Effective Process for library load events

[ricardo-estc]

Change Summary

Adding Effective process fields for library load events on macOS

Sample document:

    {
        "@timestamp": "2023-09-22T09:20:47.526181Z",
        "Effective_process": {
            "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTU2NS0xNjk1MTkyOTQ3",
            "executable": "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
            "name": "Terminal",
            "pid": 565
        },
        "agent": {
            "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
            "type": "endpoint",
            "version": "8.11.0-SNAPSHOT"
        },
        "data_stream": {
            "dataset": "endpoint.events.library",
            "namespace": "default",
            "type": "logs"
        },
        "dll": {
            "Ext": {
                "code_signature": [],
                "size": 115517
            },
            "code_signature": {
                "exists": false
            },
            "hash": {
                "md5": "3fddcb81cb0fc729a83d2c044bb3c090",
                "sha1": "45f986cf317f157183750f5bd38d27e1e0c206b3",
                "sha256": "d4925408363e940ef477f7bd0a64af3a2e9b01952f9b213c615eb6f039856a06"
            },
            "name": "inject.dylib",
            "path": "/Users/ricardo/endpoint-dev/LfsFileDeps/TestData/inject.dylib"
        },
        "ecs": {
            "version": "1.11.0"
        },
        "elastic": {
            "agent": {
                "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
            }
        },
        "event": {
            "action": "load",
            "category": [
                "library"
            ],
            "created": "2023-09-22T09:20:47.526181Z",
            "dataset": "endpoint.events.library",
            "id": "NEpQ6FhJ/OvnXoMd+++++1ef",
            "kind": "event",
            "module": "endpoint",
            "outcome": "unknown",
            "sequence": 12336,
            "type": [
                "start"
            ]
        },
        "group": {
            "Ext": {
                "real": {
                    "id": 20,
                    "name": "staff"
                }
            },
            "id": 20,
            "name": "staff"
        },
        "host": {
            "architecture": "x86_64",
            "hostname": "ricardos-macbook-pro.local",
            "id": "dabadaba-0000-0000-0000-000000000000",
            "ip": [
                "127.0.0.1",
                "::1",
                "fe80::1",
                "fe80::aede:48ff:fe00:1122",
                "192.168.0.180",
                "fe80::45a:7c46:fd5a:efd8",
                "fe80::b838:77ff:febf:9ec6",
                "fe80::97c0:ae69:3604:6c69",
                "fe80::fdad:a07b:73a:d006",
                "fe80::ce81:b1c:bd2c:69e",
                "fe80::d422:9e62:c70b:f3ab",
                "fe80::7871:31a5:37db:fcb1",
                "fe80::5b8a:b903:95ea:c9aa",
                "fe80::c2c9:45a3:779c:54c4"
            ],
            "mac": [
                "ac-de-48-00-11-22",
                "aa-66-5a-1e-22-50",
                "88-66-5a-1e-22-50",
                "ba-38-77-bf-9e-c6",
                "82-21-2c-80-bc-05",
                "82-21-2c-80-bc-04",
                "82-21-2c-80-bc-01",
                "82-21-2c-80-bc-00"
            ],
            "name": "ricardos-macbook-pro.local",
            "os": {
                "Ext": {
                    "variant": "macOS"
                },
                "family": "macos",
                "full": "macOS 13.5",
                "kernel": "Darwin Kernel Version 22.6.0: Wed Jul  5 22:21:56 PDT 2023; root:xnu-8796.141.3~6/RELEASE_X86_64",
                "name": "macOS",
                "platform": "macos",
                "type": "macos",
                "version": "13.5"
            }
        },
        "message": "Endpoint DLL load event",
        "process": {
            "Ext": {
                "ancestry": [
                    "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTY3MDUzLTE2OTUzNzQzMjY=",
                    "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTk0Ni0xNjk1MTkyOTU0",
                    "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTk0NS0xNjk1MTkyOTU0",
                    "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTU2NS0xNjk1MTkyOTQ3",
                    "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTEtMTY5NTE5MjkyNw==",
                    "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTAtMTY5NTE5MjkyNw=="
                ]
            },
            "code_signature": {
                "exists": true,
                "signing_id": "macos_signature_loader-555549442ad58f4199e636ed89d1eaf377b0c139",
                "status": "code failed to satisfy specified code requirement(s)",
                "team_id": "",
                "trusted": false
            },
            "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTY3NDE1LTE2OTUzNzQ0NDc=",
            "executable": "/Users/ricardo/endpoint-dev/LfsFileDeps/TestData/macos_signature_loader",
            "name": "macos_signature_loader",
            "pid": 67415
        },
        "user": {
            "Ext": {
                "real": {
                    "id": 501,
                    "name": "ricardo"
                }
            },
            "id": 501,
            "name": "ricardo"
        }
    }

[ricardo-estc]

@ferullo do we need to add docs for the library events on macOS? I will be adding them in 8.11

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-09-22T09:27:40.990+0000

• Duration: 7 min 18 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[pzl]

changes look ok from my end,

please add sample values into package/endpoint/data_stream/library/sample_event.json to add coverage to these fields for automated testing in this repo

[ferullo]

@ferullo do we need to add docs for the library events on macOS? I will be adding them in 8.11

Yes, but they'll get caught when I add all the other event doc updates for 8.11. So you should be ignore adding the custom_documentation/ entries.

[ricardo-estc]

@pzl added sample values

[elasticmachine]

Package endpoint - 8.11.0 containing this change is available at https://epr.elastic.co/search?package=endpoint