Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Collect Events.* fields for telemetry #107976

Merged
merged 5 commits into from
Aug 17, 2021
Merged

Collect Events.* fields for telemetry #107976

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d806384
Collect Events.* fields for telemetry
rw-access Aug 9, 2021
d3b8d34
Merge branch 'master' into telemetry-events-715
kibanamachine Aug 11, 2021
b00c600
Merge branch 'master' into telemetry-events-715
kibanamachine Aug 12, 2021
4264361
Add process.code_signature
rw-access Aug 13, 2021
a4950ab
Merge branch 'master' into telemetry-events-715
kibanamachine Aug 16, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -464,6 +464,7 @@ const allowlistProcessFields: AllowlistFields = {
args: true,
name: true,
executable: true,
code_signature: true,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding this!

command_line: true,
hash: true,
pid: true,
Expand Down Expand Up @@ -555,8 +556,10 @@ const allowlistEventFields: AllowlistFields = {
data_stream: true,
ecs: true,
elastic: true,
// behavioral protection re-nests some field sets under events.*
// behavioral protection re-nests some field sets under events.* (< 7.15)
events: allowlistBaseEventFields,
// behavioral protection re-nests some field sets under Events.* (>=7.15)
Events: allowlistBaseEventFields,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Please help out with data engineering by keeping the data dictionary up to date in our pro cloud repo.

rule: {
id: true,
name: true,
Expand Down