o365: Fix processing of ModifiedProperties field (#23777)

A bug was causing entries for the ModifiedProperties field to be dropped.
elastic · Feb 1, 2021 · 1f8a2e6 · 1f8a2e6
1 parent d59f780
commit 1f8a2e6
Show file tree

Hide file tree

Showing 3 changed files with 102 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -378,6 +378,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix syslog header parsing in infoblox module. {issue}23272[23272] {pull}23273[23273]
 - Fix concurrent modification exception in Suricata ingest node pipeline. {pull}23534[23534]
 - Fix Zoom module parameters for basic auth and url path. {pull}23779[23779]
+- Fix handling of ModifiedProperties field in Office 365. {pull}23777[23777]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/o365/audit/config/pipeline.js b/x-pack/filebeat/module/o365/audit/config/pipeline.js
@@ -157,7 +157,7 @@ function makeDictFromModifiedPropertyArray(options) {
             if (src[i] == null
                 || (name=src[i].Name) == null
                 || (newValue=src[i].NewValue) == null
-                || (oldValue=src[i].OldValue)) continue;
+                || (oldValue=src[i].OldValue) == null) continue;
             name = validFieldName(name);
             if (name in dict) {
                 if (dict[name].NewValue instanceof Array) {