Audit/Computer/Distribution Groups Management Events - ECS related.user field mapping #15217

janniten · 2019-12-19T15:18:16Z

Added Audit and Log Management related events, Computer Object Management Events, Distribution Groups Events - Change in user.name for user management events and related.user mapping

Event	Description
1100	The event logging service has shut down.
1102	The audit log was cleared.
1104	The security log is now full.
1105	Event log automatic backup.
1108	The event logging service encountered an error while processing an incoming event published from %1
4719	System audit policy was changed.
4741	A computer account was created.
4742	A computer account was changed.
4743	A computer account was deleted.
4744	A security-disabled local group was created.
4745	A security-disabled local group was changed.
4746	A member was added to a security-disabled local group.
4747	A member was removed from a security-disabled local group.
4748	A security-disabled local group was deleted.
4749	A security-disabled global group was created.
4750	A security-disabled global group was changed.
4751	A member was added to a security-disabled global group.
4752	A member was removed from a security-disabled global group.
4753	A security-disabled global group was deleted.
4759	A security-disabled universal group was created.
4760	A security-disabled universal group was changed.
4761	A member was added to a security-disabled universal group.
4762	A member was removed from a security-disabled universal group.
4763	A security-disabled global group was deleted.

New Events
Due to that Windows events are the source of information for Winlogbeat the events 1100,1102,1104,1105,1108 and 4719 has been added in order to monitor changes in the audit policy configuration, log deletion and other failures in the log subsystem.
For event 4719 a human readable description was added in order to know which setting was modified (winlog.event_data.SubCategory) and to which value (winlog.event_data.AuditPolicyChangesDescription)

Distribution Groups (Security-Disabled) Management Events were added. Those events are processed in the same way and with the same function that Security Groups (#14299). In order to add information about the nature of the group being managed the type (Security-Disabled/Security-Enabled) and scope (Local,Global,Universal) where added as winlog.group.type and winlog.group.scope

ComputerObject Management events were added

Changes to ECS mappings

In elastic/ecs#678 and elastic/ecs#589 we have been discussing how n-ary relationship between users in an event should be named and mapping into ECS.
In #13530 winlog.event_data.TargetUserName has been mapped to user.name but from the reasons exposed in elastic/ecs#678 and elastic/ecs#589 the mapping winlog.event_data.SubjectUserName -> user.name is more appropriate. This mapping was changed.

Also, with the adding of related fields in ECS 1.3 and specifically the related.user field (elastic/ecs#694) all the user names appearing in one event were mapped to the related user events.
Every time a SubjectUserName or TargetUserName is copied also is added to the related.user field, as well as other users appearing in the event.

Event test data were added for all events with the exception of event 1108 which I was not able to reproduce

elasticmachine · 2019-12-19T15:18:19Z

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

elasticmachine · 2019-12-19T15:18:19Z

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

leehinman

Thanks this is great.

I just had some thoughts about alternate names, let me know what you think.

Would you like me to generate the golden files for you?

leehinman · 2019-12-19T20:43:25Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

    // event.action Description Table
    var eventActionTypes = {
+        "1100": "logging-shutdown",


maybe "logging-service-shutdown"?

ok! I'll change it

leehinman · 2019-12-19T20:59:37Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

+        "4741": "added-computer-account",
+        "4742": "changed-computer-account",
+        "4743": "deleted-computer-account",
+        "4744": "added-group-account",


"added-distribution-group-account"?

leehinman · 2019-12-19T21:00:25Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

+        "4742": "changed-computer-account",
+        "4743": "deleted-computer-account",
+        "4744": "added-group-account",
+        "4745": "changed-group-account",


"changed-distribution-group-account"?

leehinman · 2019-12-19T21:01:56Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

+        "4743": "deleted-computer-account",
+        "4744": "added-group-account",
+        "4745": "changed-group-account",
+        "4746": "added-group-account-to",


"added-member-to-distribution-group"?

