Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] change field types in aws cloudtrail fileset #18909

Closed
wants to merge 1 commit into from
Closed

[Filebeat] change field types in aws cloudtrail fileset #18909

wants to merge 1 commit into from

Conversation

leehinman
Copy link
Contributor

What does this PR do?

A string representation of the following fields were stored. Changing
to an object which is more easily searched.

  • request_parameters
  • response_elements
  • additional_eventdata
  • service_event_details

Why is it important?

The fields within these objects are necessary for security detections.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=aws TESTING_FILEBEAT_FILESETS=cloudtrail mage -v pythonIntegTest

Related issues

@leehinman leehinman added enhancement Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. Team:SIEM labels Jun 2, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jun 2, 2020
@leehinman
change field types in aws cloudtrail fileset
793bdc5 
A string representation of the following fields was stored.  Changing
to an object which is more easily searched.

- request_parameters
- response_elements
- additional_eventdata
- service_event_details

Closes elastic#18866
@leehinman leehinman force-pushed the 18866_cloudtrail_types branch from 6ca526d to 793bdc5 Compare June 2, 2020 17:51
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jun 2, 2020 •
edited
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #18909 updated]

  • Start Time: 2020-06-02T17:52:02.940+0000

  • Duration: 58 min 33 sec

Test stats 🧪

Test Results
Failed 0
Passed 3807
Skipped 672
Total 4479

@leehinman leehinman mentioned this pull request Jun 5, 2020
Closed
@leehinman leehinman closed this Jun 11, 2020
@leehinman leehinman deleted the 18866_cloudtrail_types branch October 5, 2020 19:13
@andrewkroh andrewkroh removed the needs_backport PR is waiting to be backported to other branches. label Dec 15, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
enhancement Filebeat Filebeat
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[filebeat][aws][cloudtrail] accessKeyId should be searchable
3 participants
@leehinman @elasticmachine @andrewkroh