From c20482d71b12ce4e3baadaef5683582cd486c479 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Wed, 3 Feb 2021 11:14:46 +0100 Subject: [PATCH] Add session category to events --- CHANGELOG.next.asciidoc | 1 + .../winlogbeat/module/security/config/winlogbeat-security.js | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 6a758a2959d..2948d612b52 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -1003,6 +1003,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add dns.question.subdomain fields for sysmon DNS events. {pull}22999[22999] - Add dns.question.top_level_domain fields for sysmon DNS events. {pull}23046[23046] - Add Audit and Authentication Polixy Change Events and related.ip information {pull}20684[20684] +- Add new ECS 1.8 improvements. {pull}23563[23563] *Elastic Log Driver* diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js index 4a3984d94b2..586aeea5e17 100644 --- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js +++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js @@ -250,8 +250,8 @@ var security = (function () { "4770": [["authentication"], ["start"], "kerberos-service-ticket-renewed"], "4771": [["authentication"], ["start"], "kerberos-preauth-failed"], "4776": [["authentication"], ["start"], "credential-validated"], - "4778": [["authentication"], ["start"], "session-reconnected"], - "4779": [["authentication"], ["end"], "session-disconnected"], + "4778": [["authentication", "session"], ["start"], "session-reconnected"], + "4779": [["authentication", "session"], ["end"], "session-disconnected"], "4781": [["iam"], ["user", "change"], "renamed-user-account"], "4798": [["iam"], ["user", "info"], "group-membership-enumerated"], // process enumerates the local groups to which the specified user belongs "4799": [["iam"], ["group", "info"], "user-member-enumerated"], // a process enumerates the members of the specified local group