Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrate Winlogbeat to ECS #10169

Closed
wants to merge 1 commit into from
Closed

Migrate Winlogbeat to ECS #10169

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 17 additions & 7 deletions winlogbeat/_meta/fields.common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
description: >
Contains common fields available in all event types.
fields:
# Is this event.type?
webmat marked this conversation as resolved.
Show resolved Hide resolved
- name: type
required: true
description: >
Expand Down Expand Up @@ -31,7 +32,8 @@
activity.

- name: computer_name
type: keyword
type: alias
path: host.name
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rather host.hostname. host.name is meant to be overridable.

required: true
description: >
The name of the computer that generated the record. When using Windows
Expand All @@ -49,7 +51,8 @@
earlier versions of Windows.

- name: event_id
type: long
type: alias
path: event.id
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not the same as ECS event.id (at least in my understanding). This more like an identifier for the log message in the application. For example 1102 is "The audit log was cleared".

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

record_number is closer to event.id but it's only unique given some additional constraints. If we wanted to populate event.id I'd do a fast hash of @timestamp + computer_name + log_name + record_number.

required: true
description: >
The event identifier. The value is specific to the source of the event.
Expand All @@ -61,22 +64,26 @@
The keywords are used to classify an event.

- name: log_name
type: keyword
# This does not exist yet
path: log.name
type: alias
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to understand better the relation between log_name and source_name. Is there a place where we can see sample data? I haven't found anything obvious.

required: true
description: >
The name of the event log from which this record was read. This value is
one of the names from the `event_logs` collection in the configuration.

- name: level
type: keyword
type: alias
path: log.level
required: false
description: >
The level of the event. There are five levels of events that can be
logged: Success, Information, Warning, Error, Audit Success, and Audit
Failure.

- name: message_error
type: keyword
type: alias
path: error.message
required: false
description: >
The error that occurred while reading and formatting the message from
Expand Down Expand Up @@ -116,7 +123,8 @@
the event.

- name: process_id
type: long
type: alias
path: process.id
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

process.pid

required: false
description: >
The process_id identifies the process that generated the event.
Expand All @@ -138,7 +146,8 @@
operating systems) is written to this field.

- name: thread_id
type: long
type: alias
path: process.thread.id
required: false
description: >
The thread_id identifies the thread that generated the event.
Expand All @@ -152,6 +161,7 @@
`event_data`.

- name: user.identifier
# Is this user.id?
webmat marked this conversation as resolved.
Show resolved Hide resolved
type: keyword
required: false
example: S-1-5-21-3541430928-2051711210-1391384369-1001
Expand Down
18 changes: 9 additions & 9 deletions winlogbeat/eventlog/eventlog.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,30 +82,30 @@ type Record struct {
func (e Record) ToEvent() beat.Event {
m := common.MapStr{
"type": e.API,
"log_name": e.Channel,
"source_name": e.Provider.Name,
"computer_name": e.Computer,
"record_number": strconv.FormatUint(e.RecordID, 10),
"event_id": e.EventIdentifier.ID,
}
m.Put("event.id", e.EventIdentifier.ID)
m.Put("log.name", e.Channel)
m.Put("source.name", e.Channel)
m.Put("host.name", e.Computer)

addOptional(m, "xml", e.XML)
addOptional(m, "provider_guid", e.Provider.GUID)
addOptional(m, "version", e.Version)
addOptional(m, "level", e.Level)
addOptional(m, "log.level", e.Level)
addOptional(m, "task", e.Task)
addOptional(m, "opcode", e.Opcode)
addOptional(m, "keywords", e.Keywords)
addOptional(m, "message", sys.RemoveWindowsLineEndings(e.Message))
addOptional(m, "message_error", e.RenderErr)
addOptional(m, "error.message", e.RenderErr)

// Correlation
addOptional(m, "activity_id", e.Correlation.ActivityID)
addOptional(m, "related_activity_id", e.Correlation.RelatedActivityID)

// Execution
addOptional(m, "process_id", e.Execution.ProcessID)
addOptional(m, "thread_id", e.Execution.ThreadID)
addOptional(m, "process.id", e.Execution.ProcessID)
addOptional(m, "process.thread.id", e.Execution.ThreadID)
addOptional(m, "processor_id", e.Execution.ProcessorID)
addOptional(m, "session_id", e.Execution.SessionID)
addOptional(m, "kernel_time", e.Execution.KernelTime)
Expand Down Expand Up @@ -139,7 +139,7 @@ func (e Record) ToEvent() beat.Event {
// MapStr.
func addOptional(m common.MapStr, key string, v interface{}) {
if m != nil && !isZero(v) {
m[key] = v
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few lines up...

e.TimeCreated.SystemTime is used to populate @timestamp. That's the time the event was originally logged. So it would be nice to populate event.created with the current time.

m.Put(key) = v
}
}

Expand Down