- Notifications
You must be signed in to change notification settings - Fork545
[windows] Add provider name check to forwarded/security conditional#2527
[windows] Add provider name check to forwarded/security conditional#2527taylor-swanson merged 2 commits intoelastic:masterfromtaylor-swanson:windows-security-guard
Conversation
- Added a check to the forwarded/security conditional to ensure that onlyevents with a provider of Microsoft-Windows-Eventlog orMicrosoft-Windows-Security-Auditing are allowed through. Events not matchingthese providers will still be indexed, but won't receive additionalenrichment that could lead to incorrect metadata being applied.
elasticmachine commentedJan 13, 2022 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
💚 Build Succeeded
Expand to view the summaryBuild stats
Test stats 🧪
🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
elasticmachine commentedJan 14, 2022
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
| - pipeline: | ||
| name: '{{ IngestPipeline "security" }}' | ||
| if: ctx?.winlog?.channel != null && ctx?.winlog?.channel == "Security" | ||
| if: ctx?.winlog?.channel != null && ctx?.winlog?.channel == "Security" && ctx?.winlog?.provider_name != null && ["Microsoft-Windows-Eventlog", "Microsoft-Windows-Security-Auditing"].contains(ctx?.winlog?.provider_name) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Are there cases wherechannel is "Security" butprovider_name isn't /Microsoft-Windows-(Eventlog|Security-Auditing)/?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Good question. For forwarded events I'm not sure if this is the case or not. The other provider name we know of that can appear in theSecurity channel isAD FS, and we know we don't want it enriched with this pipeline. I was mostly replicating the logic from other pipelines here (the ones in System and Winlogbeat). I think this is still safe since we don't want to enrich any other providers other than the ones we know of. Those are listed here:https://windows-event-explorer.app.elstc.co/channel/Security
What does this PR do?
-Added a check to the forwarded/security conditional to ensure that only events with a provider of
Microsoft-Windows-EventlogorMicrosoft-Windows-Security-Auditingare allowed through. Events not matching these providers will still be indexed, but won't receive additional enrichment that could lead to incorrect metadata being applied.Checklist
changelog.ymlfile.How to test this PR locally
Related issues