diff --git a/packages/system/changelog.yml b/packages/system/changelog.yml index 47bb2e17418..d7049678ba5 100644 --- a/packages/system/changelog.yml +++ b/packages/system/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.19.3" + changes: + - description: Add test cases for events 4738 and 4742. + type: bugfix + link: https://github.com/elastic/integrations/pull/3944 - version: "1.19.2" changes: - description: Add mapping for event.original for auth and security data streams. @@ -6,7 +11,7 @@ link: https://github.com/elastic/integrations/pull/4012 - version: "1.19.1" changes: - - description: Fix handling of security events 4674, 4738 and 3742. + - description: Fix handling of security events 4674, 4738 and 4742. type: bugfix link: https://github.com/elastic/integrations/pull/3930 - version: "1.19.0" diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-4738.json b/packages/system/data_stream/security/_dev/test/pipeline/test-4738.json new file mode 100644 index 00000000000..e23bd781780 --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-4738.json @@ -0,0 +1,72 @@ +{ + "events": [ + { + "@timestamp": "2021-11-11T17:14:52.001Z", + "event": { + "action": "User Account Management", + "code": "4738", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "host": { + "name": "DC_TEST2k12" + }, + "log": { + "level": "information" + }, + "message": "A user account was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-2794\n\tAccount Name:\t\tat_adm\n\tAccount Domain:\t\tTEST\n\tLogon ID:\t\t0x5E2887\n\nTarget Account:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-8884\n\tAccount Name:\t\tanatest1\n\tAccount Domain:\t\tTEST\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tDisplay Name:\t\t-\n\tUser Principal Name:\tanatest12@TEST\n\tHome Directory:\t\t-\n\tHome Drive:\t\t-\n\tScript Path:\t\t-\n\tProfile Path:\t\t-\n\tUser Workstations:\t-\n\tPassword Last Set:\t-\n\tAccount Expires:\t\t-\n\tPrimary Group ID:\t-\n\tAllowedToDelegateTo:\t-\n\tOld UAC Value:\t\t-\n\tNew UAC Value:\t\t-\n\tUser Account Control:\t-\n\tUser Parameters:\t-\n\tSID History:\t\t-\n\tLogon Hours:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "winlog": { + "channel": "Security", + "computer_name": "DC_TEST2k12", + "event_data": { + "AccountExpires": "-", + "AllowedToDelegateTo": "-", + "DisplayName": "-", + "Dummy": "-", + "HomeDirectory": "-", + "HomePath": "-", + "LogonHours": "-", + "NewUacValue": "-", + "OldUacValue": "-", + "PasswordLastSet": "-", + "PrimaryGroupId": "-", + "PrivilegeList": "-", + "ProfilePath": "-", + "SamAccountName": "-", + "ScriptPath": "-", + "SidHistory": "-", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x5e2887", + "SubjectUserName": "at_adm", + "SubjectUserSid": "S-1-5-21-1717121054-434620538-60925301-2794", + "TargetDomainName": "TEST", + "TargetSid": "S-1-5-21-1717121054-434620538-60925301-8884", + "TargetUserName": "anatest1", + "UserAccountControl": "-", + "UserParameters": "-", + "UserPrincipalName": "anatest12@TEST", + "UserWorkstations": "-" + }, + "event_id": "4738", + "keywords": [ + "Audit Success" + ], + "level": "information", + "opcode": "Info", + "outcome": "success", + "process": { + "pid": 604, + "thread": { + "id": 864 + } + }, + "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 18232108, + "task": "User Account Management", + "time_created": "2022-08-01T08:49:58.8259888Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-4738.json-expected.json b/packages/system/data_stream/security/_dev/test/pipeline/test-4738.json-expected.json new file mode 100644 index 00000000000..0c6f66fc80d --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-4738.json-expected.json @@ -0,0 +1,101 @@ +{ + "expected": [ + { + "@timestamp": "2022-08-01T08:49:58.825Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "modified-user-account", + "category": [ + "iam" + ], + "code": "4738", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "user", + "change" + ] + }, + "host": { + "name": "DC_TEST2k12" + }, + "log": { + "level": "information" + }, + "message": "A user account was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-2794\n\tAccount Name:\t\tat_adm\n\tAccount Domain:\t\tTEST\n\tLogon ID:\t\t0x5E2887\n\nTarget