leehinman · 2019-12-19T21:02:41Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

+        "4744": "added-group-account",
+        "4745": "changed-group-account",
+        "4746": "added-group-account-to",
+        "4747": "deleted-group-account-from",


"deleted-member-from-distribution-group"?

leehinman · 2019-12-19T21:15:15Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

        "4754": "added-group-account",
        "4755": "modified-group-account",
        "4756": "added-group-account-to",
        "4757": "deleted-group-account-from",
        "4758": "deleted-group-account",
+        "4759": "added-group-account",


"added-distribution-group-account"?

leehinman · 2019-12-19T21:15:46Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

        "4754": "added-group-account",
        "4755": "modified-group-account",
        "4756": "added-group-account-to",
        "4757": "deleted-group-account-from",
        "4758": "deleted-group-account",
+        "4759": "added-group-account",
+        "4760": "changed-group-account",


"changed-distribution-group-account"

leehinman · 2019-12-19T21:16:36Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

        "4754": "added-group-account",
        "4755": "modified-group-account",
        "4756": "added-group-account-to",
        "4757": "deleted-group-account-from",
        "4758": "deleted-group-account",
+        "4759": "added-group-account",
+        "4760": "changed-group-account",
+        "4761": "added-group-account-to",


"added-member-to-distribution-group"?

leehinman · 2019-12-19T21:17:03Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

+        "4759": "added-group-account",
+        "4760": "changed-group-account",
+        "4761": "added-group-account-to",
+        "4762": "deleted-group-account-from",


"removed-member-from-distribution-group"?

leehinman · 2019-12-19T21:17:57Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

+        "4760": "changed-group-account",
+        "4761": "added-group-account-to",
+        "4762": "deleted-group-account-from",
+        "4763": "deleted-group-account",


"deleted-distribution-group-account"?

janniten · 2019-12-20T10:18:07Z

Thanks this is great.

I just had some thoughts about alternate names, let me know what you think.

Would you like me to generate the golden files for you?

Hi @leehinman ,
I have updated the action description with your suggestions. Algo I have changed the action description for normal groups in order to be consistent with your proposal.
Regarding to golden files, yes, please Can you generate the files for me?

Thank you!

leehinman

Found a bug while generating the golden files.

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

janniten

Found a bug while generating the golden files.

Hi @leehinman . I have removed the Group Type related fields and functions. Now it should work when generating golden files.
I think it does not add valuable information at the moment. I'll keep thinking in how to add that information for a future PR

leehinman · 2019-12-30T18:34:37Z

Found a bug while generating the golden files.

Hi @leehinman . I have removed the Group Type related fields and functions. Now it should work when generating golden files.
I think it does not add valuable information at the moment. I'll keep thinking in how to add that information for a future PR

@janniten Thanks. I was able to produce the golden files. I noticed one odd thing. In security-windows2016_4723_Password_Change.evtx the Subject & Target user are the same, so when they get added to the related.user list we get a duplicates. That seems like a bug to me. What do you think? I was thinking we could use a Set in addRelatedUser to make sure the values are unique. Sound OK to you?

+    "related": {
+      "user": [
+        "Administrator",
+        "Administrator"
+      ]

One other small thing. I noticed that

"process": {
      "name": "null"
}

Was in a few of the golden files. I think if we add

            if (exe) {
                evt.Put("process.name", path.basename(exe));
            }

to renameCommonAuthFields that will prevent the nulls

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

janniten · 2020-01-05T18:27:51Z

Hi @leehinman
I have fixed the duplicates issues in the related.users array. I was not able to use Sets due that they are available in ES6 (as far as I know we are using ES 5.1) . I use a prototype and anonymous function in order to define an "unique" function that returns the distinct elements of an array
If there is a better way to solve this, please let me know and I'll investigate.
I have also added the check for the null process in the renameCommonAuthFields function, but I use the following code in order to be consistent with the same check in other parts of the code.

