Fix preserve original event.

elastic · Jun 19, 2024 · d9e44b8 · d9e44b8
1 parent ef96a8c
commit d9e44b8
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 2 deletions.
diff --git a/packages/windows/changelog.yml b/packages/windows/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.45.1"
+  changes:
+    - description: Add missing preserve_original_event tag when toggled on for AppLocker.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/99999
 - version: "1.45.0"
   changes:
     - description: Add powershell.file.script_block_hash and powershell.file.script_block_signature fields.

diff --git a/packages/windows/data_stream/applocker_exe_and_dll/agent/stream/winlog.yml.hbs b/packages/windows/data_stream/applocker_exe_and_dll/agent/stream/winlog.yml.hbs
@@ -16,8 +16,16 @@ tags:
 {{/each}}
 {{/if}}
 {{#if preserve_original_event}}
-include_xml: true
+  - preserve_original_event
+{{/if}}
+{{else}}
+{{#if preserve_original_event}}
+tags:
+  - preserve_original_event
 {{/if}}
+{{/if}}
+{{#if preserve_original_event}}
+include_xml: true
 processors:
 - translate_sid:
     field: winlog.event_data.MemberSid

diff --git a/packages/windows/manifest.yml b/packages/windows/manifest.yml
@@ -1,6 +1,6 @@
 name: windows
 title: Windows
-version: 1.45.0
+version: 1.45.1
 description: Collect logs and metrics from Windows OS and services with Elastic Agent.
 type: integration
 categories: