Fix powershell error on events 40961 and 40962

[bjmcnic]

Proposed commit message

Fix pipeline_error for powershell_operational events 40961 and 40962.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[leehinman]

missing changes to manifest.yml that match the change in changelog.yml

[leehinman]

For sure we need to add this to:

forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml

but it probably applies to:

• powershell/elasticsearch/ingest_pipeline/default.yml
• sysmon_operational/elasticsearch/ingest_pipeline/default.yml
• forwarded/elasticsearch/ingest_pipeline/powershell.yml
• forwarded/elasticsearch/ingest_pipeline/sysmon_operational.yml

Do you happen to have any sample events you could add to powershell_operational/_dev/test/pipeline/test-events.json ? That way the tests will catch this if we break it in the future.

[bjmcnic]

@leehinman Thanks for the tips. I was able to find sample events for powershell_operational and added them to tests. I also made the analogous fix powershell and sysmon_operational as you'd suggested, but was unable to create real events that would trigger the issue for those.

[jamiehynds]

Hi @bjmcnic - a customer has been in touch looking for an update on this PR. Their main focus is 40961 and 40962 event support within the powershell_operational pipeline? Is it possible to prioritise that pipeline first, and handle the forwarded events (and other) pipelines separately?

[bjmcnic]

@jamiehynds I added the tests for powershell_operational and the forwarded events for that. I was unable to naturally generate erring events for powershell or sysmon_operational, but I put the fixes in anyway. We'll see what reviewers think.

[elasticmachine]

🚀 Benchmarks report

Package windows 👍(4) 💚(2) 💔(3)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
applocker_msi_and_script	9433.96	7462.69	-1971.27 (-20.9%)	💔
applocker_packaged_app_deployment	14705.88	11904.76	-2801.12 (-19.05%)	💔
powershell_operational	4347.83	2976.19	-1371.64 (-31.55%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 8ef0da9

History

• 💔 Build #14663 failed 6aac51f

cc @bjmcnic

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
85.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[leehinman]

LGTM. Thanks for adding the test cases.

[elasticmachine]

Package windows - 2.0.2 containing this change is available at https://epr.elastic.co/search?package=windows