 if (!exe) {
                return;
            }
 evt.Put("process.name", path.basename(exe));

How are the golden files generated? Next time I can try to generate the golden files for myself and detect errors in an early stage.
Thank you!

andrewkroh · 2020-01-06T16:17:27Z

If the problem is that you are getting duplicate values in a string array, then you can use event.AppendTo("related.user", "andrewkroh"). It will not add a duplicate value. See the documentation in https://www.elastic.co/guide/en/beats/winlogbeat/7.5/processor-script.html.

janniten · 2020-01-06T18:13:26Z

If the problem is that you are getting duplicate values in a string array, then you can use event.AppendTo("related.user", "andrewkroh"). It will not add a duplicate value. See the documentation in https://www.elastic.co/guide/en/beats/winlogbeat/7.5/processor-script.html.

Thank you @andrewkroh.
I have already modified the code in order to use the script processor AppendTo.

leehinman · 2020-01-07T18:16:41Z

Hi @leehinman
I have fixed the duplicates issues in the related.users array. I was not able to use Sets due that they are available in ES6 (as far as I know we are using ES 5.1) . I use a prototype and anonymous function in order to define an "unique" function that returns the distinct elements of an array
If there is a better way to solve this, please let me know and I'll investigate.
I have also added the check for the null process in the renameCommonAuthFields function, but I use the following code in order to be consistent with the same check in other parts of the code.
 if (!exe) {
                return;
            }
 evt.Put("process.name", path.basename(exe));
How are the golden files generated? Next time I can try to generate the golden files for myself and detect errors in an early stage.
Thank you!

Sorry about the Set suggestion, luckily @andrewkroh had a much better suggestion :-)

You can make the golden files by being in the "C:\Gopath\src\github.com\elastic\beats\x-pack\winlogbeat\module\security\test" directory and running "go test -update".

I found one more issue, in win2019 the SubcategoryGuid is lowercase, not uppercase so the addAuditInfo function wasn't adding subcategor and AuditPolicyChangesDescription. Easy fix with adding toUpperCase before doing the lookup. I'll add that to the same commit as the golden files.

janniten · 2020-01-09T07:11:53Z

Hi @leehinman
I have fixed the duplicates issues in the related.users array. I was not able to use Sets due that they are available in ES6 (as far as I know we are using ES 5.1) . I use a prototype and anonymous function in order to define an "unique" function that returns the distinct elements of an array
If there is a better way to solve this, please let me know and I'll investigate.
I have also added the check for the null process in the renameCommonAuthFields function, but I use the following code in order to be consistent with the same check in other parts of the code.
 if (!exe) {
                return;
            }
 evt.Put("process.name", path.basename(exe));
How are the golden files generated? Next time I can try to generate the golden files for myself and detect errors in an early stage.
Thank you!
Sorry about the Set suggestion, luckily @andrewkroh had a much better suggestion :-)

You can make the golden files by being in the "C:\Gopath\src\github.com\elastic\beats\x-pack\winlogbeat\module\security\test" directory and running "go test -update".

I found one more issue, in win2019 the SubcategoryGuid is lowercase, not uppercase so the addAuditInfo function wasn't adding subcategor and AuditPolicyChangesDescription. Easy fix with adding toUpperCase before doing the lookup. I'll add that to the same commit as the golden files.

Thank you @leehinman
Is it ready to merge or shall I modify something more?

neu5ron · 2020-01-10T05:08:42Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

+        if (!computer) {
+            return;
+    }
+        evt.Put("winlog.computer.name", computer.split(".")[0]);


I would not make this assumption (and the next line) that these are the computer and domain by splitting . - because many organizations can/do have multi level domains (ie: addomain.mydomain.local)

@neu5ron Does this make sense ?

evt.Put("winlog.computer.name", computer.split(".")[0]);
evt.Put("winlog.computer.domain", computer.split(".").slice(1).join('.');

If computer name is computer.addomain.mydomain.local

winlog.computer.name -> computer
winlog.computer.domain -> addomain.mydomain.local

Many of these windows logs will already have the domain, and for the one's that don't - if the log does not have the domain, unless one can explicitly know with certainty what the domain is then I would not try to pull the domain from the computer name.. Otherwise there can be false/incorrect information..

