Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Winlogbeat] ECS 1.9 user.changes.*, user.effective.*, user.target.* #26509

Merged
merged 14 commits into from
Oct 19, 2021
Merged

[Winlogbeat] ECS 1.9 user.changes.*, user.effective.*, user.target.* #26509

Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
71d916b
Add Winlogbeat Security Module Doc
janniten Jan 26, 2021
2a610c4
Merge branch 'elastic:master' into master
janniten Jun 27, 2021
8a5db71
ECS 1.9 new user fields
janniten Jun 27, 2021
f7acd39
Add Documentation
janniten Jun 27, 2021
4788f66
Update x-pack/winlogbeat/module/security/config/winlogbeat-security.js
janniten Jul 17, 2021
6e84caf
Update x-pack/winlogbeat/module/security/config/winlogbeat-security.js
janniten Jul 17, 2021
2167b12
Suggeted changes by adriansr
janniten Jul 20, 2021
0727ab0
Merge branch 'elastic:master' into master
janniten Oct 13, 2021
4bd4bca
Merge remote-tracking branch 'upstream/master' into ecs_1.9
janniten Oct 13, 2021
3c67931
Regenerate golden files
marc-gr Oct 14, 2021
6a94aa4
Fix changelog and remove ~/go/src/github.com/elastic/integrations/pac…
marc-gr Oct 18, 2021
8d3c800
Fix typo
marc-gr Oct 18, 2021
782721b
Regenerate test files
marc-gr Oct 18, 2021
8941a65
Check for empty values on target user
marc-gr Oct 18, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -439,6 +439,8 @@ for a few releases. Please use other tools provided by Elastic to fetch data fro
- Add source.ip validation for event ID 4778 in the Security module. {issue}19627[19627]
- Protect against accessing undefined variables in Sysmon module. {issue}22219[22219] {pull}22236[22236]
- Protect against accessing an undefined variable in Security module. {pull}22937[22937]
- Fix related.ip field in renameCommonAuthFields {pull}24892[24892]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this line got in with the merge, can we remove it if it is the case?

- Add ECS 1.9 new users fields {pull}26509[26509]
- Tolerate faults when Windows Event Log session is interrupted {issue}27947[27947] {pull}28191[28191]

*Functionbeat*
Expand Down
77 changes: 61 additions & 16 deletions x-pack/winlogbeat/module/security/config/winlogbeat-security.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1907,14 +1907,14 @@ var security = (function () {

var copyTargetUser = function(evt) {
var targetUserId = evt.Get("winlog.event_data.TargetUserSid");
if (!targetUserId) targetUserId = evt.Get("winlog.event_data.TargetSid");
if (targetUserId) {
if (evt.Get("user.id")) evt.Put("user.target.id", targetUserId);
else evt.Put("user.id", targetUserId);
}

var targetUserName = evt.Get("winlog.event_data.TargetUserName");
if (targetUserName) {
if (/.@*/.test(targetUserName)) {
if (targetUserName.indexOf('@')>0) {
targetUserName = targetUserName.split('@')[0];
}

Expand All @@ -1930,6 +1930,49 @@ var security = (function () {
}
}

var copyTargetUserToEffective = new processor.Chain()
.Convert({
fields: [
{from: "winlog.event_data.TargetUserSid", to: "user.effective.id"},
{from: "winlog.event_data.TargetUserName", to: "user.effective.name"},
{from: "winlog.event_data.TargetDomainName", to: "user.effective.domain"},
],
ignore_missing: true,
})
.Add(function(evt) {
var user = evt.Get("winlog.event_data.TargetUserName");
if (user) {
if (user.indexOf('@')>0) {
user = user.split('@')[0];
evt.Put('user.effective.name', user);
}
evt.AppendTo('related.user', user);
}
})
.Build();

var copyTargetUserToTarget = new processor.Chain()
.Convert({
fields: [
{from: "winlog.event_data.TargetSid", to: "user.target.id"},
{from: "winlog.event_data.TargetUserName", to: "user.target.name"},
{from: "winlog.event_data.TargetDomainName", to: "user.target.domain"},
],
ignore_missing: true,
})
.Add(function(evt) {
var user = evt.Get("winlog.event_data.TargetUserName");
if (user) {
if (user.indexOf('@')>0) {
user = user.split('@')[0];
evt.Put('user.target.name', user);
}
evt.AppendTo('related.user', user);
}
})
.Build();


var copyMemberToUser = function(evt) {
var member = evt.Get("winlog.event_data.MemberName");
if (!member) {
Expand All @@ -1940,6 +1983,11 @@ var security = (function () {

evt.AppendTo("related.user", userName);
evt.Put("user.target.name", userName);

var domainName = member.split(',')[3];
if (domainName) {
evt.Put("user.target.domain", domainName.replace('DC=', '').replace('dc=', ''));
}
}

var copyTargetUserToGroup = new processor.Chain()
Expand Down Expand Up @@ -2130,10 +2178,11 @@ var security = (function () {

// Handles both 4648
var event4648 = new processor.Chain()
.Add(copyTargetUser)
.Add(copySubjectUser)
.Add(copySubjectUserLogonId)
.Add(renameCommonAuthFields)
.Add(addEventFields)
.Add(copyTargetUserToEffective)
.Add(function(evt) {
var user = evt.Get("winlog.event_data.SubjectUserName");
if (user) {
Expand Down Expand Up @@ -2173,16 +2222,8 @@ var security = (function () {
.Add(copySubjectUser)
.Add(copySubjectUserLogonId)
.Add(renameNewProcessFields)
.Add(copyTargetUserToEffective)
.Add(addEventFields)
.Add(function(evt) {
var user = evt.Get("winlog.event_data.TargetUserName");
if (user) {
var res = /^-$/.test(user);
if (!res) {
evt.AppendTo('related.user', user);
}
}
})
.Build();

var event4689 = new processor.Chain()
Expand All @@ -2206,10 +2247,7 @@ var security = (function () {
.Add(renameCommonAuthFields)
.Add(addUACDescription)
.Add(addEventFields)
.Add(function(evt) {
var user = evt.Get("winlog.event_data.TargetUserName");
evt.AppendTo('related.user', user);
})
.Add(copyTargetUserToTarget)
.Build();

var userRenamed = new processor.Chain()
Expand All @@ -2221,6 +2259,12 @@ var security = (function () {
evt.AppendTo('related.user', userNew);
var userOld = evt.Get("winlog.event_data.OldTargetUserName");
evt.AppendTo('related.user', userOld);
if (userOld) {
evt.Put('user.target.name', userOld);
}
if (userNew) {
evt.Put('user.changes.name', userNew);
}
})
.Build();

Expand Down Expand Up @@ -2359,6 +2403,7 @@ var security = (function () {
.Add(copySubjectUserLogonId)
.Add(renameCommonAuthFields)
.Add(addEventFields)
.Add(copyTargetUserToTarget)
.Add(function(evt) {
var oldSd = evt.Get("winlog.event_data.OldSd");
var newSd = evt.Get("winlog.event_data.NewSd");
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/4746.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
"name": "at_adm",
"target": {
"domain": "SAAS",
"group": {
"domain": "TEST",
"id": "S-1-5-21-1717121054-434620538-60925301-2903",
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/4747.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
"name": "at_adm",
"target": {
"domain": "SAAS",
"group": {
"domain": "TEST",
"id": "S-1-5-21-1717121054-434620538-60925301-2903",
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/4751.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
"name": "at_adm",
"target": {
"domain": "SAAS",
"group": {
"domain": "TEST",
"id": "S-1-5-21-1717121054-434620538-60925301-2904",
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/4752.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
"name": "at_adm",
"target": {
"domain": "SAAS",
"group": {
"domain": "TEST",
"id": "S-1-5-21-1717121054-434620538-60925301-2904",
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/4761.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
"name": "at_adm",
"target": {
"domain": "SAAS",
"group": {
"domain": "TEST",
"id": "S-1-5-21-1717121054-434620538-60925301-2905",
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/4762.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
"name": "at_adm",
"target": {
"domain": "SAAS",
"group": {
"domain": "TEST",
"id": "S-1-5-21-1717121054-434620538-60925301-2905",
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4768.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@
},
"user": {
"domain": "TEST.SAAS",
"id": "S-1-5-21-1717121054-434620538-60925301-2794",
"name": "at_adm"
},
"winlog": {
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4771.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
"port": 53366
},
"user": {
"id": "S-1-5-21-1717121054-434620538-60925301-3057",
"name": "MPUIG"
},
"winlog": {
Expand Down
14 changes: 12 additions & 2 deletions .../module/security/test/testdata/security-windows2016_4720_Account_Created.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1005",
"name": "elastictest1"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down Expand Up @@ -126,7 +131,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1006",
"name": "audittest0609"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down
14 changes: 12 additions & 2 deletions .../module/security/test/testdata/security-windows2016_4722_Account_Enabled.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1000",
"name": "audittest"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down Expand Up @@ -99,7 +104,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1006",
"name": "audittest0609"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down
14 changes: 12 additions & 2 deletions .../module/security/test/testdata/security-windows2016_4723_Password_Change.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down Expand Up @@ -94,7 +99,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down
14 changes: 12 additions & 2 deletions ...t/module/security/test/testdata/security-windows2016_4724_Password_Reset.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1005",
"name": "elastictest1"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down Expand Up @@ -99,7 +104,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1006",
"name": "audittest0609"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down
14 changes: 12 additions & 2 deletions ...module/security/test/testdata/security-windows2016_4725_Account_Disabled.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1000",
"name": "audittest"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down Expand Up @@ -99,7 +104,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1006",
"name": "audittest0609"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down
14 changes: 12 additions & 2 deletions .../module/security/test/testdata/security-windows2016_4726_Account_Deleted.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1001",
"name": "audittest23"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down Expand Up @@ -100,7 +105,12 @@
"user": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator"
"name": "Administrator",
"target": {
"domain": "WIN-41OB2LO92CR",
"id": "S-1-5-21-101361758-2486510592-3018839910-1000",
"name": "audittest"
}
},
"winlog": {
"activity_id": "{1200ce16-64b6-0000-0ed0-0012b664d501}",
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4728.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator",
"target": {
"domain": "local",
"group": {
"domain": "WLBEAT",
"id": "S-1-5-21-101361758-2486510592-3018839910-1112",
Expand Down
1 change: 1 addition & 0 deletions x-pack/winlogbeat/module/security/test/testdata/security-windows2016_4729.evtx.golden.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
"name": "Administrator",
"target": {
"domain": "local",
"group": {
"domain": "WLBEAT",
"id": "S-1-5-21-101361758-2486510592-3018839910-1112",
Expand Down
Loading