Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat][Azure Module] Fixing event.outcome from result_type issue #20998

Merged
merged 3 commits into from
Sep 21, 2020
Merged

[Filebeat][Azure Module] Fixing event.outcome from result_type issue #20998

merged 3 commits into from
Sep 21, 2020

Conversation

P1llus
Copy link
Member

@P1llus P1llus commented Sep 6, 2020 •
edited
Loading

What does this PR do?

Adding a small fix to event.outcome from resulttype and adding a second property to event.outcome if result_type does not exist

Why is it important?

Fixes small issues for event.outcome parsing

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Sep 6, 2020
@P1llus P1llus changed the title fixing a small typo in result type and adding more event.outcome poss… [Filebeat][Azure Module] Fixing event.outcome from result_type issue Sep 6, 2020
@elasticmachine
Copy link
Collaborator

elasticmachine commented Sep 6, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20998 event]

  • Start Time: 2020-09-06T09:31:50.184+0000

  • Duration: 51 min 6 sec

Test stats 🧪

Test Results
Failed 0
Passed 2474
Skipped 388
Total 2862

@andresrc andresrc added the Team:Platforms Label for the Integrations - Platforms team label Sep 6, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/integrations-platforms (Team:Platforms)

@P1llus
Copy link
Member Author

P1llus commented Sep 6, 2020

@threat-punter If you could share a example doc before it was parsed as well that would be great, then I can add it as part of our test data :)

leehinman
leehinman approved these changes Sep 6, 2020
View reviewed changes
Copy link
Contributor

@leehinman leehinman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@threat-punter
Copy link

threat-punter commented Sep 8, 2020 •
edited
Loading

@threat-punter If you could share a example doc before it was parsed as well that would be great, then I can add it as part of our test data :)

Unfortunately not. My Azure subscription expired and it looks like I don't have access to the raw event anymore.

marc-gr
marc-gr reviewed Sep 9, 2020
View reviewed changes
CHANGELOG.next.asciidoc
@@ -555,6 +555,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Convert httpjson to v2 input {pull}20226[20226]
- Improve Zeek x509 module with `x509` ECS mappings {pull}20867[20867]
- Improve Zeek SSL module with `x509` ECS mappings {pull}20927[20927]
- Added new properties field support for event.outcome in azure module {pull}20998[20998]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this needs to be reordered

@threat-punter
Copy link

@P1llus do you know if this one will get merged before the 7.10 feature freeze?

Once it's merged, I can go ahead and merge these detection rules ready for 7.10 too elastic/detection-rules#143 and elastic/detection-rules#129

@P1llus
Copy link
Member Author

P1llus commented Sep 21, 2020 •
edited
Loading

@P1llus do you know if this one will get merged before the 7.10 feature freeze?

Once it's merged, I can go ahead and merge these detection rules ready for 7.10 too elastic/detection-rules#143 and elastic/detection-rules#129

@threat-punter
This will be in 7.10 indeed, have just not had time to look at getting the merge.

@leehinman anything else needed before a merge?

@leehinman
Copy link
Contributor

looks good. I'm merge & open backport PR.

@leehinman leehinman merged commit 578a0f9 into elastic:master Sep 21, 2020
leehinman pushed a commit to leehinman/beats that referenced this pull request Sep 21, 2020
@P1llus @leehinman
[Filebeat][Azure Module] Fixing event.outcome from result_type issue (e…
71122ff 
…lastic#20998)

* fixing a small typo in result type and adding more event.outcome possibilities

* Updating changelog

(cherry picked from commit 578a0f9)
@leehinman leehinman mentioned this pull request Sep 21, 2020
Merged
6 tasks
leehinman added a commit that referenced this pull request Sep 21, 2020
@leehinman @P1llus
[Filebeat][Azure Module] Fixing event.outcome from result_type issue (#…
227210c 
…20998) (#21203)

* fixing a small typo in result type and adding more event.outcome possibilities

* Updating changelog

(cherry picked from commit 578a0f9)

Co-authored-by: Marius Iversen <pillus@chasenet.org>
This was referenced Sep 22, 2020
Merged
Merged
v1v added a commit to v1v/beats that referenced this pull request Sep 24, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/ci-pipeli…
c59bffe 
…ne-2.0-arm

* upstream/master: (29 commits)
  Fix librpm installation in auditbeat build (elastic#21239)
  Fix prometheus default config (elastic#21253)
  Fix dev guide test command (elastic#21254)
  Move aws lambda metricset to GA (elastic#21255)
  [Docs] Typo in table syntax (elastic#20227)
  [ECS] Adds related.hosts to capture all hostnames and host identifiers on an event. (elastic#21160)
  Add recursive split to httpjson (elastic#21214)
  [DOCS] Add beat specific start widgets (elastic#21217)
  Fix timestamp handling in remote_write (elastic#21166)
  Fix aws, azure and googlecloud compute dashboards (elastic#21098)
  Add acceptable event log keys to winlog (elastic#21205)
  Add elastic-agent to gitignore (elastic#21219)
  Add cloudfoundry tags to events (elastic#21177)
  [Ingest Manager] Agent includes pgp file (elastic#19480)
  Add compatibility note about ingress-controller-v0.34.1 (elastic#21209)
  [Ingest Manager] Support for UPGRADE_ACTION (elastic#21002)
  Fix libbeat.output.*.bytes metrics of Elasticsearch output (elastic#21197)
  [packaging] use docker.elastic.co/ubi8/ubi-minimal (elastic#21154)
  Add host inventory metrics to system module (elastic#20415)
  [Filebeat][Azure Module] Fixing event.outcome from result_type issue (elastic#20998)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marc-gr marc-gr marc-gr left review comments

@leehinman leehinman leehinman approved these changes

Assignees
No one assigned
Labels
enhancement Filebeat Filebeat Team:Platforms Label for the Integrations - Platforms team v7.10.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Request to update the Azure Filebeat module pipeline for parsing Azure activity logs
6 participants
@P1llus @elasticmachine @threat-punter @leehinman @marc-gr @andresrc