Hope that makes sense, if not let me know :)

@neu5ron you are correct. Thank you for your feedback.
If the computer is not joined or member of the domain I cannot fetch the domain name from the computer name.
In the case of the audit events like 1100, there is no other field in the event from where the domain name can be obtained; but to keep consistency and correctness I'll remove the addComputerData function

@neu5ron @leehinman I have removed the addComputerData function.
Please let me know if I have to modify something else
Thank you!

@janniten I think the PR needs to be rebased so there aren't merge conflicts and the CI tests will run.

@leehinman . Done!

@janniten sorry, I forgot to say "rebased off a more recent master" . It looks like this PR is still based on 9b48f2b from Wed Dec 18 11:43:56 2019 +0100. Unfortunately 586eac1 on Fri Dec 20 13:54:27 2019 -0600 makes changes to the golden files in the same place this PR does, so they conflict.

@leehinman Let me know I know is ok. Thank you!

leehinman · 2020-01-22T15:28:15Z

jenkins, test this

andrewkroh · 2020-01-25T01:34:55Z

jenkins, test this

andrewkroh

We need to update the list of event IDs in the module's asciidoc file. Can you do that in this PR please?
Thanks for your contribution.

andrewkroh · 2020-01-25T01:38:43Z

x-pack/winlogbeat/module/security/config/winlogbeat-security.js

+
+    var addRelatedUser= function(evt,user) {
+        var related_user = evt.Get("related.user");
+        if (!related_user) {


From and Elasticsearch document standpoint this is not necessary. You can just call evt.AppendTo in both cases and it will work. Whether the value is a string or an array or strings it's going to be handled the same way in ES.

I have modified the code in order to use directly the evt.AppentTo(related.user,user_to_add), less functions calls, less code, more efficiency :)
Thank you for the suggestion. I'll have this in mind for futures PRs

@andrewkroh some checks fail regarding to the documentation update.
I have added the events ID in \beats\x-pack\winlogbeat\module\security_meta\docs.asciidoc.
Shall I do something more?

janniten · 2020-01-27T11:35:59Z

We need to update the list of event IDs in the module's asciidoc file. Can you do that in this PR please?
Thanks for your contribution.

@andrewkroh I have aldready added the events ID. I have also added the ones in #14299 that alse were missing.

elasticmachine · 2020-02-05T04:17:16Z

Pinging @elastic/siem (Team:SIEM)

andrewkroh · 2020-02-05T04:17:44Z

jenkins, test this

…er ECS mapping

…d Fixes

…y evt.AppendTo

andrewkroh · 2020-02-05T06:28:24Z

jenkins, test this

andrewkroh · 2020-02-05T06:36:10Z

jenkins, test this

andrewkroh · 2020-02-05T21:34:05Z

🍾 Thank you @janniten for your contributions to Winlogbeat and ECS!

