Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Auditbeat] Add message field to system module #9483

Merged
merged 10 commits into from
Dec 12, 2018
Merged

[Auditbeat] Add message field to system module #9483

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
34db7dc
Add message field and eventAction enum everywhere.
Dec 10, 2018
bb125d8
System testing: Base fields are top-level.
Dec 11, 2018
8b7cb87
Start enums at 0.
Dec 11, 2018
8a304cd
Adjust password change message.
Dec 11, 2018
39dfdbe
Disable test again, will fix later.
Dec 11, 2018
b2894dd
Make Hound happy
Dec 11, 2018
82406ba
Fix rebase
Dec 11, 2018
e7c6fb2
Handle when host has no IP
Dec 12, 2018
1323a4c
Fix user test data
Dec 12, 2018
48d5ac7
Update socket test data
Dec 12, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Update socket test data
  • Loading branch information
Christoph Wurm committed Dec 12, 2018
commit 48d5ac7785a83e5e723acdf3c6368cf3fab081b8
14 changes: 7 additions & 7 deletions x-pack/auditbeat/module/system/socket/_meta/data.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,28 +11,28 @@
"event": {
"action": "existing_socket",
"dataset": "socket",
"id": "d55364de-0442-4638-9022-887d0a549b00",
"module": "system",
"kind": "state"
"id": "6aff69f8-7267-4604-9701-d7b67a7c65bc",
"kind": "state",
"module": "system"
},
"message": "Inbound socket (10.0.2.2:52002 -\u003e 10.0.2.15:22) OPEN by process sshd (PID: 2293) and user root (UID: 0)",
"message": "Inbound socket (10.0.2.2:55270 -\u003e 10.0.2.15:22) OPEN by process sshd (PID: 22799) and user root (UID: 0)",
"network": {
"direction": "inbound",
"type": "ipv4"
},
"process": {
"name": "sshd",
"pid": 2293
"pid": 22799
},
"service": {
"type": "system"
},
"source": {
"ip": "10.0.2.2",
"port": 52002
"port": 55270
},
"user": {
"id": 0,
"name": "root"
}
}
}