Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update winlogbeat templates, add info for adding filters #261

Open
wants to merge 6 commits into
base: release-1.4.0
Choose a base branch
from

Conversation

llwaterhouse
Copy link
Contributor

@llwaterhouse llwaterhouse commented Apr 16, 2024

🗣 Description

  1. added winlogbeat 8.5.0 templates into Elastic pipeline
  2. added instructions on how to add filters to panels on dashboards

💭 Motivation and context

1.This change is required because earlier versions of Winlogbeat did the parsing and mapping of logs and this version no longer does that.
2. LME logs many activities that may not be interesting to the user so filtering gives them away to keep them out of the dashboards.

We now will be able to leverage Elastic Common Schema field names.

Closes #155
Closes #57

📷 Screenshots (DELETE IF UNAPPLICABLE)

🧪 Testing

The API tests were run and a change needed to be made to reflect the updated fields.

The dashboards need to be revisited to make sure they read the new fields.

✅ Pre-approval checklist

  • Changes are limited to a single goal AND
    the title reflects this in a clear human readable format
  • Issue that this PR solves has been selected in the Development section
  • I have read and agree to LME's CONTRIBUTING.md document.
  • The PR adheres to LME's requirements in RELEASES.md
  • These code changes follow cisagov code standards.
  • All relevant repo and/or project documentation has been updated to reflect the changes in this PR.

✅ Pre-merge Checklist

  • All tests pass
  • PR has been tested and the documentation for testing is above
  • Squash and merge all commits into one PR level commit

✅ Post-merge Checklist

  • Delete the branch to keep down number of branches

@llwaterhouse llwaterhouse added the bug This issue or pull request addresses broken functionality label Apr 16, 2024
@llwaterhouse llwaterhouse added this to the Elm-1.4.0 milestone Apr 16, 2024
@llwaterhouse llwaterhouse self-assigned this Apr 16, 2024
@cbaxley
Copy link
Collaborator

cbaxley commented Apr 17, 2024

We will want to update our installers to install these versions before releasing this. The pipeline should fail tests before we start the modification, and pass tests when we finish.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue or pull request addresses broken functionality
Projects
Status: 🆕 Product Backlog
Development

Successfully merging this pull request may close these issues.

None yet

2 participants