[ML] Adds new SIEM auditbeat, winlogbeat and packetbeat modules by peteharverson · Pull Request #47848 · elastic/kibana

peteharverson · 2019-10-10T15:39:09Z

Summary

Adds files for three new SIEM data recognizer modules for auditbeat, winlogbeat and packetbeat data:

SIEM Auditbeat Authentication (detecting suspicious authentication events in Auditbeat data)
SIEM Winlogbeat Authentication (detecting suspicious authentication events in Winlogbeat data)
SIEM Packetbeat (detecting suspicious network activity in Packetbeat data)

Also includes some edits to the descriptions and filters from the existing Auditbeat and Winlogbeat modules, removing the ecs suffix from the module IDs and folders.

Contains:

Module manifest.json
Module logo.json
ML Job configurations
ML Datafeed configurations

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This includes a feature addition or change that requires a release note and was labeled appropriately

elasticmachine · 2019-10-10T15:39:12Z

Pinging @elastic/ml-ui (:ml)

elasticmachine · 2019-10-10T16:51:02Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 3cfc1c5

blaklaybul

Looks good. However let's pull windows_rare_country_for_user and linux_rare_country_for_user for now. This detector has only been tested on okta data, not yet on auditbeat or winlogbeat. @cwurm began ingesting country info on our siem development cluster, but these jobs have yet to produce results there.

elasticmachine · 2019-10-11T11:34:49Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 7e52f5e

jgowdyelastic

LGTM

…tic#47848) * [ML] Adds new SIEM auditbeat, winlogbeat and packetbeat modules * [ML] Removed rare_country_for_user jobs * [ML] Removed rare_country_for_user jobs from manifests

…) (#47945) * [ML] Adds new SIEM auditbeat, winlogbeat and packetbeat modules * [ML] Removed rare_country_for_user jobs * [ML] Removed rare_country_for_user jobs from manifests

This change augments the SIEM jobs and datafeeds that were added in #47848 with the allow_lazy_open and max_empty_searches options that were added in elastic/elasticsearch#47726 and elastic/elasticsearch#47922 respectively.

@benskelker

## Summary This PR updates the list of ML Modules that the SIEM App should display jobs from within the Anomaly Detection UI. ML PR: #47848 Modules include: ``` 'siem_auditbeat', 'siem_auditbeat_auth', 'siem_packetbeat', 'siem_winlogbeat', 'siem_winlogbeat_auth', ``` Anomaly Detection UI now shows `23` jobs in total: ![image](https://user-images.githubusercontent.com/2946766/66853948-a31ad900-ef3d-11e9-8be9-dc7224a0f975.png) Summarize your PR. If it involves visual changes include a screenshot or gif. ### Checklist Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR. - [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~ - [ ] ~Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~ - [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials * will work with @benskelker on latest ML doc updates - [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~ - [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~ ### For maintainers - [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~ - [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~

@benskelker

## Summary This PR updates the list of ML Modules that the SIEM App should display jobs from within the Anomaly Detection UI. ML PR: elastic#47848 Modules include: ``` 'siem_auditbeat', 'siem_auditbeat_auth', 'siem_packetbeat', 'siem_winlogbeat', 'siem_winlogbeat_auth', ``` Anomaly Detection UI now shows `23` jobs in total: ![image](https://user-images.githubusercontent.com/2946766/66853948-a31ad900-ef3d-11e9-8be9-dc7224a0f975.png) Summarize your PR. If it involves visual changes include a screenshot or gif. ### Checklist Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR. - [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~ - [ ] ~Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~ - [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials * will work with @benskelker on latest ML doc updates - [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~ - [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~ ### For maintainers - [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~ - [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~

@benskelker

## Summary This PR updates the list of ML Modules that the SIEM App should display jobs from within the Anomaly Detection UI. ML PR: #47848 Modules include: ``` 'siem_auditbeat', 'siem_auditbeat_auth', 'siem_packetbeat', 'siem_winlogbeat', 'siem_winlogbeat_auth', ``` Anomaly Detection UI now shows `23` jobs in total: ![image](https://user-images.githubusercontent.com/2946766/66853948-a31ad900-ef3d-11e9-8be9-dc7224a0f975.png) Summarize your PR. If it involves visual changes include a screenshot or gif. ### Checklist Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR. - [ ] ~This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~ - [ ] ~Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~ - [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials * will work with @benskelker on latest ML doc updates - [ ] ~[Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios~ - [ ] ~This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~ ### For maintainers - [ ] ~This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~ - [ ] ~This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~

…#48372) This change augments the SIEM jobs and datafeeds that were added in #47848 with the allow_lazy_open and max_empty_searches options that were added in elastic/elasticsearch#47726 and elastic/elasticsearch#47922 respectively.

elasticmachine · 2019-10-21T10:34:10Z

Pinging @elastic/siem (Team:SIEM)

[ML] Adds new SIEM auditbeat, winlogbeat and packetbeat modules

3cfc1c5

peteharverson added release_note:enhancement :ml Feature:Anomaly Detection ML anomaly detection v8.0.0 v7.5.0 labels Oct 10, 2019

peteharverson requested review from blaklaybul, jgowdyelastic and walterra October 10, 2019 15:39

peteharverson requested a review from a team as a code owner October 10, 2019 15:39

peteharverson self-assigned this Oct 10, 2019

blaklaybul suggested changes Oct 10, 2019

View reviewed changes

peteharverson added 2 commits October 11, 2019 11:16

[ML] Removed rare_country_for_user jobs

4c11657

[ML] Removed rare_country_for_user jobs from manifests

7e52f5e

jgowdyelastic approved these changes Oct 11, 2019

View reviewed changes

peteharverson merged commit cd735fd into elastic:master Oct 11, 2019

peteharverson mentioned this pull request Oct 11, 2019

[7.x] [ML] Adds new SIEM auditbeat, winlogbeat and packetbeat modules (#47848) #47945

Merged

droberts195 mentioned this pull request Oct 15, 2019

[ML] Add allow_lazy_open and max_empty_searches to SIEM jobs #48238

Merged

spong mentioned this pull request Oct 15, 2019

[SIEM] [ML] Updates ML Modules bundled with SIEM App #48256

Merged

7 tasks

cwurm added the Team:SIEM label Oct 21, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ML] Adds new SIEM auditbeat, winlogbeat and packetbeat modules#47848

[ML] Adds new SIEM auditbeat, winlogbeat and packetbeat modules#47848
peteharverson merged 3 commits intoelastic:masterfrom
peteharverson:ml-siem-auth-packetbeat-modules

peteharverson commented Oct 10, 2019 •

edited

Loading

Uh oh!

elasticmachine commented Oct 10, 2019

Uh oh!

elasticmachine commented Oct 10, 2019

Uh oh!

blaklaybul left a comment •

edited

Loading

Uh oh!

elasticmachine commented Oct 11, 2019

Uh oh!

jgowdyelastic left a comment

Uh oh!

elasticmachine commented Oct 21, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

peteharverson commented Oct 10, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

For maintainers

Uh oh!

elasticmachine commented Oct 10, 2019

Uh oh!

elasticmachine commented Oct 10, 2019

💚 Build Succeeded

Uh oh!

blaklaybul left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Oct 11, 2019

💚 Build Succeeded

Uh oh!

jgowdyelastic left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Oct 21, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

peteharverson commented Oct 10, 2019 •

edited

Loading

blaklaybul left a comment •

edited

Loading