[Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23010

andrewstucki · 2020-12-09T04:52:33Z

What does this PR do?

This adds configuration categorization for the relevant modules in #21674 other than those generated via the rsa2elk process.

The general rule of thumb for categorization that I used was that if an event is arguably describing a "setting" change/creation/deletion, it can be classified as event.category: "configuration".

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

Relates [ECS] Upgrade modules to 1.7 #21674

…uditd, gsuite, o365, and zoom

elasticmachine · 2020-12-09T04:52:35Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

elasticmachine · 2020-12-09T05:03:36Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Build Cause: Pull request #23010 updated
Start Time: 2020-12-09T21:18:21.532+0000
Duration: 49 min 14 sec

Test stats 🧪

Test	Results
Failed	0
Passed	5094
Skipped	566
Total	5660

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	5094
Skipped	566
Total	5660

elasticmachine · 2020-12-09T05:03:37Z

❕ Build Aborted

There is a new build on-going so the previous on-going builds have been aborted.

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Build Cause: Pull request #23010 opened
Reason: Aborted from #3
Start Time: 2020-12-09T04:53:18.124+0000
Duration: 10 min 7 sec
Commit: c6a6685

Log output

Expand to view the last 100 lines of log output

[2020-12-09T05:01:45.045Z]   DOCKER_CACHE: null
[2020-12-09T05:01:45.045Z]   DOCKER_COMPOSE_PROJECT_NAME: null
[2020-12-09T05:01:45.045Z]   DOCKER_COMPOSE: null
[2020-12-09T05:01:45.045Z]   FIND: null
[2020-12-09T05:01:45.045Z]   GOBUILD_FLAGS: null
[2020-12-09T05:01:45.045Z]   GOIMPORTS: null
[2020-12-09T05:01:45.045Z]   GOIMPORTS_REPO: null
[2020-12-09T05:01:45.045Z]   GOIMPORTS_LOCAL_PREFIX: null
[2020-12-09T05:01:45.045Z]   GOLINT: null
[2020-12-09T05:01:45.045Z]   GOLINT_REPO: null
[2020-12-09T05:01:45.045Z]   GOPACKAGES_COMMA_SEP: null
[2020-12-09T05:01:45.045Z]   GOX_FLAGS: -arch amd64
[2020-12-09T05:01:45.045Z]   GOX_OS: null
[2020-12-09T05:01:45.045Z]   GOX_OSARCH: null
[2020-12-09T05:01:45.045Z]   HOME: /var/lib/jenkins/workspace/Beats_beats_PR-23010
[2020-12-09T05:01:45.045Z]   NOSETESTS_OPTIONS: null
[2020-12-09T05:01:45.045Z]   NOW: null
[2020-12-09T05:01:45.045Z]   PATH: /var/lib/jenkins/workspace/Beats_beats_PR-23010/bin:/var/lib/jenkins/workspace/Beats_beats_PR-23010/.gvm/versions/go1.14.12.linux.amd64/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
[2020-12-09T05:01:45.045Z]   PKG_BUILD_DIR: null
[2020-12-09T05:01:45.045Z]   PKG_UPLOAD_DIR: null
[2020-12-09T05:01:45.045Z]   PIP_INSTALL_PARAMS: null
[2020-12-09T05:01:45.045Z]   PROJECTS: null
[2020-12-09T05:01:45.045Z]   PROJECTS_ENV: null
[2020-12-09T05:01:45.045Z]   PYTHON_ENV: /var/lib/jenkins/workspace/Beats_beats_PR-23010/python-env
[2020-12-09T05:01:45.045Z]   PYTHON_ENV_EXE: null
[2020-12-09T05:01:45.045Z]   PYTHON_EXE: null
[2020-12-09T05:01:45.045Z]   PYTHON_TEST_FILES: null
[2020-12-09T05:01:45.045Z]   PROCESSES: null
[2020-12-09T05:01:45.045Z]   REVIEWDOG: null
[2020-12-09T05:01:45.045Z]   REVIEWDOG_OPTIONS: null
[2020-12-09T05:01:45.045Z]   REVIEWDOG_REPO: null
[2020-12-09T05:01:45.045Z]   STRESS_TESTS: null
[2020-12-09T05:01:45.045Z]   STRESS_TEST_OPTIONS: null
[2020-12-09T05:01:45.045Z]   SYSTEM_TESTS: null
[2020-12-09T05:01:45.045Z]   TESTIFY_TOOL_REPO: null
[2020-12-09T05:01:45.045Z]   TEST_ENVIRONMENT: null
[2020-12-09T05:01:45.045Z]   TEST_TAGS: null,oracle
[2020-12-09T05:01:45.045Z]   TESTING_ENVIRONMENT: null
[2020-12-09T05:01:45.045Z]   TIMEOUT: null
[2020-12-09T05:01:45.045Z]   USERPROFILE: null
[2020-12-09T05:01:45.045Z]   VENV_PARAMS: null
[2020-12-09T05:01:45.045Z]   XPACK_SUFFIX: null
[2020-12-09T05:01:45.045Z]   ### END ENV DUMP ###
[2020-12-09T05:01:45.045Z]   
[2020-12-09T05:01:45.349Z] + make get-version
[2020-12-09T05:01:46.640Z] + make check-python
[2020-12-09T05:03:08.421Z] + make check-go
