Skip to content

in_winevtlog: Retrieve actual user account's domain and name [Backport to 3.0]#8995

Merged
edsiper merged 1 commit into3.0from
3.0-cosmo0920-retrieve-actual-account-data-via-sid
Jun 24, 2024
Merged

in_winevtlog: Retrieve actual user account's domain and name [Backport to 3.0]#8995
edsiper merged 1 commit into3.0from
3.0-cosmo0920-retrieve-actual-account-data-via-sid

Conversation

@cosmo0920
Copy link
Contributor

This is backporting PR which is corresponding to #8992.


Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

  • Example configuration file for the change
  • Debug log output from testing the change
  • Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

  • Run local packaging test showing all targets (including any new ones) build.
  • Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

  • Documentation required for this feature

Backporting

  • Backport to latest stable release.

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Only extracting the SID when is used for normal data cases.
For string inserts, we needn't replace with the actual data because
replacing with actual user account's domain and its name causes
breaking the relationship of corresponding string interpolated message
and the element of string inserts.

Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants