[System.Security] For Windows, store the split access list and mask values #9907
+49
−10
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…lues as a list of values instead of a multi-line string value.
a03nikki
changed the title
🚀 Benchmarks reportTo see the full report comment with |
|
I'm finding out if AccessList should be fixed too per the user that I was talking with. |
I confirmed they would like the AccessList to be brought back into alignment as well. Change has been pushed to this pull request now. |
a03nikki
changed the title
|
💚 Build Succeeded
History
cc @a03nikki |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Added logic to store the individual
winlog.event_data.AccessListandwinlog.event_data.AccessMaskvalues as a list of values instead of a multi-line string value.This brings the format in alignment with the previous Winlogbeat v7 format of these values.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
elastic-package testRelated issues
Screenshots
This was found while comparing Winlogbeat 7.10.1 output to Elastic Agent v8.12.1 with System integration version approximate 1.48.1.
Winlogbeat v7.10.1 for event code
4674documents had thisBut Elastic Agent v8.12.1, had this
After this Elasticsearch ingest pipeline change, the Elastic Agent should return to be the list of values again like Winlogbeat.