-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add processing of event ID's 5140 and 5145 to mirror Elastic Agent's … #34352
Conversation
…Security Ingest Pipeline for System Integration
This pull request does not have a backport label.
To fixup this pull request, you need to add the backport labels for the needed
|
/test |
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
Co-authored-by: Dan Kortschak <[email protected]>
Co-authored-by: Dan Kortschak <[email protected]>
Co-authored-by: Dan Kortschak <[email protected]>
Co-authored-by: Dan Kortschak <[email protected]>
Co-authored-by: Dan Kortschak <[email protected]>
/test |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks
Type of change
What does this PR do?
While creating #5085, I realized Elastic Agent includes parsing for two additional event ID's not included in the Winlogbeat Security Ingest Pipeline. This PR adds event parsing to the Security Ingest Pipeline for Winlogbeat for Event ID's 4040 and 4045.
Why is it important?
This PR will create a 1:1 match of event ID coverage between Winlogbeat's Security module and Elastic Agent's
system
Integration for Windows Security events.Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Related issues