Skip to content

Commit e7f9f30

Browse files
marc-grmarc-gr
committed
Improve user mappings
1 parent 153945d commit e7f9f30

30 files changed

+281
-57
lines changed

‎packages/system/changelog.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.5.0"
3+
changes:
4+
- description: Better user mappings for security events
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/1944
27
- version: "1.4.2"
38
changes:
49
- description: Prevent pipeline script error

‎packages/system/data_stream/security/_dev/test/pipeline/test-4746.json-expected.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"name": "DC_TEST2k12.TEST.SAAS"
6565
},
6666
"event": {
67-
"ingested": "2021-07-30T21:06:04.767568644Z",
67+
"ingested": "2021-10-19T11:55:16.331823600Z",
6868
"code": "4746",
6969
"provider": "Microsoft-Windows-Security-Auditing",
7070
"kind": "event",
@@ -84,6 +84,7 @@
8484
"domain": "TEST",
8585
"target": {
8686
"name": "Administrator",
87+
"domain": "SAAS",
8788
"group": {
8889
"name": "testdistlocal1",
8990
"domain": "TEST",

‎packages/system/data_stream/security/_dev/test/pipeline/test-4747.json-expected.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"name": "DC_TEST2k12.TEST.SAAS"
6565
},
6666
"event": {
67-
"ingested": "2021-07-30T21:06:04.888936317Z",
67+
"ingested": "2021-10-19T11:55:16.621125Z",
6868
"code": "4747",
6969
"provider": "Microsoft-Windows-Security-Auditing",
7070
"kind": "event",
@@ -84,6 +84,7 @@
8484
"domain": "TEST",
8585
"target": {
8686
"name": "Administrator",
87+
"domain": "SAAS",
8788
"group": {
8889
"name": "testdistlocal1",
8990
"domain": "TEST",

‎packages/system/data_stream/security/_dev/test/pipeline/test-4751.json-expected.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"name": "DC_TEST2k12.TEST.SAAS"
6565
},
6666
"event": {
67-
"ingested": "2021-07-30T21:06:05.313669028Z",
67+
"ingested": "2021-10-19T11:55:17.565769200Z",
6868
"code": "4751",
6969
"provider": "Microsoft-Windows-Security-Auditing",
7070
"kind": "event",
@@ -84,6 +84,7 @@
8484
"domain": "TEST",
8585
"target": {
8686
"name": "Administrator",
87+
"domain": "SAAS",
8788
"group": {
8889
"name": "testglobal1",
8990
"domain": "TEST",

‎packages/system/data_stream/security/_dev/test/pipeline/test-4752.json-expected.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"name": "DC_TEST2k12.TEST.SAAS"
6565
},
6666
"event": {
67-
"ingested": "2021-07-30T21:06:05.414207722Z",
67+
"ingested": "2021-10-19T11:55:17.906691Z",
6868
"code": "4752",
6969
"provider": "Microsoft-Windows-Security-Auditing",
7070
"kind": "event",
@@ -84,6 +84,7 @@
8484
"domain": "TEST",
8585
"target": {
8686
"name": "Administrator",
87+
"domain": "SAAS",
8788
"group": {
8889
"name": "testglobal1",
8990
"domain": "TEST",

‎packages/system/data_stream/security/_dev/test/pipeline/test-4761.json-expected.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"name": "DC_TEST2k12.TEST.SAAS"
6565
},
6666
"event": {
67-
"ingested": "2021-07-30T21:06:05.791134249Z",
67+
"ingested": "2021-10-19T11:55:18.871413700Z",
6868
"code": "4761",
6969
"provider": "Microsoft-Windows-Security-Auditing",
7070
"kind": "event",
@@ -84,6 +84,7 @@
8484
"domain": "TEST",
8585
"target": {
8686
"name": "Administrator",
87+
"domain": "SAAS",
8788
"group": {
8889
"name": "testuni2",
8990
"domain": "TEST",

‎packages/system/data_stream/security/_dev/test/pipeline/test-4762.json-expected.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"name": "DC_TEST2k12.TEST.SAAS"
6565
},
6666
"event": {
67-
"ingested": "2021-07-30T21:06:05.889044291Z",
67+
"ingested": "2021-10-19T11:55:19.143941900Z",
6868
"code": "4762",
6969
"provider": "Microsoft-Windows-Security-Auditing",
7070
"kind": "event",
@@ -84,6 +84,7 @@
8484
"domain": "TEST",
8585
"target": {
8686
"name": "Administrator",
87+
"domain": "SAAS",
8788
"group": {
8889
"name": "testuni2",
8990
"domain": "TEST",

