Filebeat auditd: Fix Top Exec Commands dashboard visualization #27638
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This visualization was expecting an uppercase EXECVE value in event.action while the ingest pipeline was lowercasing this value.
adriansr
added
bug
review
Team:Security-External Integrations
backport-v7.14.0
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
botelastic
bot
added
needs_team
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
Trends 🧪💚 Flaky test reportTests succeeded. Expand to view the summary
Test stats 🧪
|
andrewkroh
approved these changes
Aug 30, 2021
mergify bot
pushed a commit
that referenced
this pull request
Aug 30, 2021
This visualization was expecting an uppercase EXECVE value in event.action while the ingest pipeline was lowercasing this value. (cherry picked from commit 02315d9)
mergify bot
pushed a commit
that referenced
this pull request
Aug 30, 2021
This visualization was expecting an uppercase EXECVE value in event.action while the ingest pipeline was lowercasing this value. (cherry picked from commit 02315d9) # Conflicts: # filebeat/module/auditd/_meta/kibana/7/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858-ecs.json
mergify bot
pushed a commit
that referenced
this pull request
Aug 30, 2021
This visualization was expecting an uppercase EXECVE value in event.action while the ingest pipeline was lowercasing this value. (cherry picked from commit 02315d9) # Conflicts: # filebeat/module/auditd/_meta/kibana/7/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858-ecs.json
mergify bot
pushed a commit
that referenced
this pull request
Aug 30, 2021
This visualization was expecting an uppercase EXECVE value in event.action while the ingest pipeline was lowercasing this value. (cherry picked from commit 02315d9) # Conflicts: # filebeat/module/auditd/_meta/kibana/7/visualization/5ebdbe50-0a0f-11e7-825f-6748cda7d858-ecs.json
adriansr
added a commit
to adriansr/beats
that referenced
this pull request
Aug 30, 2021
…ic#27638) This visualization was expecting an uppercase EXECVE value in event.action while the ingest pipeline was lowercasing this value.
adriansr
added a commit
that referenced
this pull request
Aug 30, 2021
… (#27646) This visualization was expecting an uppercase EXECVE value in event.action while the ingest pipeline was lowercasing this value.
adriansr
added a commit
that referenced
this pull request
Aug 31, 2021
mdelapenya
added a commit
to mdelapenya/beats
that referenced
this pull request
Sep 1, 2021
* master: Forward port 7.14.1 changelog to master (elastic#27687) Addressing multiple dashboard issues: deps loading once, field conversion, etc. (elastic#27669) Remove adaptive queue sizes from agent's spec files (elastic#27653) Osquerybeat: Improve testability and unit test coverage (elastic#27591) Osquerybeat: lockdown flagsfile, prevent global defaults (elastic#27611) Import the references of dashboard assets using the Saved Objects API (elastic#27647) Fix bug with override path in cgroups (elastic#27620) Allow Kibana client to authorize with Elasticsearch API key (elastic#27540) Filebeat auditd: Fix Top Exec Commands dashboard visualization (elastic#27638) [elastic-agent] Fix docker tar.gz generation for complete image (elastic#27621) Follow up changes in dashboards in mage check && fix minor issue (elastic#27553) [Heartbeat] Fix bug where `enabled: false` is ignored. (elastic#27615) Support kube_state_metrics v2.0.0 (elastic#27552)
Icedroid
pushed a commit
to Icedroid/beats
that referenced
this pull request
Nov 1, 2021
…ic#27638) This visualization was expecting an uppercase EXECVE value in event.action while the ingest pipeline was lowercasing this value.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Updates a Kibana visualization provided by Filebeat's auditd module so that it filters on the lowercase value
execveinstead of uppercase.Why is it important?
For a long time the module has been lowercasing the value of the ECS event.action field, but the dashboard wasn't updated.
Checklist
[ ] My code follows the style guidelines of this project[ ] I have commented my code, particularly in hard-to-understand areas[ ] I have made corresponding changes to the documentation[ ] I have made corresponding change to the default configuration files[ ] I have added tests that prove my fix is effective or that my feature worksCHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.