Account:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-8884\n\tAccount Name:\t\tanatest1\n\tAccount Domain:\t\tTEST\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tDisplay Name:\t\t-\n\tUser Principal Name:\tanatest12@TEST\n\tHome Directory:\t\t-\n\tHome Drive:\t\t-\n\tScript Path:\t\t-\n\tProfile Path:\t\t-\n\tUser Workstations:\t-\n\tPassword Last Set:\t-\n\tAccount Expires:\t\t-\n\tPrimary Group ID:\t-\n\tAllowedToDelegateTo:\t-\n\tOld UAC Value:\t\t-\n\tNew UAC Value:\t\t-\n\tUser Account Control:\t-\n\tUser Parameters:\t-\n\tSID History:\t\t-\n\tLogon Hours:\t\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "related": { + "user": [ + "at_adm", + "anatest1" + ] + }, + "user": { + "domain": "TEST", + "id": "S-1-5-21-1717121054-434620538-60925301-2794", + "name": "at_adm", + "target": { + "domain": "TEST", + "id": "S-1-5-21-1717121054-434620538-60925301-8884", + "name": "anatest1" + } + }, + "winlog": { + "channel": "Security", + "computer_name": "DC_TEST2k12", + "event_data": { + "AccountExpires": "-", + "AllowedToDelegateTo": "-", + "DisplayName": "-", + "Dummy": "-", + "HomeDirectory": "-", + "HomePath": "-", + "LogonHours": "-", + "NewUacValue": "-", + "OldUacValue": "-", + "PasswordLastSet": "-", + "PrimaryGroupId": "-", + "PrivilegeList": "-", + "ProfilePath": "-", + "SamAccountName": "-", + "ScriptPath": "-", + "SidHistory": "-", + "SubjectDomainName": "TEST", + "SubjectLogonId": "0x5e2887", + "SubjectUserName": "at_adm", + "SubjectUserSid": "S-1-5-21-1717121054-434620538-60925301-2794", + "TargetDomainName": "TEST", + "TargetSid": "S-1-5-21-1717121054-434620538-60925301-8884", + "TargetUserName": "anatest1", + "UserAccountControl": "-", + "UserParameters": "-", + "UserPrincipalName": "anatest12@TEST", + "UserWorkstations": "-" + }, + "event_id": "4738", + "keywords": [ + "Audit Success" + ], + "level": "information", + "logon": { + "id": "0x5e2887" + }, + "opcode": "Info", + "outcome": "success", + "process": { + "pid": 604, + "thread": { + "id": 864 + } + }, + "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": "18232108", + "task": "User Account Management", + "time_created": "2022-08-01T08:49:58.8259888Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-4742.json b/packages/system/data_stream/security/_dev/test/pipeline/test-4742.json new file mode 100644 index 00000000000..524720e3171 --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-4742.json @@ -0,0 +1,74 @@ +{ + "events": [ + { + "@timestamp": "2021-11-11T17:14:52.001Z", + "event": { + "action": "Computer Account Management", + "code": "4742", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "host": { + "name": "DC_TEST2k12.TEST." + }, + "log": { + "level": "information" + }, + "message": "A computer account was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-7\n\tAccount Name:\t\tANONYMOUS LOGON\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E6\n\nComputer Account That Was Changed:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-11556\n\tAccount Name:\t\tTEST4642$\n\tAccount Domain:\t\tTEST\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tDisplay Name:\t\t-\n\tUser Principal Name:\t-\n\tHome Directory:\t\t-\n\tHome Drive:\t\t-\n\tScript Path:\t\t-\n\tProfile Path:\t\t-\n\tUser Workstations:\t-\n\tPassword Last Set:\t01/08/2022 10:56:47\n\tAccount Expires:\t\t-\n\tPrimary Group ID:\t-\n\tAllowedToDelegateTo:\t-\n\tOld UAC Value:\t\t-\n\tNew UAC Value:\t\t-\n\tUser Account Control:\t-\n\tUser Parameters:\t-\n\tSID History:\t\t-\n\tLogon Hours:\t\t-\n\tDNS Host Name:\t\t-\n\tService Principal Names:\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "winlog": { + "channel": "Security", + "computer_name": "DC_TEST2k12.TEST.", + "event_data": { + "AccountExpires": "-", + "AllowedToDelegateTo": "-", + "ComputerAccountChange": "-", + "DisplayName": "-", + "DnsHostName": "-", + "HomeDirectory": "-", + "HomePath": "-", + "LogonHours": "-", + "NewUacValue": "-", + "OldUacValue": "-", + "PasswordLastSet": "01/08/2022 10:56:47", + "PrimaryGroupId": "-", + "PrivilegeList": "-", + "ProfilePath": "-", + "SamAccountName": "-", + "ScriptPath": "-", + "ServicePrincipalNames": "-", + "SidHistory": "-", + "SubjectDomainName": "NT AUTHORITY", + "SubjectLogonId": "0x3e6", + "SubjectUserName": "ANONYMOUS