Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #20564 to 7.x: [Winlogbeat] Set event.outcome based on raw keyword value #20611

Merged
merged 2 commits into from
Aug 24, 2020

Conversation

andrewkroh
Copy link
Member

@andrewkroh andrewkroh commented Aug 14, 2020

Cherry-pick of PR #20564 to 7.x branch. Original message:

What does this PR do?

Set the event.outcome value if the event contains the "audit failure" or "audit success" keywords.
The Keywords value in the XML is a hex value where each bit can represent a keyword. So this
checks if the audit success or audit failure bits are set then adds event.outcome as either
"success" or "failure".

I removed similar logic from the Security module since it is now redundant. That logic was based
on string matching of the keyword name (rather than number) so it had problems when the OS
language was not English.

Why is it important?

Fixes event.outcome for non-English based Windows systems.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

@andrewkroh andrewkroh requested a review from a team as a code owner August 14, 2020 16:14
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Aug 14, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Aug 14, 2020
Set the event.outcome value if the event contains the "audit failure" or "audit success" keywords.
The `Keywords` value in the XML is a hex value where each bit can represent a keyword. So this
checks if the audit success or audit failure bits are set then adds `event.outcome` as either
"success" or "failure".

I removed similar logic from the Security module since it is now redundant. That logic was based
on string matching of the keyword name (rather than number) so it had problems when the OS
language was not English.

Fixes elastic#20079

(cherry picked from commit 16ea8e2)
@elasticmachine
Copy link
Collaborator

elasticmachine commented Aug 14, 2020

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20611 updated]

  • Start Time: 2020-08-24T01:18:56.254+0000

  • Duration: 40 min 58 sec

Test stats 🧪

Test Results
Failed 0
Passed 277
Skipped 1
Total 278

@andrewkroh andrewkroh merged commit c1c966e into elastic:7.x Aug 24, 2020
@zube zube bot removed the [zube]: Done label Nov 23, 2020
@andrewkroh andrewkroh deleted the backport_20564_7.x branch January 14, 2022 14:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants