Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[winlogbeat] event.type has colon in its name at the end #13676

Closed
FrankHassanabad opened this issue Sep 13, 2019 · 0 comments · Fixed by #13677
Closed

[winlogbeat] event.type has colon in its name at the end #13676

FrankHassanabad opened this issue Sep 13, 2019 · 0 comments · Fixed by #13677
Labels
bug Winlogbeat

Comments

@FrankHassanabad
Copy link

In:
https://github.com/elastic/beats/blob/7.4/x-pack/winlogbeat/module/sysmon/config/winlogbeat-sysmon.js#L397

and:
https://github.com/elastic/beats/blob/master/x-pack/winlogbeat/module/sysmon/config/winlogbeat-sysmon.js#L397

There is an extra colon which causes that event.type to show up in KQL and other spots like this:
Screen Shot 2019-09-13 at 10 12 02 AM

And in the queries you have an event.type with a colon
Screen Shot 2019-09-13 at 10 07 08 AM

For confirmed bugs, please report:

  • Version:
    7-4-0-BC4

  • Operating System:
    Windows

  • Steps to Reproduce:
    Install winlogbeat and sysmon and run it for a bit.

Workaround is to manually modify the file:
C:\Program Files\Winlogbeat\module\sysmon\config\winlogbeat-sysmon.js

And take away the extra colon.
@FrankHassanabad FrankHassanabad changed the title [winlogbeat] event.type has [winlogbeat] event.type has colon in its name at the end Sep 13, 2019
adriansr added a commit to adriansr/beats that referenced this issue Sep 13, 2019
@adriansr
Fix Winlogbeat's sysmon event.type with a colon
823d072 
The sysmon module in Winlogbeat was creating the field `event.type:`
with a colon at the end.

Fixes elastic#13676
@adriansr adriansr mentioned this issue Sep 13, 2019
Merged
adriansr added a commit that referenced this issue Sep 13, 2019
@adriansr
Fix Winlogbeat's sysmon event.type with a colon (#13677)
71eee76 
The sysmon module in Winlogbeat was creating the field `event.type:`
with a colon at the end.

Fixes #13676
adriansr added a commit to adriansr/beats that referenced this issue Sep 14, 2019
@adriansr
Fix Winlogbeat's sysmon event.type with a colon (elastic#13677)
2a81e81 
The sysmon module in Winlogbeat was creating the field `event.type:`
with a colon at the end.

Fixes elastic#13676

(cherry picked from commit 71eee76)
@adriansr adriansr mentioned this issue Sep 14, 2019
Merged
andrewkroh pushed a commit that referenced this issue Sep 16, 2019
@adriansr @andrewkroh
Fix Winlogbeat's sysmon event.type with a colon (#13677) (#13684)
869254b 
The sysmon module in Winlogbeat was creating the field `event.type:`
with a colon at the end.

Fixes #13676

(cherry picked from commit 71eee76)
leweafan pushed a commit to leweafan/beats that referenced this issue Apr 28, 2023
@adriansr @andrewkroh
Fix Winlogbeat's sysmon event.type with a colon (elastic#13677) (elas…
77b6a41 
…tic#13684)

The sysmon module in Winlogbeat was creating the field `event.type:`
with a colon at the end.

Fixes elastic#13676

(cherry picked from commit a0b55ab)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Winlogbeat
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[SIEM][Winlogbeat] Fix sysmon event.type with a colon adriansr/beats
1 participant
@FrankHassanabad