From d4e193df3be412c0c39d7558f5e0ca7418ad25f7 Mon Sep 17 00:00:00 2001 From: Lee Hinman <57081003+leehinman@users.noreply.github.com> Date: Mon, 25 Jan 2021 16:02:40 -0600 Subject: [PATCH] Remove 4912 evtx from testing (#23669) - causing failures on Win 7,8, 2008R2 & 2012R2 --- .../test/testdata/4912_WindowsSrv2016.evtx | Bin 69632 -> 0 bytes .../4912_WindowsSrv2016.evtx.golden.json | 70 ------------------ 2 files changed, 70 deletions(-) delete mode 100644 x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx delete mode 100644 x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json diff --git a/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx b/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx deleted file mode 100644 index 15a93a947a21e60b5c5de31a57cd5c14625ff795..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 69632 zcmeI1X>3$g6vxk-c{99DXX((?1w{d=QnaN7i(ql7v{jVCXe(kYN~JB7PG@QtC^j0R z7!$YP8WQ|KOpL)T8e<^DsF9fP!Qd7l7-M2$;zCRmF&H%&|L4B zIrrXkf9KqDZ>P=ao|fKpw-l#y(-QrS$4&P{#-f># z16IPaBx?Pz?6MF29-4ow;fmYtt4lhcM_#LX9V=0(#-!{(Ru`ygPc$UWvO&5fBf}^^ ziYL6@YkV&el2PfGG#ZD{5VGoJ9mIxZK(3ZK_zcM!)O16p6Zsmvdr>neS(LKU1IZec zv#6gV8_|}*d#=>tb0u=MvH;)R$EP1ECmv*6-cjQ~Mol&XtzEn#7egZK$LgM?VYwaa)tS9DN2NSy$CEPM zmdOx>Tbc)6jKj=bp(7RINK(oqfmX*njzo+cx|r00lD1>na#e7;*45XRyKU1pKYHZg zKWW6wg;QI)uNx5=GVcRc6z2XuDiZtNi>|HEyD*qlgN+8UF06YaRIi?}#%lP-2-}^6<~CyAB`uC55e{ zQm|kXvU=ufYI;cB%Maa6#??DfuTilXZ#{$6%O1hYnp^8EvD z|9M{jQ)s;u{nz5jz=>4rpc|m-yq=fjXO6*VJK=0=vEGTRwcXXKrb=#VzF!0z#f@k> z&!7nuI#bBi@q{zEWOZ-o)++25cKe-zYjHpSSPH}to0MyVr)70s%gN(BF9kjI1X=@K z{b-=89)i{mX14`*2pk;cG6h=%HFzpaIf^_EMYDZ0k5fTYr~+Tl?s|K)WB%BVxxv~e zj$)5Ag0~*{89aI@51Q2~AwNPq(27WdbgEG*;gSn*DYy!;Me}ts51%@eZ+>Qf^v&Kw z$@jlZrP@=qwXWoqQV(e)y$8v>LqmN#XMEUEHFw4Cna_^?{RirFuYl1{$fjV)0!D@B zlYdmYmj*uo>jqM1-;U1b;||ID~Z+g|H56`vDlzb=2h; z*S*md8dRm)aBa8;?@=5Kdc*63Lk*&)$(Vn@9Fd!#MI{*JZ)qx-1&2!MD5#$YBdUHQ zs9k0x+zXTI`tFfkgBkSr6q$y&EZ5_KcB>J*%sm+ItEXw5$V0DAuQ)d09(^kQI2pWla~`>H;NL(zMEEf5tmL`s?jq_RLuF%HhN(ZeM2QTZ(DWO*WdiL_1v=?ZH~DG zstMKfE^s}`qt@!wgS-0UMr+ahU6*WIxoGRrcRru-$`_xa+S^}yk=6ZG5S#Pb4`bXx zjGRBB{`d|^F(rxY@6#)cO zTmM^bcFru=RxSR2?ix(ZL;@s00wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZr zKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{ z0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2J zBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZr zKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{ z0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2J zBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZrKmsH{0wh2JBtQZr uKmsH{0wh2Jrzg-WS;q^BKV2OF diff --git a/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json deleted file mode 100644 index 5e9a933c7bb8..000000000000 --- a/x-pack/winlogbeat/module/security/test/testdata/4912_WindowsSrv2016.evtx.golden.json +++ /dev/null @@ -1,70 +0,0 @@ -[ - { - "@timestamp": "2020-08-18T14:36:41.2936839Z", - "event": { - "action": "per-user-audit-policy-changed", - "category": [ - "iam", - "configuration" - ], - "code": 4912, - "kind": "event", - "module": "security", - "outcome": "success", - "provider": "Microsoft-Windows-Security-Auditing", - "type": [ - "admin", - "change" - ] - }, - "host": { - "name": "WIN-BVM4LI1L1Q6.TEST.local" - }, - "log": { - "level": "information" - }, - "related": { - "user": "Administrator" - }, - "user": { - "domain": "TEST", - "id": "S-1-5-21-2024912787-2692429404-2351956786-500", - "name": "Administrator" - }, - "winlog": { - "activity_id": "{65461d39-753f-0000-731d-46653f75d601}", - "api": "wineventlog", - "channel": "Security", - "computer_name": "WIN-BVM4LI1L1Q6.TEST.local", - "event_data": { - "AuditPolicyChanges": "%%8452", - "CategoryId": "%%8276", - "SubcategoryGuid": "{0cce924a-69ae-11d9-bed3-505054503030}", - "SubcategoryId": "%%13317", - "SubjectDomainName": "TEST", - "SubjectLogonId": "0x44d7d", - "SubjectUserName": "Administrator", - "SubjectUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500", - "TargetUserSid": "S-1-5-21-2024912787-2692429404-2351956786-500" - }, - "event_id": 4912, - "keywords": [ - "Audit Success" - ], - "logon": { - "id": "0x44d7d" - }, - "opcode": "Info", - "process": { - "pid": 780, - "thread": { - "id": 3300 - } - }, - "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", - "provider_name": "Microsoft-Windows-Security-Auditing", - "record_id": 123917, - "task": "Audit Policy Change" - } - } -] \ No newline at end of file