packetbeat in the CI (elastic#22252)
  Fix awscloudwatch input documentation (elastic#22247)
  Add support for different Azure Cloud environments in the metricbeat azure module (elastic#21044)
  [CI] support windows-2008-r2 (elastic#19791)
  protect against accessing undefined variables in sysmon module (elastic#22236)
  [CI] archive only if failed steps (elastic#22220)
  Add pe fields to Sysmon module (elastic#22217)
  [CI][flaky] Support 7.x branches and PRs (elastic#22197)
  Perfmon - Fix regular expressions to comply to multiple parentheses in instance name and object (elastic#22146)
  ci: improve linting speed (elastic#22103)
  Move cloudfoundry tags with metadata to common metadata fields (elastic#22150)
  [Docs] Update custom beat docs (elastic#22194)
  [Ingest Manager] Agent fix snapshot download for upgrade (elastic#22175)
  Update shared-autodiscover.asciidoc (elastic#21827)
  [DOCS] Warn about compression and Azure Event Hub for Kafka (elastic#21578)
  [CI][flaky] reporting for PRs in GitHub (elastic#21853)
  [Packetbeat] Create x-pack magefile (elastic#21979)
  [Elastic Agent] Fix deb/rpm installation (elastic#22153)
  ...
v1v added a commit to v1v/beats that referenced this pull request Oct 29, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/windows-7-32
a776d4d 
* upstream/master: (93 commits)
  Update commands used in the quick start (elastic#22248)
  Add interval documentation to `monitor` metricset (elastic#22152)
  [CI] enable x-pack/packetbeat in the CI (elastic#22252)
  Fix awscloudwatch input documentation (elastic#22247)
  Add support for different Azure Cloud environments in the metricbeat azure module (elastic#21044)
  [CI] support windows-2008-r2 (elastic#19791)
  protect against accessing undefined variables in sysmon module (elastic#22236)
  [CI] archive only if failed steps (elastic#22220)
  Add pe fields to Sysmon module (elastic#22217)
  [CI][flaky] Support 7.x branches and PRs (elastic#22197)
  Perfmon - Fix regular expressions to comply to multiple parentheses in instance name and object (elastic#22146)
  ci: improve linting speed (elastic#22103)
  Move cloudfoundry tags with metadata to common metadata fields (elastic#22150)
  [Docs] Update custom beat docs (elastic#22194)
  [Ingest Manager] Agent fix snapshot download for upgrade (elastic#22175)
  Update shared-autodiscover.asciidoc (elastic#21827)
  [DOCS] Warn about compression and Azure Event Hub for Kafka (elastic#21578)
  [CI][flaky] reporting for PRs in GitHub (elastic#21853)
  [Packetbeat] Create x-pack magefile (elastic#21979)
  [Elastic Agent] Fix deb/rpm installation (elastic#22153)
  ...
leehinman added a commit that referenced this pull request Nov 3, 2020
@leehinman
Add pe fields to Sysmon module (#22217) (#22231)
75662cc 
- ProcessCreate event
- LoadImage event

Closes #17335

(cherry picked from commit 310dbf6)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marc-gr marc-gr marc-gr approved these changes

Assignees
No one assigned
Labels
enhancement v7.11.0 Winlogbeat
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Winlogbeat] Sysmon module - populate pe.original_file_name
3 participants
@leehinman @elasticmachine @marc-gr