‎packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4768.json-expected.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@
7777
"name": "DC_TEST2k12.TEST.SAAS"
7878
},
7979
"event": {
80-
"ingested": "2021-07-30T21:06:06.837533884Z",
80+
"ingested": "2021-10-19T11:55:21.246497500Z",
8181
"code": "4768",
8282
"provider": "Microsoft-Windows-Security-Auditing",
8383
"kind": "event",
@@ -92,7 +92,8 @@
9292
},
9393
"user": {
9494
"name": "at_adm",
95-
"domain": "TEST.SAAS"
95+
"domain": "TEST.SAAS",
96+
"id": "S-1-5-21-1717121054-434620538-60925301-2794"
9697
}
9798
}
9899
]

‎packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4771.json-expected.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@
7373
"name": "DC_TEST2k12.TEST.SAAS"
7474
},
7575
"event": {
76-
"ingested": "2021-07-30T21:06:07.159369727Z",
76+
"ingested": "2021-10-19T11:55:22.001023400Z",
7777
"code": "4771",
7878
"provider": "Microsoft-Windows-Security-Auditing",
7979
"kind": "event",
@@ -87,7 +87,8 @@
8787
"outcome": "failure"
8888
},
8989
"user": {
90-
"name": "MPUIG"
90+
"name": "MPUIG",
91+
"id": "S-1-5-21-1717121054-434620538-60925301-3057"
9192
}
9293
}
9394
]

‎packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2016-4722-account-enabled.json-expected.json

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
"name": "WIN-41OB2LO92CR"
6363
},
6464
"event": {
65-
"ingested": "2021-07-30T21:06:09.468417917Z",
65+
"ingested": "2021-10-19T11:55:27.016591Z",
6666
"code": "4722",
6767
"provider": "Microsoft-Windows-Security-Auditing",
6868
"kind": "event",
@@ -78,8 +78,13 @@
7878
},
7979
"user": {
8080
"name": "Administrator",
81+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
8182
"domain": "WIN-41OB2LO92CR",
82-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
83+
"target": {
84+
"name": "audittest",
85+
"domain": "WIN-41OB2LO92CR",
86+
"id": "S-1-5-21-101361758-2486510592-3018839910-1000"
87+
}
8388
}
8489
},
8590
{
@@ -144,7 +149,7 @@
144149
"name": "WIN-41OB2LO92CR"
145150
},
146151
"event": {
147-
"ingested": "2021-07-30T21:06:09.468420621Z",
152+
"ingested": "2021-10-19T11:55:27.016600700Z",
148153
"code": "4722",
149154
"provider": "Microsoft-Windows-Security-Auditing",
150155
"kind": "event",
@@ -160,8 +165,13 @@
160165
},
161166
"user": {
162167
"name": "Administrator",
168+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
163169
"domain": "WIN-41OB2LO92CR",
164-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
170+
"target": {
171+
"name": "audittest0609",
172+
"domain": "WIN-41OB2LO92CR",
173+
"id": "S-1-5-21-101361758-2486510592-3018839910-1006"
174+
}
165175
}
166176
}
167177
]

‎packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2016-4723-password-change.json-expected.json

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
"name": "WIN-41OB2LO92CR"
6363
},
6464
"event": {
65-
"ingested": "2021-07-30T21:06:09.676454372Z",
65+
"ingested": "2021-10-19T11:55:27.450128800Z",
6666
"code": "4723",
6767
"provider": "Microsoft-Windows-Security-Auditing",
6868
"kind": "event",
@@ -78,8 +78,13 @@
7878
},
7979
"user": {
8080
"name": "Administrator",
81+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
8182
"domain": "WIN-41OB2LO92CR",
82-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
83+
"target": {
84+
"name": "Administrator",
85+
"domain": "WIN-41OB2LO92CR",
86+
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
87+
}
8388
}
8489
},
8590
{
@@ -144,7 +149,7 @@
144149
"name": "WIN-41OB2LO92CR"
145150
},
146151
"event": {
147-
"ingested": "2021-07-30T21:06:09.676457128Z",
152+
"ingested": "2021-10-19T11:55:27.450137Z",
148153
"code": "4723",
149154
"provider": "Microsoft-Windows-Security-Auditing",
150155
"kind": "event",
@@ -160,8 +165,13 @@
160165
},
161166
"user": {
162167
"name": "Administrator",
168+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
163169
"domain": "WIN-41OB2LO92CR",
164-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
170+
"target": {
171+
"name": "Administrator",
172+
"domain": "WIN-41OB2LO92CR",
173+
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
174+
}
165175
}
166176
}
167177
]

‎packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2016-4724-password-reset.json-expected.json

