[windows] Add provider name check to forwarded/security conditional #2527
Conversation
- Added a check to the forwarded/security conditional to ensure that only events with a provider of Microsoft-Windows-Eventlog or Microsoft-Windows-Security-Auditing are allowed through. Events not matching these providers will still be indexed, but won't receive additional enrichment that could lead to incorrect metadata being applied.
taylor-swanson
added
bug
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
| @@ -3,7 +3,7 @@ description: Pipeline for Windows forwarded Event Logs | |||
| processors: | |||
| - pipeline: | |||
| name: '{{ IngestPipeline "security" }}' | |||
| if: ctx?.winlog?.channel != null && ctx?.winlog?.channel == "Security" | |||
| if: ctx?.winlog?.channel != null && ctx?.winlog?.channel == "Security" && ctx?.winlog?.provider_name != null && ["Microsoft-Windows-Eventlog", "Microsoft-Windows-Security-Auditing"].contains(ctx?.winlog?.provider_name) | |||
There was a problem hiding this comment.
Are there cases where channel is "Security" but provider_name isn't /Microsoft-Windows-(Eventlog|Security-Auditing)/?
There was a problem hiding this comment.
Good question. For forwarded events I'm not sure if this is the case or not. The other provider name we know of that can appear in the Security channel is AD FS, and we know we don't want it enriched with this pipeline. I was mostly replicating the logic from other pipelines here (the ones in System and Winlogbeat). I think this is still safe since we don't want to enrich any other providers other than the ones we know of. Those are listed here: https://windows-event-explorer.app.elstc.co/channel/Security
What does this PR do?
-Added a check to the forwarded/security conditional to ensure that only events with a provider of
Microsoft-Windows-EventlogorMicrosoft-Windows-Security-Auditingare allowed through. Events not matching these providers will still be indexed, but won't receive additional enrichment that could lead to incorrect metadata being applied.Checklist
changelog.ymlfile.How to test this PR locally
Related issues