Skip to content

Fix EventID's for "Users Added to Group" panel #6280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 7 commits into from
Jul 14, 2023
Merged

Fix EventID's for "Users Added to Group" panel #6280

merged 7 commits into from
Jul 14, 2023

Conversation

sakurai-youhei
Copy link
Member

@sakurai-youhei sakurai-youhei commented May 22, 2023 •
edited
Loading

Fixes #6275

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
4732 636 Low A member was added to a security-enabled local group.
4728 632 Low A member was added to a security-enabled global group.
4756 660 Low A member was added to a security-enabled universal group.
4751 655 Low A member was added to a security-disabled global group.
4761 665 Low A member was added to a security-disabled universal group.
4746 650 Low A member was added to a security-disabled local group.
4785 689 Low A member was added to a basic application group.
4787 691 Low A nonmember was added to a basic application group.

What does this PR do?

Change Event ID's set to the filter in "Users Added to Group" panel.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Rewrite the numbers manually in the Lens.

Related issues

Screenshots

Kibana > Dashboard > [System Windows Security] Group Management Events > Users Added to Group

Before change
image

After change
image

@sakurai-youhei
Fix EventID's for "Users Added to Group" panel
e970868 
Fixes elastic#6275

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
4732 636 Low A member was added to a security-enabled local group.
4728 632 Low A member was added to a security-enabled global group.
4756 660 Low A member was added to a security-enabled universal group.
4751 655 Low A member was added to a security-disabled global group.
4761 665 Low A member was added to a security-disabled universal group.
4746 650 Low A member was added to a security-disabled local group.
4785 689 Low A member was added to a basic application group.
4787 691 Low A nonmember was added to a basic application group.
@sakurai-youhei sakurai-youhei added the bug Something isn't working, use only for issues label May 22, 2023
@sakurai-youhei sakurai-youhei marked this pull request as ready for review May 22, 2023 10:20
@sakurai-youhei sakurai-youhei requested review from a team as code owners May 22, 2023 10:20
@elasticmachine
Copy link

elasticmachine commented May 22, 2023 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-07-08T16:41:00.258+0000

  • Duration: 15 min 12 sec

Test stats 🧪

Test Results
Failed 0
Passed 146
Skipped 0
Total 146

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link

elasticmachine commented May 22, 2023 •
edited
Loading

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (3/3) 💚
Files 100.0% (4/4) 💚 2.757
Classes 100.0% (4/4) 💚 2.757
Methods 60.759% (48/79) 👎 -32.149
Lines 100.0% (2811/2811) 💚 8.85
Conditionals 100.0% (0/0) 💚

@jamiehynds jamiehynds requested a review from a team May 22, 2023 15:58
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@cmacknz cmacknz removed their request for review May 23, 2023 17:25
@pierrehilbert pierrehilbert removed their request for review June 2, 2023 08:01
@efd6
Copy link
Contributor

efd6 commented Jun 5, 2023

There is currently a beta version in play for the promotion of TSDB to GA, so this PR should wait for that to have gone in before it's updated and merged.

/cc @tetianakravchenko

@ebeahan
Copy link
Member

ebeahan commented Jun 26, 2023

Are these changes able to move forward with 1.34.0 released in #6607?

@sakurai-youhei sakurai-youhei requested a review from a team as a code owner June 27, 2023 02:50
@sakurai-youhei
Copy link
Member Author

sakurai-youhei commented Jun 27, 2023 •
edited
Loading

@ebeahan Is that change bumping up to 1.34.1 ok?

@sakurai-youhei
Copy link
Member Author

/test

@sakurai-youhei
Copy link
Member Author

The same issue here. #6607 (comment) Because elastic-package v0.83.2 was released with the fix - elastic/elastic-package#1315 20 hours ago, I'm attempting the test again.

@sakurai-youhei
Copy link
Member Author

/test

@efd6
Copy link
Contributor

efd6 commented Jun 29, 2023

@sakurai-youhei Are you able to merge?

@sakurai-youhei
Copy link
Member Author

@efd6 No, The merge button is still diactive and it says:

Waiting on code owner review from elastic/elastic-agent-data-plane, elastic/kibana-visualizations, and/or elastic/obs-infraobs-integrations.

Could you give another approval from either? Thanks.

@efd6
Copy link
Contributor

efd6 commented Jun 30, 2023

Sorry, I missed that there are different owners across multiple files.

@efd6
Copy link
Contributor

efd6 commented Jul 14, 2023

@elastic/elastic-agent-data-plane, @elastic/kibana-visualizations and @elastic/obs-infraobs-integrations would you be able to take a look please.

ishleenk17
ishleenk17 approved these changes Jul 14, 2023
View reviewed changes
Copy link
Member

@ishleenk17 ishleenk17 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@sakurai-youhei sakurai-youhei merged commit bc7ff96 into elastic:main Jul 14, 2023
@elasticmachine
Copy link

Package system - 1.36.1 containing this change is available at https://epr.elastic.co/search?package=system

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cmacknz cmacknz cmacknz approved these changes

@efd6 efd6 efd6 approved these changes

@ishleenk17 ishleenk17 ishleenk17 approved these changes

Assignees
No one assigned
Labels
bug Something isn't working, use only for issues Integration:system System
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[System][Windows] "Users Added to Group" panel has incorrect filter
8 participants
@sakurai-youhei @elasticmachine @efd6 @ebeahan @cmacknz @ishleenk17 @andrewkroh @jamiehynds