…module (elastic#15217) Added Audit and Log Management related events, Computer Object Management Events, Distribution Groups Events. Changed user.name field for user management events and related.user mapping. New Events Due to that Windows events are the source of information for Winlogbeat the events 1100, 1102, 1104, 1105, 1108 and 4719 has been added in order to monitor changes in the audit policy configuration, log deletion and other failures in the log subsystem. For event 4719, a human readable description was added in order to know which setting was modified (winlog.event_data.SubCategory) and to which value (winlog.event_data.AuditPolicyChangesDescription). Distribution Groups (Security-Disabled) Management Events were added. Those events are processed in the same way and with the same function that Security Groups (elastic#14299). In order to add information about the nature of the group being managed the type (Security-Disabled/Security-Enabled) and scope (Local,Global,Universal) where added as winlog.group.type and winlog.group.scope. ComputerObject Management events were also added. Changes to ECS mappings In elastic/ecs#678 and elastic/ecs#589 we have been discussing how n-ary relationship between users in an event should be named and mapping into ECS. In elastic#13530 winlog.event_data.TargetUserName has been mapped to user.name but from the reasons exposed in elastic/ecs#678 and elastic/ecs#589 the mapping winlog.event_data.SubjectUserName -> user.name is more appropriate. This mapping was changed. Also, with the adding of related fields in ECS 1.3 and specifically the related.user field (elastic/ecs#694) all the user names appearing in one event were mapped to the related user events. Every time a SubjectUserName or TargetUserName is copied also is added to the related.user field, as well as other users appearing in the event. Event test data were added for all events with the exception of event 1108 which I was not able to reproduce. Co-authored-by: Lee Hinman <57081003+leehinman@users.noreply.github.com> Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> (cherry picked from commit e624aef)

…ent Events - ECS related.user field mapping (#17090) Added Audit and Log Management related events, Computer Object Management Events, Distribution Groups Events. Changed user.name field for user management events and related.user mapping. New Events Due to that Windows events are the source of information for Winlogbeat the events 1100, 1102, 1104, 1105, 1108 and 4719 has been added in order to monitor changes in the audit policy configuration, log deletion and other failures in the log subsystem. For event 4719, a human readable description was added in order to know which setting was modified (winlog.event_data.SubCategory) and to which value (winlog.event_data.AuditPolicyChangesDescription). Distribution Groups (Security-Disabled) Management Events were added. Those events are processed in the same way and with the same function that Security Groups (#14299). In order to add information about the nature of the group being managed the type (Security-Disabled/Security-Enabled) and scope (Local,Global,Universal) where added as winlog.group.type and winlog.group.scope. ComputerObject Management events were also added. Changes to ECS mappings In elastic/ecs#678 and elastic/ecs#589 we have been discussing how n-ary relationship between users in an event should be named and mapping into ECS. In #13530 winlog.event_data.TargetUserName has been mapped to user.name but from the reasons exposed in elastic/ecs#678 and elastic/ecs#589 the mapping winlog.event_data.SubjectUserName -> user.name is more appropriate. This mapping was changed. Also, with the adding of related fields in ECS 1.3 and specifically the related.user field (elastic/ecs#694) all the user names appearing in one event were mapped to the related user events. Every time a SubjectUserName or TargetUserName is copied also is added to the related.user field, as well as other users appearing in the event. Event test data were added for all events with the exception of event 1108 which I was not able to reproduce. Co-authored-by: Lee Hinman <57081003+leehinman@users.noreply.github.com> Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> Co-authored-by: Anabella Cristaldi <33020901+janniten@users.noreply.github.com> (cherry picked from commit e624aef)

…18775) This PR adds two new dashboards related to events added in PRs (#12906, #14299, #15217, #17517) and implements some improvements to existing winlogbeat security module's dashboard New Dashboards User Logon Dashboard shows all the logon information. It allow us to keep track between logon and admin logons event between RDP connections and disconnections. Failed and Blocked Accounts allow us to keep track to failed logons and locked out account Existing Dashboards Added Distribution groups Events (#15217) Found that Event 4625 can be generated by two different providers: Microsoft-Windows-Security-Auditing and Microsoft-Windows-EventSystem. Filters to use only the event.code=4625 from Microsoft-Windows-Security-Auditing where added All Dashboards Markdown with links all the winlogbeat security dashboards where added (following the idea of Filebeats, Auditbeat dashboards) image Visualization that use may events (like group management related visualizations) were modified in order to use a saved search with the relevant events for that visualization as a source (instead of using individual filters for each visualization) Removed the margin between panels to look in the same way that other beats dashboards TSVB metrics were modified to use the Entire Time Range and to use eye-friendlier colors Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

