From 97404f99f53e29db229707270b8279010ee14007 Mon Sep 17 00:00:00 2001
From: Andrew Kroh <andrew.kroh@elastic.co>
Date: Mon, 3 Jun 2019 14:31:27 -0400
Subject: [PATCH] Fix authentication_failure event.type for security module
 (#12393)

Change authentication_failed to authentication_failure in the event.type field added by the Security module.

Relates #11651
---
 x-pack/winlogbeat/module/security/config/winlogbeat-security.js | 2 +-
 .../test/testdata/security-windows2012r2-logon.evtx.golden.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js
index c8c5973320a..b598c686a56 100644
--- a/x-pack/winlogbeat/module/security/config/winlogbeat-security.js
+++ b/x-pack/winlogbeat/module/security/config/winlogbeat-security.js
@@ -18,7 +18,7 @@ var security = (function () {
     var addAuthFailed = new processor.AddFields({
         fields: {
             "event.category": "authentication",
-            "event.type": "authentication_failed",
+            "event.type": "authentication_failure",
         },
         target: "",
     });
diff --git a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012r2-logon.evtx.golden.json b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012r2-logon.evtx.golden.json
index d391d6fc87a..d9f97fe5e3c 100644
--- a/x-pack/winlogbeat/module/security/test/testdata/security-windows2012r2-logon.evtx.golden.json
+++ b/x-pack/winlogbeat/module/security/test/testdata/security-windows2012r2-logon.evtx.golden.json
@@ -1069,7 +1069,7 @@
       "category": "authentication",
       "code": 4625,
       "kind": "event",
-      "type": "authentication_failed"
+      "type": "authentication_failure"
     },
     "log": {
       "level": "information"