o365: Fix processing of ModifiedProperties field (#23777) (#23787)

A bug was causing entries for the ModifiedProperties field to be dropped. (cherry picked from commit 1f8a2e6)
elastic · Feb 1, 2021 · 098acff · 098acff
1 parent 0f9626c
commit 098acff
Show file tree

Hide file tree

Showing 3 changed files with 102 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -254,6 +254,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix CredentialsJSON unpacking for `gcp-pubsub` and `httpjson` inputs. {pull}23277[23277]
 - Fix syslog header parsing in infoblox module. {issue}23272[23272] {pull}23273[23273]
 - Fix concurrent modification exception in Suricata ingest node pipeline. {pull}23534[23534]
+- Fix handling of ModifiedProperties field in Office 365. {pull}23777[23777]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/o365/audit/config/pipeline.js b/x-pack/filebeat/module/o365/audit/config/pipeline.js
@@ -157,7 +157,7 @@ function makeDictFromModifiedPropertyArray(options) {
             if (src[i] == null
                 || (name=src[i].Name) == null
                 || (newValue=src[i].NewValue) == null
-                || (oldValue=src[i].OldValue)) continue;
+                || (oldValue=src[i].OldValue) == null) continue;
             name = validFieldName(name);
             if (name in dict) {
                 if (dict[name].NewValue instanceof Array) {