…lastic#18775) This PR adds two new dashboards related to events added in PRs (elastic#12906, elastic#14299, elastic#15217, elastic#17517) and implements some improvements to existing winlogbeat security module's dashboard New Dashboards User Logon Dashboard shows all the logon information. It allow us to keep track between logon and admin logons event between RDP connections and disconnections. Failed and Blocked Accounts allow us to keep track to failed logons and locked out account Existing Dashboards Added Distribution groups Events (elastic#15217) Found that Event 4625 can be generated by two different providers: Microsoft-Windows-Security-Auditing and Microsoft-Windows-EventSystem. Filters to use only the event.code=4625 from Microsoft-Windows-Security-Auditing where added All Dashboards Markdown with links all the winlogbeat security dashboards where added (following the idea of Filebeats, Auditbeat dashboards) image Visualization that use may events (like group management related visualizations) were modified in order to use a saved search with the relevant events for that visualization as a source (instead of using individual filters for each visualization) Removed the margin between panels to look in the same way that other beats dashboards TSVB metrics were modified to use the Entire Time Range and to use eye-friendlier colors Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

…lastic#18775) This PR adds two new dashboards related to events added in PRs (elastic#12906, elastic#14299, elastic#15217, elastic#17517) and implements some improvements to existing winlogbeat security module's dashboard New Dashboards User Logon Dashboard shows all the logon information. It allow us to keep track between logon and admin logons event between RDP connections and disconnections. Failed and Blocked Accounts allow us to keep track to failed logons and locked out account Existing Dashboards Added Distribution groups Events (elastic#15217) Found that Event 4625 can be generated by two different providers: Microsoft-Windows-Security-Auditing and Microsoft-Windows-EventSystem. Filters to use only the event.code=4625 from Microsoft-Windows-Security-Auditing where added All Dashboards Markdown with links all the winlogbeat security dashboards where added (following the idea of Filebeats, Auditbeat dashboards) image Visualization that use may events (like group management related visualizations) were modified in order to use a saved search with the relevant events for that visualization as a source (instead of using individual filters for each visualization) Removed the margin between panels to look in the same way that other beats dashboards TSVB metrics were modified to use the Entire Time Range and to use eye-friendlier colors Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> (cherry picked from commit 7b9c535)

…18775) (#22598) This PR adds two new dashboards related to events added in PRs (#12906, #14299, #15217, #17517) and implements some improvements to existing winlogbeat security module's dashboard New Dashboards User Logon Dashboard shows all the logon information. It allow us to keep track between logon and admin logons event between RDP connections and disconnections. Failed and Blocked Accounts allow us to keep track to failed logons and locked out account Existing Dashboards Added Distribution groups Events (#15217) Found that Event 4625 can be generated by two different providers: Microsoft-Windows-Security-Auditing and Microsoft-Windows-EventSystem. Filters to use only the event.code=4625 from Microsoft-Windows-Security-Auditing where added All Dashboards Markdown with links all the winlogbeat security dashboards where added (following the idea of Filebeats, Auditbeat dashboards) image Visualization that use may events (like group management related visualizations) were modified in order to use a saved search with the relevant events for that visualization as a source (instead of using individual filters for each visualization) Removed the margin between panels to look in the same way that other beats dashboards TSVB metrics were modified to use the Entire Time Range and to use eye-friendlier colors Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> (cherry picked from commit 7b9c535) Co-authored-by: Anabella Cristaldi <33020901+janniten@users.noreply.github.com>

janniten requested a review from a team as a code owner December 19, 2019 15:18

houndci-bot reviewed Dec 19, 2019

View reviewed changes

leehinman reviewed Dec 19, 2019

View reviewed changes

leehinman requested changes Dec 20, 2019

View reviewed changes

x-pack/winlogbeat/module/security/config/winlogbeat-security.js Outdated Show resolved Hide resolved

