Skip to content

Commit

Permalink
Fix related.ip field (#24892) (#25534)
Browse files Browse the repository at this point in the history
- [Winlogbeat] fix related.ip field in renameCommonAuthFields function

Co-authored-by: Lee E. Hinman <[email protected]>
(cherry picked from commit d0887fd)

Co-authored-by: Anabella Cristaldi <[email protected]>
  • Loading branch information
mergify[bot] and janniten authored May 12, 2021
1 parent 2cb2fc1 commit 43a09c6
Show file tree
Hide file tree
Showing 6 changed files with 19 additions and 2 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -357,6 +357,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
*Winlogbeat*

- Change `event.code` and `winlog.event_id` from int to keyword. {pull}25176[25176]
- Fix related.ip field in renameCommonAuthFields {pull}24892[24892]

*Functionbeat*

Expand Down
14 changes: 12 additions & 2 deletions x-pack/winlogbeat/module/security/config/winlogbeat-security.js
Original file line number Diff line number Diff line change
Expand Up @@ -1850,7 +1850,6 @@ var security = (function () {
{from: "winlog.event_data.AccountName", to: "user.name"},
{from: "winlog.event_data.AccountDomain", to: "user.domain"},
{from: "winlog.event_data.ClientAddress", to: "source.ip", type: "ip"},
{from: "winlog.event_data.ClientAddress", to: "related.ip", type: "ip"},
{from: "winlog.event_data.ClientName", to: "source.domain"},
{from: "winlog.event_data.LogonID", to: "winlog.logon.id"},
],
Expand All @@ -1861,6 +1860,12 @@ var security = (function () {
var user = evt.Get("winlog.event_data.AccountName");
evt.AppendTo('related.user', user);
})
.Add(function(evt) {
var ip = evt.Get("source.ip");
if (ip) {
evt.Put('related.ip', ip);
}
})
.Build();

var addServiceFields = new processor.Chain()
Expand Down Expand Up @@ -2028,7 +2033,6 @@ var security = (function () {
{from: "winlog.event_data.ProcessId", to: "process.pid", type: "long"},
{from: "winlog.event_data.ProcessName", to: "process.executable"},
{from: "winlog.event_data.IpAddress", to: "source.ip", type: "ip"},
{from: "winlog.event_data.ClientAddress", to: "related.ip", type: "ip"},
{from: "winlog.event_data.IpPort", to: "source.port", type: "long"},
{from: "winlog.event_data.WorkstationName", to: "source.domain"},
],
Expand All @@ -2047,6 +2051,12 @@ var security = (function () {
}
evt.Put("process.name", path.basename(exe));
})
.Add(function(evt) {
var ip = evt.Get("source.ip");
if (ip) {
evt.Put('related.ip', ip);
}
})
.Build();

var renameNewProcessFields = new processor.Chain()
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
"level": "information"
},
"related": {
"ip": "::1",
"user": "at_adm"
},
"source": {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
"level": "information"
},
"related": {
"ip": "::1",
"user": "at_adm"
},
"source": {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
"level": "information"
},
"related": {
"ip": "::1",
"user": "DC_TEST2K12$"
},
"source": {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,7 @@
"pid": 448
},
"related": {
"ip": "127.0.0.1",
"user": [
"vagrant",
"VAGRANT-2012-R2$"
Expand Down Expand Up @@ -858,6 +859,7 @@
"pid": 2812
},
"related": {
"ip": "10.0.2.2",
"user": [
"vagrant",
"VAGRANT-2012-R2$"
Expand Down Expand Up @@ -1449,6 +1451,7 @@
"pid": 836
},
"related": {
"ip": "::1",
"user": "bosch"
},
"source": {
Expand Down

0 comments on commit 43a09c6

Please sign in to comment.