LOGON", + "SubjectUserSid": "S-1-5-7", + "TargetDomainName": "TEST", + "TargetSid": "S-1-5-21-1717121054-434620538-60925301-11556", + "TargetUserName": "TEST4642$", + "UserAccountControl": "-", + "UserParameters": "-", + "UserPrincipalName": "-", + "UserWorkstations": "-" + }, + "event_id": "4742", + "keywords": [ + "Audit Success" + ], + "level": "information", + "opcode": "Info", + "outcome": "success", + "process": { + "pid": 604, + "thread": { + "id": 864 + } + }, + "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 18232202, + "task": "Computer Account Management", + "time_created": "2022-08-01T08:56:47.9740262Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-4742.json-expected.json b/packages/system/data_stream/security/_dev/test/pipeline/test-4742.json-expected.json new file mode 100644 index 00000000000..77d449f587e --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-4742.json-expected.json @@ -0,0 +1,104 @@ +{ + "expected": [ + { + "@timestamp": "2022-08-01T08:56:47.974Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "changed-computer-account", + "category": [ + "iam" + ], + "code": "4742", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "change", + "admin" + ] + }, + "host": { + "name": "DC_TEST2k12.TEST." + }, + "log": { + "level": "information" + }, + "message": "A computer account was changed.\n\nSubject:\n\tSecurity ID:\t\tS-1-5-7\n\tAccount Name:\t\tANONYMOUS LOGON\n\tAccount Domain:\t\tNT AUTHORITY\n\tLogon ID:\t\t0x3E6\n\nComputer Account That Was Changed:\n\tSecurity ID:\t\tS-1-5-21-1717121054-434620538-60925301-11556\n\tAccount Name:\t\tTEST4642$\n\tAccount Domain:\t\tTEST\n\nChanged Attributes:\n\tSAM Account Name:\t-\n\tDisplay Name:\t\t-\n\tUser Principal Name:\t-\n\tHome Directory:\t\t-\n\tHome Drive:\t\t-\n\tScript Path:\t\t-\n\tProfile Path:\t\t-\n\tUser Workstations:\t-\n\tPassword Last Set:\t01/08/2022 10:56:47\n\tAccount Expires:\t\t-\n\tPrimary Group ID:\t-\n\tAllowedToDelegateTo:\t-\n\tOld UAC Value:\t\t-\n\tNew UAC Value:\t\t-\n\tUser Account Control:\t-\n\tUser Parameters:\t-\n\tSID History:\t\t-\n\tLogon Hours:\t\t-\n\tDNS Host Name:\t\t-\n\tService Principal Names:\t-\n\nAdditional Information:\n\tPrivileges:\t\t-", + "related": { + "user": [ + "ANONYMOUS LOGON" + ] + }, + "user": { + "domain": "NT AUTHORITY", + "id": "S-1-5-7", + "name": "ANONYMOUS LOGON" + }, + "winlog": { + "channel": "Security", + "computerObject": { + "domain": "TEST", + "id": "S-1-5-21-1717121054-434620538-60925301-11556", + "name": "TEST4642$" + }, + "computer_name": "DC_TEST2k12.TEST.", + "event_data": { + "AccountExpires": "-", + "AllowedToDelegateTo": "-", + "ComputerAccountChange": "-", + "DisplayName": "-", + "DnsHostName": "-", + "HomeDirectory": "-", + "HomePath": "-", + "LogonHours": "-", + "NewUacValue": "-", + "OldUacValue": "-", + "PasswordLastSet": "01/08/2022 10:56:47", + "PrimaryGroupId": "-", + "PrivilegeList": [ + "-" + ], + "ProfilePath": "-", + "SamAccountName": "-", + "ScriptPath": "-", + "ServicePrincipalNames": "-", + "SidHistory": "-", + "SubjectDomainName": "NT AUTHORITY", + "SubjectLogonId": "0x3e6", + "SubjectUserName": "ANONYMOUS LOGON", + "SubjectUserSid": "S-1-5-7", + "TargetDomainName": "TEST", + "TargetSid": "S-1-5-21-1717121054-434620538-60925301-11556", + "TargetUserName": "TEST4642$", + "UserAccountControl": "-", + "UserParameters": "-", + "UserPrincipalName": "-", + "UserWorkstations": "-" + }, + "event_id": "4742", + "keywords": [ + "Audit Success" + ], + "level": "information", + "logon": { + "id": "0x3e6" + }, + "opcode": "Info", + "outcome": "success", + "process": { + "pid": 604, + "thread": { + "id": 864 + } + }, + "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": "18232202", + "task": "Computer Account Management", + "time_created": "2022-08-01T08:56:47.9740262Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/manifest.yml b/packages/system/manifest.yml index 069e360e074..a3f0acb698a 100644 --- a/packages/system/manifest.yml +++ b/packages/system/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: system title: System -version: 1.19.2 +version: 1.19.3 license: basic description: Collect system logs and metrics from your servers with Elastic Agent. type: integration