filebeat azure module not mapping event.category for activitylogs

[pwen090]

Filebeat Azure module does not seem to be mapping Azure activitylogs event.category field. This causes most Azure detections to fail. For example rules like "Azure Diagnostic Settings Deletion" will not match because event.category is missing. The event is shown in Elastic with category set within azure.activitylogs.properties.eventCategory but this does not seem to be mapped to event.category which the detection rules are looking for. Might be related to other mapping issues noted here: #20990

• Version: Filebeat 7.9.1
• Operating System: Windows

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)

[bm11100]

We'll be updating all the detection rules to remove event.category - elastic/detection-rules#333

These rules are targeted for the 7.10 release.

[leehinman]

@pwen090 do you have a list of expected values for azure.activitylogs.properties.eventCategory that we could use for a mapping to event.category ?

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!