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
"name": "WIN-41OB2LO92CR"
6363
},
6464
"event": {
65-
"ingested": "2021-07-30T21:06:09.855345755Z",
65+
"ingested": "2021-10-19T11:55:27.912761300Z",
6666
"code": "4724",
6767
"provider": "Microsoft-Windows-Security-Auditing",
6868
"kind": "event",
@@ -78,8 +78,13 @@
7878
},
7979
"user": {
8080
"name": "Administrator",
81+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
8182
"domain": "WIN-41OB2LO92CR",
82-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
83+
"target": {
84+
"name": "elastictest1",
85+
"domain": "WIN-41OB2LO92CR",
86+
"id": "S-1-5-21-101361758-2486510592-3018839910-1005"
87+
}
8388
}
8489
},
8590
{
@@ -144,7 +149,7 @@
144149
"name": "WIN-41OB2LO92CR"
145150
},
146151
"event": {
147-
"ingested": "2021-07-30T21:06:09.855372883Z",
152+
"ingested": "2021-10-19T11:55:27.912770100Z",
148153
"code": "4724",
149154
"provider": "Microsoft-Windows-Security-Auditing",
150155
"kind": "event",
@@ -160,8 +165,13 @@
160165
},
161166
"user": {
162167
"name": "Administrator",
168+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
163169
"domain": "WIN-41OB2LO92CR",
164-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
170+
"target": {
171+
"name": "audittest0609",
172+
"domain": "WIN-41OB2LO92CR",
173+
"id": "S-1-5-21-101361758-2486510592-3018839910-1006"
174+
}
165175
}
166176
}
167177
]

‎packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2016-4725-account-disabled.json-expected.json

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
"name": "WIN-41OB2LO92CR"
6363
},
6464
"event": {
65-
"ingested": "2021-07-30T21:06:10.021979420Z",
65+
"ingested": "2021-10-19T11:55:28.349650400Z",
6666
"code": "4725",
6767
"provider": "Microsoft-Windows-Security-Auditing",
6868
"kind": "event",
@@ -78,8 +78,13 @@
7878
},
7979
"user": {
8080
"name": "Administrator",
81+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
8182
"domain": "WIN-41OB2LO92CR",
82-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
83+
"target": {
84+
"name": "audittest",
85+
"domain": "WIN-41OB2LO92CR",
86+
"id": "S-1-5-21-101361758-2486510592-3018839910-1000"
87+
}
8388
}
8489
},
8590
{
@@ -144,7 +149,7 @@
144149
"name": "WIN-41OB2LO92CR"
145150
},
146151
"event": {
147-
"ingested": "2021-07-30T21:06:10.021981930Z",
152+
"ingested": "2021-10-19T11:55:28.349659100Z",
148153
"code": "4725",
149154
"provider": "Microsoft-Windows-Security-Auditing",
150155
"kind": "event",
@@ -160,8 +165,13 @@
160165
},
161166
"user": {
162167
"name": "Administrator",
168+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
163169
"domain": "WIN-41OB2LO92CR",
164-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
170+
"target": {
171+
"name": "audittest0609",
172+
"domain": "WIN-41OB2LO92CR",
173+
"id": "S-1-5-21-101361758-2486510592-3018839910-1006"
174+
}
165175
}
166176
}
167177
]

‎packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2016-4726-account-deleted.json-expected.json

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@
6363
"name": "WIN-41OB2LO92CR"
6464
},
6565
"event": {
66-
"ingested": "2021-07-30T21:06:10.186637182Z",
66+
"ingested": "2021-10-19T11:55:28.808472500Z",
6767
"code": "4726",
6868
"provider": "Microsoft-Windows-Security-Auditing",
6969
"kind": "event",
@@ -79,8 +79,13 @@
7979
},
8080
"user": {
8181
"name": "Administrator",
82+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
8283
"domain": "WIN-41OB2LO92CR",
83-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
84+
"target": {
85+
"name": "audittest23",
86+
"domain": "WIN-41OB2LO92CR",
87+
"id": "S-1-5-21-101361758-2486510592-3018839910-1001"
88+
}
8489
}
8590
},
8691
{
@@ -146,7 +151,7 @@
146151
"name": "WIN-41OB2LO92CR"
147152
},
148153
"event": {
149-
"ingested": "2021-07-30T21:06:10.186639172Z",
154+
"ingested": "2021-10-19T11:55:28.808476700Z",
150155
"code": "4726",
151156
"provider": "Microsoft-Windows-Security-Auditing",
152157
"kind": "event",
@@ -162,8 +167,13 @@
162167
},
163168
"user": {
164169
"name": "Administrator",
170+
"id": "S-1-5-21-101361758-2486510592-3018839910-500",
165171
"domain": "WIN-41OB2LO92CR",
166-
"id": "S-1-5-21-101361758-2486510592-3018839910-500"
172+
"target": {
173+
"name": "audittest",
174+
"domain": "WIN-41OB2LO92CR",
175+
"id": "S-1-5-21-101361758-2486510592-3018839910-1000"
176+
}
167177
}
168178
}
169179
]

0 commit comments

Comments
 (0)