-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Auditbeat] Add system module user dataset ECS categorization fields #18035
[Auditbeat] Add system module user dataset ECS categorization fields #18035
Conversation
Pinging @elastic/siem (Team:SIEM) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ECS categorization looks good.
Could we add the following?:
- related.user
- user.group.id
thanks, done |
💚 Build SucceededExpand to view the summary
Build stats
Test stats 🧪
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
…lastic#18035) * [Auditbeat] Add system module user dataset ECS categorization fields * add changelog entry * Add user.group and related.user fields * Remove group name that may not match across test environments * Modify test so it doesn't pick up real user events (cherry picked from commit 000bbc6)
… ECS categorization fields (#18252) * [Auditbeat] Add system module user dataset ECS categorization fields (#18035) * [Auditbeat] Add system module user dataset ECS categorization fields * add changelog entry * Add user.group and related.user fields * Remove group name that may not match across test environments * Modify test so it doesn't pick up real user events (cherry picked from commit 000bbc6) * Fix up changelog
Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Related issues