Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Winlogbeat] add eventID 4912 test #23694

Closed
wants to merge 1 commit into from
Closed

[Winlogbeat] add eventID 4912 test #23694

wants to merge 1 commit into from

Conversation

leehinman
Copy link
Contributor

What does this PR do?

adds example of eventID 4912 captured on win2012R2

Why is it important?

testing winlogbeat security module. previous example captured on a
win2016 host did not work on win2012R2, Win 7 or Win 8

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

cd x-pack\winlogbeat\module\security\test
go test -v

Related issues

@leehinman
[Winlogbeat] add eventID 4912 test
4722ef0 
- add example of eventID 4912 captured on win2012R2
@leehinman leehinman requested a review from a team as a code owner January 26, 2021 16:51
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jan 26, 2021
@leehinman leehinman added needs_backport PR is waiting to be backported to other branches. Team:Security-External Integrations Winlogbeat labels Jan 26, 2021
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jan 26, 2021
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@leehinman
Copy link
Contributor Author

While this works for 2012, still seeing errors on win 7 & 2008.

@leehinman leehinman closed this Jan 26, 2021
@leehinman leehinman deleted the 4912_win2012R2_test branch May 14, 2021 14:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
needs_backport PR is waiting to be backported to other branches. Winlogbeat
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@leehinman @elasticmachine