[2020-12-09T05:03:09.300Z] + make check-no-changes
[2020-12-09T05:03:12.182Z] Client: Docker Engine - Community
[2020-12-09T05:03:12.182Z]  Version:           19.03.14
[2020-12-09T05:03:12.182Z]  API version:       1.40
[2020-12-09T05:03:12.182Z]  Go version:        go1.13.15
[2020-12-09T05:03:12.182Z]  Git commit:        5eb3275d40
[2020-12-09T05:03:12.182Z]  Built:             Tue Dec  1 19:20:17 2020
[2020-12-09T05:03:12.182Z]  OS/Arch:           linux/amd64
[2020-12-09T05:03:12.182Z]  Experimental:      false
[2020-12-09T05:03:12.182Z] 
[2020-12-09T05:03:12.182Z] Server: Docker Engine - Community
[2020-12-09T05:03:12.182Z]  Engine:
[2020-12-09T05:03:12.182Z]   Version:          19.03.14
[2020-12-09T05:03:12.182Z]   API version:      1.40 (minimum version 1.12)
[2020-12-09T05:03:12.182Z]   Go version:       go1.13.15
[2020-12-09T05:03:12.182Z]   Git commit:       5eb3275d40
[2020-12-09T05:03:12.182Z]   Built:            Tue Dec  1 19:18:45 2020
[2020-12-09T05:03:12.182Z]   OS/Arch:          linux/amd64
[2020-12-09T05:03:12.182Z]   Experimental:     false
[2020-12-09T05:03:12.182Z]  containerd:
[2020-12-09T05:03:12.182Z]   Version:          1.3.9
[2020-12-09T05:03:12.182Z]   GitCommit:        ea765aba0d05254012b0b9e595e995c09186427f
[2020-12-09T05:03:12.182Z]  runc:
[2020-12-09T05:03:12.182Z]   Version:          1.0.0-rc10
[2020-12-09T05:03:12.182Z]   GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
[2020-12-09T05:03:12.182Z]  docker-init:
[2020-12-09T05:03:12.182Z]   Version:          0.18.0
[2020-12-09T05:03:12.182Z]   GitCommit:        fec3683
[2020-12-09T05:03:12.182Z] Unable to find image 'alpine:3.4' locally
[2020-12-09T05:03:12.750Z] 3.4: Pulling from library/alpine
[2020-12-09T05:03:12.750Z] c1e54eec4b57: Pulling fs layer
[2020-12-09T05:03:13.318Z] c1e54eec4b57: Verifying Checksum
[2020-12-09T05:03:13.318Z] c1e54eec4b57: Download complete
[2020-12-09T05:03:13.318Z] c1e54eec4b57: Pull complete
[2020-12-09T05:03:13.318Z] Digest: sha256:b733d4a32c4da6a00a84df2ca32791bb03df95400243648d8c539e7b4cce329c
[2020-12-09T05:03:13.318Z] Status: Downloaded newer image for alpine:3.4
[2020-12-09T05:03:23.556Z] [INFO] unstashV2: JOB_GCS_BUCKET is set. bucket param got precedency instead.
[2020-12-09T05:03:23.584Z] [INFO] unstashV2: JOB_GCS_CREDENTIALS is set. credentialsId param got precedency instead.
[2020-12-09T05:03:23.664Z] [Google Cloud Storage Plugin] Found 1 files to download from pattern: gs://beats-ci-temp/Beats/beats/PR-23010-1/source/source.tgz
[2020-12-09T05:03:23.998Z] Stage "Packaging" skipped due to earlier failure(s)
[2020-12-09T05:03:24.097Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-23010/src/github.com/elastic/beats
[2020-12-09T05:03:24.336Z] Running on Jenkins in /var/lib/jenkins/workspace/Beats_beats_PR-23010@2
[2020-12-09T05:03:24.491Z] [INFO] getVaultSecret: Getting secrets
[2020-12-09T05:03:24.580Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID
[2020-12-09T05:03:23.686Z] [Google Cloud Storage Plugin] Downloading: Beats/beats/PR-23010-1/source/source.tgz to local path: /var/lib/jenkins/workspace/Beats_beats_PR-23010/source.tgz
[2020-12-09T05:03:25.449Z] + chmod 755 generate-build-data.sh
[2020-12-09T05:03:25.449Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23010/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23010/runs/1 ABORTED 607054
[2020-12-09T05:03:25.449Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23010/runs/1/steps/?limit=10000 -o steps-info.json
[2020-12-09T05:03:25.700Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23010/runs/1/tests/?status=FAILED -o tests-errors.json
[2020-12-09T05:03:25.950Z] Retry 1/3 exited 22, retrying in 1 seconds...
[2020-12-09T05:03:27.294Z] Retry 2/3 exited 22, retrying in 2 seconds...
[2020-12-09T05:03:29.776Z] Retry 3/3 exited 22, no more retries left.
[2020-12-09T05:03:29.776Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23010/runs/1/log/ -o pipeline-log.txt

