Add User/Group Management Dashboards to Security module (#15236)

Add dashboards to the Winlogbeat Security module for visualizing User Management events and Group Management events. There are two versions of each dashboard - one with and without TSVB (time series visual builder) visualizations. This updates the Winlogbeat build to include the dashboards from the module directories. Add it adds winlog.event_data.MemberName to the fields.yml because it's used in the user management dashboard and should be in the fields.yml so the dashboards load without error. Co-authored-by: Andrew Kroh <[email protected]>
elastic · Feb 5, 2020 · d866824 · d866824
1 parent 03d62cc
commit d866824
Show file tree

Hide file tree

Showing 8 changed files with 17,181 additions and 2 deletions.
diff --git a/winlogbeat/_meta/fields.common.yml b/winlogbeat/_meta/fields.common.yml
@@ -162,6 +162,10 @@
               type: keyword
             - name: MaximumPerformancePercent
               type: keyword
+            - name: MemberName
+              type: keyword
+            - name: MemberSid
+              type: keyword
             - name: MinimumPerformancePercent
               type: keyword
             - name: MinimumThrottlePercent

diff --git a/winlogbeat/docs/fields.asciidoc b/winlogbeat/docs/fields.asciidoc
@@ -6967,6 +6967,20 @@ type: keyword
 
 --
 
+*`winlog.event_data.MemberName`*::
++
+--
+type: keyword
+
+--
+
+*`winlog.event_data.MemberSid`*::
++
+--
+type: keyword
+
+--
+
 *`winlog.event_data.MinimumPerformancePercent`*::
 +
 --

diff --git a/winlogbeat/include/fields.go b/winlogbeat/include/fields.go
diff --git a/winlogbeat/scripts/mage/update.go b/winlogbeat/scripts/mage/update.go
@@ -56,7 +56,12 @@ func (Update) Config() error {
 // Dashboards collects all the dashboards and generates index patterns.
 func (Update) Dashboards() error {
 	mg.Deps(fb.FieldsYML)
-	return devtools.KibanaDashboards()
+	switch SelectLogic {
+	case devtools.XPackProject:
+		return devtools.KibanaDashboards(devtools.OSSBeatDir("module"), devtools.XPackBeatDir("module"))
+	default:
+		return devtools.KibanaDashboards(devtools.OSSBeatDir("module"))
+	}
 }
 
 // Fields updates all fields files (.go, .yml).