Add support for FileDelete events (event id 23) to sysmon module

FileDelete events were added in Sysmon v11.
Prior to this change processing such events lead to an 'unexpected sysmon event_id' error message.

Closes elastic#18094

CHANGELOG.next.asciidoc

@@ -44,6 +44,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 *Winlogbeat*
 
+- Add support to Sysmon file delete events (event ID 23). {issue}18094[18094]
+
 *Functionbeat*
 
 

winlogbeat/docs/fields.asciidoc

@@ -7572,6 +7572,24 @@ type: keyword
 
 --
 
+*`sysmon.file.archived`*::
++
+--
+Indicates if the deleted file was archived.
+
+type: boolean
+
+--
+
+*`sysmon.file.is_executable`*::
++
+--
+Indicates if the deleted file was an executable.
+
+type: boolean
+
+--
+
 [[exported-fields-winlog]]
 == Winlogbeat fields
 

x-pack/winlogbeat/module/sysmon/_meta/fields.yml

@@ -8,3 +8,11 @@
     - name: sysmon.dns.status
       type: keyword
       description: Windows status code returned for the DNS query.
+
+    - name: sysmon.file.archived
+      type: boolean
+      description: Indicates if the deleted file was archived.
+
+    - name: sysmon.file.is_executable
+      type: boolean
+      description: Indicates if the deleted file was an executable.

x-pack/winlogbeat/module/sysmon/config/winlogbeat-sysmon.js

@@ -1392,6 +1392,63 @@ var sysmon = (function () {
         .Add(removeEmptyEventData)
         .Build();
 
+    // Event ID 23 - FileDelete (A file delete was detected).
+    var event23 = new processor.Chain()
+        .Add(parseUtcTime)
+        .AddFields({
+            fields: {
+                "event.category": ["file"], // pipes are files
+                "event.type": ["deletion"],
+            },
+        })
+        .Convert({
+            fields: [
+                {
+                    from: "winlog.event_data.UtcTime",
+                    to: "@timestamp",
+                },
+                {
+                    from: "winlog.event_data.ProcessGuid",
+                    to: "process.entity_id",
+                },
+                {
+                    from: "winlog.event_data.ProcessId",
+                    to: "process.pid",
+                    type: "long",
+                },
+                {
+                    from: "winlog.event_data.RuleName",
+                    to: "rule.name",
+                },
+                {
+                    from: "winlog.event_data.TargetFilename",
+                    to: "file.name",
+                },
+                {
+                    from: "winlog.event_data.Image",
+                    to: "process.executable",
+                },
+                {
+                    from: "winlog.event_data.Archived",
+                    to: "sysmon.file.archived",
+                    type: "boolean",
+                },
+                {
+                    from: "winlog.event_data.IsExecutable",
+                    to: "sysmon.file.is_executable",
+                    type: "boolean",
+                },
+            ],
+            mode: "rename",
+            ignore_missing: true,
+            fail_on_error: false,
+        })
+        .Add(addUser)
+        .Add(splitHashes)
+        .Add(setProcessNameUsingExe)
+        .Add(removeEmptyEventData)
+        .Build();
+
     // Event ID 255 - Error report.
     var event255 = new processor.Chain()
         .Add(parseUtcTime)
@@ -1436,6 +1493,7 @@ var sysmon = (function () {
         20: event20.Run,
         21: event21.Run,
         22: event22.Run,
+        23: event23.Run,
         255: event255.Run,
 
         process: function (evt) {

x-pack/winlogbeat/module/sysmon/test/testdata/sysmon-11-filedelete.evtx.golden.json

@@ -0,0 +1,74 @@
+[
+  {
+    "@timestamp": "2020-05-07T07:27:18.722Z",
+    "event": {
+      "code": 23,
+      "kind": "event",
+      "module": "sysmon",
+      "provider": "Microsoft-Windows-Sysmon"
+    },
+    "fields": {
+      "event": {
+        "category": [
+          "file"
+        ],
+        "type": [
+          "deletion"
+        ]
+      }
+    },
+    "file": {
+      "name": "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\lastalive0.dat"
+    },
+    "hash": {
+      "sha1": "115106f5b338c87ae6836d50dd890de3da296367"
+    },
+    "host": {
+      "name": "vagrant-2012-r2"
+    },
+    "log": {
+      "level": "information"
+    },
+    "process": {
+      "entity_id": "{42f11c3b-b2b6-5eb3-18ab-000000000000}",
+      "executable": "C:\\Windows\\System32\\svchost.exe",
+      "name": "svchost.exe",
+      "pid": 776
+    },
+    "rule": {
+      "name": "-"
+    },
+    "sysmon": {
+      "file": {
+        "archived": true,
+        "is_executable": false
+      }
+    },
+    "user": {
+      "domain": "NT AUTHORITY",
+      "name": "LOCAL SERVICE"
+    },
+    "winlog": {
+      "api": "wineventlog",
+      "channel": "Microsoft-Windows-Sysmon/Operational",
+      "computer_name": "vagrant-2012-r2",
+      "event_id": 23,
+      "process": {
+        "pid": 664,
+        "thread": {
+          "id": 2360
+        }
+      },
+      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
+      "provider_name": "Microsoft-Windows-Sysmon",
+      "record_id": 11,
+      "user": {
+        "domain": "NT AUTHORITY",
+        "identifier": "S-1-5-18",
+        "name": "SYSTEM",
+        "type": "Well Known Group"
+      },
+      "version": 5
+    }
+  }
+]