…guration-category

filebeat/module/auditd/log/ingest/pipeline.yml

…uditd, gsuite, o365, and zoom (elastic#23010) * [Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom * Update bad AppendTo * Update changelog * Convert processor to painless (cherry picked from commit 77292bf)

…uditd, gsuite, o365, and zoom (#23010) (#23047) * [Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom * Update bad AppendTo * Update changelog * Convert processor to painless (cherry picked from commit 77292bf)

[Filebeat] Update event categorization for configuration events for a…

c6a6685

…uditd, gsuite, o365, and zoom

andrewstucki added enhancement Filebeat Filebeat ecs Team:Security-External Integrations labels Dec 9, 2020

andrewstucki requested a review from a team December 9, 2020 04:52

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Dec 9, 2020

Andrew Stucki added 2 commits December 8, 2020 23:56

Update bad AppendTo

1ac937b

Update changelog

39150d8

andrewstucki mentioned this pull request Dec 9, 2020

[ECS] Upgrade modules to 1.7 #21674

Closed

andrewstucki changed the title ~~[Filebeat] Update event categorization for configuration events for a…~~ [Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom Dec 9, 2020

Andrew Stucki added 3 commits December 9, 2020 08:46

Merge branch 'master' of github.com:elastic/beats into filebeat-confi…

239391d

…guration-category

Merge branch 'master' into filebeat-configuration-category

8a5f12d

Merge branch 'master' into filebeat-configuration-category

e027ea1

leehinman reviewed Dec 9, 2020

View reviewed changes

filebeat/module/auditd/log/ingest/pipeline.yml Outdated Show resolved Hide resolved

Convert processor to painless

df365b9

leehinman approved these changes Dec 9, 2020

View reviewed changes

andrewstucki merged commit 77292bf into elastic:master Dec 9, 2020

andrewstucki mentioned this pull request Dec 9, 2020

Cherry-pick #23010 to 7.x: [Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23047

Merged

6 tasks

andrewstucki added the v7.11.0 label Dec 9, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23010

[Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23010

andrewstucki commented Dec 9, 2020 •

edited

Loading

elasticmachine commented Dec 9, 2020

elasticmachine commented Dec 9, 2020 •

edited by jenkins-beats-ci bot

Loading

Build stats

Test stats 🧪

Test stats 🧪

elasticmachine commented Dec 9, 2020

Build stats

[Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23010

[Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23010

Conversation

andrewstucki commented Dec 9, 2020 • edited Loading

What does this PR do?

Checklist

Related issues

elasticmachine commented Dec 9, 2020

elasticmachine commented Dec 9, 2020 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

Test stats 🧪

elasticmachine commented Dec 9, 2020

❕ Build Aborted

Build stats

Log output

andrewstucki commented Dec 9, 2020 •

edited

Loading

elasticmachine commented Dec 9, 2020 •

edited by jenkins-beats-ci bot

Loading