[Filebeat][New Module] Adding support for Microsoft Defender ATP #19197
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
P1llus
added
enhancement
in progress
botelastic
bot
added
the
needs_team
|
Pinging @elastic/integrations (Team:Integrations) |
botelastic
bot
removed
the
needs_team
💔 Tests Failed
Expand to view the summary
Build stats
Test stats 🧪
Test errorsExpand to view the tests failures
Steps errorsExpand to view the steps failures
Log outputExpand to view the last 100 lines of log output
|
P1llus
force-pushed
the
filebeat_atp_module_mvp
branch
from
55abde5
to
707a9c7
Compare
|
Pinging @elastic/siem (Team:SIEM) |
P1llus
force-pushed
the
filebeat_atp_module_mvp
branch
from
b0d7969
to
1444813
Compare
P1llus
added
review
and removed
in progress
leehinman
requested changes
Jul 6, 2020
| field: json.description | ||
| target_field: rule.description | ||
| ignore_missing: true | ||
| if: (ctx.json?.description).length() < 1020 |
There was a problem hiding this comment.
optional. I'm wondering if we should copy the first 1019 chars, not skip if over 1019.
There was a problem hiding this comment.
I think that the sentence would just break off at that point, it would be half a sentence. I think that its just to ensure it never hits the limit as it was the only field that can in very niche usecases maybe include too much info. It wouldn't stop any of the events I have seen, and its more to drop it on ingest rather than creating an error in elasticsearch due to the field size limit (1024?)
leehinman
reviewed
Jul 6, 2020
x-pack/filebeat/module/microsoft/defender_atp/test/defender_atp-test.json.log-expected.json
Outdated
Show resolved
Hide resolved
P1llus
force-pushed
the
filebeat_atp_module_mvp
branch
from
b0ff380
to
b9e0092
Compare
|
run tests |
|
jenkins run tests |
P1llus
force-pushed
the
filebeat_atp_module_mvp
branch
from
d88d542
to
9e8ecd7
Compare
andrewkroh
approved these changes
Jul 13, 2020
| This is a list of Defender ATP fields that are mapped to ECS. | ||
|
|
||
| [options="header"] | ||
| |======================================================================| |
There was a problem hiding this comment.
This is great info to have in the docs.
…g it ready for review
…s and resolving some null fields
…nce done. Updating field docs and running mage fmt update
…ded in separate PR
P1llus
force-pushed
the
filebeat_atp_module_mvp
branch
from
9e8ecd7
to
00b9f63
Compare
|
jenkins run tests |
|
jenkins run tests |
|
This has a docs build issue that needs fixed. |
marc-gr
pushed a commit
to marc-gr/beats
that referenced
this pull request
Jul 14, 2020
…stic#19197) What does this PR do? This PR adds the initial beta support for Microsoft Defender ATP. Why is it important? Adds new products to the supported list for filebeat Co-authored-by: Lee E. Hinman <lee.e.hinman@elastic.co> (cherry picked from commit fead071)
Merged
9 tasks
andrewkroh
pushed a commit
that referenced
this pull request
Jul 14, 2020
…Microsoft Defender ATP (#19907) * [Filebeat][New Module] Adding support for Microsoft Defender ATP (#19197) What does this PR do? This PR adds the initial beta support for Microsoft Defender ATP. Why is it important? Adds new products to the supported list for filebeat Co-authored-by: Lee E. Hinman <lee.e.hinman@elastic.co> Co-authored-by: Marius Iversen <pillus@chasenet.org> (cherry picked from commit fead071)
melchiormoulin
pushed a commit
to melchiormoulin/beats
that referenced
this pull request
Oct 14, 2020
…stic#19197) What does this PR do? This PR adds the initial beta support for Microsoft Defender ATP. Why is it important? Adds new products to the supported list for filebeat Co-authored-by: Lee E. Hinman <lee.e.hinman@elastic.co>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR adds the initial beta support for Microsoft Defender ATP.
Why is it important?
Adds new products to the supported list for filebeat
Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Author's Checklist
Related issues
Reviewers:
The documentation for the incoming JSON fields is available here:
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/alerts