leehinman self-assigned this Dec 20, 2019

janniten commented Dec 24, 2019

View reviewed changes

houndci-bot reviewed Jan 5, 2020

View reviewed changes

x-pack/winlogbeat/module/security/config/winlogbeat-security.js Outdated Show resolved Hide resolved

x-pack/winlogbeat/module/security/config/winlogbeat-security.js Outdated Show resolved Hide resolved

janniten requested a review from leehinman January 5, 2020 18:32

leehinman approved these changes Jan 7, 2020

View reviewed changes

neu5ron reviewed Jan 10, 2020

View reviewed changes

andrewkroh approved these changes Jan 25, 2020

View reviewed changes

andrewkroh added enhancement review Team:SIEM Winlogbeat labels Feb 5, 2020

Add Audit/Computer/Distribution Groups Management

649d3fb

janniten and others added 15 commits February 4, 2020 23:29

Add Audit/Computer/Distribution Groups Management Events - related.us…

4b29b7f

…er ECS mapping

Add Audit/Computer/Distribution Groups Management Events - related.us…

bdcc76f

…er ECS mapping

Add Audit/Computer/Distribution Groups Management Events - related.us…

bbff210

…er ECS mapping

event action description updated

6696124

event action description updated

05ff097

event action description updated

a8d7c6f

event action description updated

9415bfe

Removed Group Type

85f334a

Fix: related.users unique elements and null process name check

ba167ae

Fix: related.users unique elements and null process name check - Houn…

2fe69da

…d Fixes

Fix related.user duplicates using AppendTo from Script Processor

fff4412

removed addComputerData

946f8f5

Clean up whitespace

c652a81

update golden files and fix subcategoryGuid lookup

b89c009

Events ID added to asciidoc File - addRelatedUser function replaced b…

cd2abaf

…y evt.AppendTo

Update golden, Format Javascript

cd2716f

andrewkroh merged commit e624aef into elastic:master Feb 5, 2020

andrewkroh mentioned this pull request Mar 18, 2020

Cherry-pick #15217 to 7.x: Audit/Computer/Distribution Groups Management Events - ECS related.user field mapping #17090

Merged

andrewkroh added the v7.7.0 label Mar 18, 2020

janniten mentioned this pull request May 27, 2020

Winlogbeat Security new dashboards - Older dashboards improvements #18775

Merged

2 tasks

andrewkroh mentioned this pull request Nov 16, 2020

Cherry-pick #18775 to 7.x: Winlogbeat Security new dashboards - Older dashboards improvements #22598

Merged

2 tasks

Audit/Computer/Distribution Groups Management Events - ECS related.user field mapping #15217

Audit/Computer/Distribution Groups Management Events - ECS related.user field mapping #15217

Conversation

janniten commented Dec 19, 2019 • edited Loading

elasticmachine commented Dec 19, 2019

elasticmachine commented Dec 19, 2019

leehinman left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

janniten commented Dec 20, 2019

leehinman left a comment

Choose a reason for hiding this comment

janniten left a comment

Choose a reason for hiding this comment

leehinman commented Dec 30, 2019

janniten commented Jan 5, 2020

andrewkroh commented Jan 6, 2020

janniten commented Jan 6, 2020

leehinman commented Jan 7, 2020

janniten commented Jan 9, 2020 • edited Loading

Choose a reason for hiding this comment

janniten Jan 13, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leehinman commented Jan 22, 2020

andrewkroh commented Jan 25, 2020

andrewkroh left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

janniten commented Jan 27, 2020

elasticmachine commented Feb 5, 2020

andrewkroh commented Feb 5, 2020

andrewkroh commented Feb 5, 2020

andrewkroh commented Feb 5, 2020

andrewkroh commented Feb 5, 2020

janniten commented Dec 19, 2019 •

edited

Loading

janniten commented Jan 9, 2020 •

edited

Loading

janniten Jan 13, 2020 •

edited

Loading