Fix authentication_failure event.type for security module (elastic#12393

) Change authentication_failed to authentication_failure in the event.type field added by the Security module. Relates elastic#11651 (cherry picked from commit 97404f9)
andrewkroh · Jun 3, 2019 · 9c624cf · 9c624cf
1 parent c067d50
commit 9c624cf
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js
@@ -18,7 +18,7 @@ var security = (function () {
     var addAuthFailed = new processor.AddFields({
         fields: {
             "event.category": "authentication",
-            "event.type": "authentication_failed",
+            "event.type": "authentication_failure",
         },
         target: "",
     });

diff --git a/...ck/winlogbeat/module/security/test/testdata/security-windows2012r2-logon.evtx.golden.json b/...ck/winlogbeat/module/security/test/testdata/security-windows2012r2-logon.evtx.golden.json
@@ -1069,7 +1069,7 @@
       "category": "authentication",
       "code": 4625,
       "kind": "event",
-      "type": "authentication_failed"
+      "type": "authentication_failure"
     },
     "log": {
       "level": "information"