Update security telemetry allowlist. (#103471) (#103626)

Co-authored-by: Pete Hampton <pjhampton@users.noreply.github.com>
elastic · Jun 29, 2021 · c9aa40f · c9aa40f
1 parent fd02892
commit c9aa40f
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts
@@ -41,6 +41,7 @@ describe('TelemetryEventsSender', () => {
             version: '100',
           },
           file: {
+            extension: '.exe',
             size: 3,
             created: 0,
             path: 'X',
@@ -72,6 +73,7 @@ describe('TelemetryEventsSender', () => {
             name: 'foo.exe',
             nope: 'nope',
             executable: null, // null fields are never allowlisted
+            working_directory: '/some/usr/dir',
           },
           Target: {
             process: {
@@ -101,6 +103,7 @@ describe('TelemetryEventsSender', () => {
             version: '100',
           },
           file: {
+            extension: '.exe',
             size: 3,
             created: 0,
             path: 'X',
@@ -126,6 +129,7 @@ describe('TelemetryEventsSender', () => {
           },
           process: {
             name: 'foo.exe',
+            working_directory: '/some/usr/dir',
           },
           Target: {
             process: {

diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
@@ -307,6 +307,7 @@ const allowlistProcessFields: AllowlistFields = {
     },
   },
   thread: true,
+  working_directory: true,
 };
 
 // Allow list for event-related fields, which can also be nested under events[]
@@ -322,6 +323,7 @@ const allowlistBaseEventFields: AllowlistFields = {
   },
   event: true,
   file: {
+    extension: true,
     name: true,
     path: true,
     size: true,