Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] Fix event.outcome logic for azure/signinlogs fileset #20254

Merged
merged 4 commits into from
Aug 14, 2020
Merged

[Filebeat] Fix event.outcome logic for azure/signinlogs fileset #20254

merged 4 commits into from
Aug 14, 2020

Conversation

leehinman
Copy link
Contributor

What does this PR do?

  • fix event.outcome logic for azure/siginlogs fileset
  • add GROK pattern for usernames that don't have '@' for
    azure/siginlogs fileset

Why is it important?

  • Bug fix for event.outcome logic
  • some usernames in azure don't have '@'

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=azure TESTING_FILEBEAT_FILESETS=signinlogs mage -v pythonIntegTest

@leehinman leehinman added bug Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. Team:SIEM labels Jul 27, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jul 27, 2020
@leehinman
Fix event.outcome logic for azure/signinlogs fileset
d8a0c7b 
- fix event.outcome logic
- add GROK pattern for usernames that don't have '@'
@leehinman leehinman mentioned this pull request Jul 27, 2020
Merged
5 tasks
@leehinman leehinman requested a review from narph July 27, 2020 20:54
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jul 28, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20254 updated]

  • Start Time: 2020-08-11T14:35:57.862+0000

  • Duration: 99 min 8 sec

Test stats 🧪

Test Results
Failed 0
Passed 2450
Skipped 400
Total 2850

andrewkroh
andrewkroh approved these changes Jul 28, 2020
View reviewed changes
Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. It would be good to add a log sample where the user_principal_name doesn't contain the @.

@leehinman leehinman merged commit dac0534 into elastic:master Aug 14, 2020
@leehinman leehinman mentioned this pull request Aug 14, 2020
Merged
3 tasks
leehinman added a commit to leehinman/beats that referenced this pull request Aug 14, 2020
@leehinman
[Filebeat] Fix event.outcome logic for azure/signinlogs fileset (elas…
8c40a0d 
…tic#20254)

* Fix event.outcome logic for azure/signinlogs fileset

- fix event.outcome logic
- add GROK pattern for usernames that don't have '@'

* Add example of principal name without @

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
(cherry picked from commit dac0534)
@leehinman leehinman added v7.10.0 and removed needs_backport PR is waiting to be backported to other branches. labels Aug 14, 2020
leehinman added a commit that referenced this pull request Aug 18, 2020
@leehinman
[Filebeat] Fix event.outcome logic for azure/signinlogs fileset (#20254…
c203428 
…) (#20608)

* Fix event.outcome logic for azure/signinlogs fileset

- fix event.outcome logic
- add GROK pattern for usernames that don't have '@'

* Add example of principal name without @

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
(cherry picked from commit dac0534)
@leehinman leehinman deleted the sdh_345_azure branch October 5, 2020 19:21
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
@leehinman @andrewkroh @melchiormoulin
[Filebeat] Fix event.outcome logic for azure/signinlogs fileset (elas…
e782a66 
…tic#20254)

* Fix event.outcome logic for azure/signinlogs fileset

- fix event.outcome logic
- add GROK pattern for usernames that don't have '@'

* Add example of principal name without @

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

@narph narph Awaiting requested review from narph

Assignees
No one assigned
Labels
bug Filebeat Filebeat v7.10.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@leehinman @elasticmachine @andrewkroh