Add translate_sid processor to Winlogbeat #16013
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Pinging @elastic/siem (Team:SIEM) |
houndci-bot
reviewed
Feb 3, 2020
This was referenced Feb 3, 2020
andrewkroh
added
the
needs_backport
urso
reviewed
Feb 6, 2020
|
Metricbeat and Filebeat allow for generic events to be pushed to them. E.g. |
The `translate_sid` processor translates a Windows security identifier (SID) into an account name. It retrieves the name of the account associated with the SID, the first domain on which the SID is found, and the type of account. Closes elastic#7451
I moved the processor to libbeat to make it available to all Beats. And because it's not available to all Beats it now makes sense to include the docs by default in all Beats.
andrewkroh
force-pushed
the
feature/wlb/translate-sid
branch
from
a946043 to
63c5787
Compare
|
@urso I moved the processor to libbeat so any Beat can use it now. |
urso
approved these changes
Feb 25, 2020
andrewkroh
added
v7.7.0
and removed
needs_backport
andrewkroh
added a commit
to andrewkroh/beats
that referenced
this pull request
Mar 10, 2020
* Add translate_sid processor to Winlogbeat The `translate_sid` processor translates a Windows security identifier (SID) into an account name. It retrieves the name of the account associated with the SID, the first domain on which the SID is found, and the type of account. Closes elastic#7451 (cherry picked from commit 65b31bd)
andrewkroh
added a commit
that referenced
this pull request
Mar 12, 2020
…16941) * Add translate_sid processor (#16013) * Add translate_sid processor to Winlogbeat The `translate_sid` processor translates a Windows security identifier (SID) into an account name. It retrieves the name of the account associated with the SID, the first domain on which the SID is found, and the type of account. Closes #7451 (cherry picked from commit 65b31bd)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The
translate_sidprocessor translates a Windows security identifier (SID)into an account name. It retrieves the name of the account associated with the
SID, the first domain on which the SID is found, and the type of account.
Closes #7451