-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[winlogbeat] Default to raw api #42275
Merged
+4,516
−3,777
Merged
Changes from 23 commits
Commits
Show all changes
25 commits
Select commit
Hold shift + click to select a range
396fc7d
Default to raw api
marc-gr 585ff5d
Merge remote-tracking branch 'upstream/main' into winlogbeat-default-api
marc-gr 97ed84f
Install sysmon event manifests
marc-gr 724e32b
Merge remote-tracking branch 'upstream/main' into winlogbeat-default-api
marc-gr d10097e
Re-generate golden files
marc-gr 37302c6
Remove unused renderer option
marc-gr 74858cb
Fix tests
marc-gr d829c9a
Fix tests
marc-gr 8a66d4e
Remove field from docs
marc-gr 24fca7a
Fix doc default value
marc-gr e6cc25b
Make script compatible with older ps
marc-gr 5cfdc9b
Print error
marc-gr 3fd5e3f
Fix web request
marc-gr 61cb7a0
Clean tests and Fallback to use latest available metadata if non found
marc-gr bb6b1fb
Fix security pipeline for new rendered events
marc-gr 18c4d33
Regenerate ingest golden files
marc-gr 04a8a25
:Merge remote-tracking branch 'upstream/main' into winlogbeat-default…
marc-gr 15fae95
Fix test for win2016
marc-gr c4b452e
Merge branch 'main' into winlogbeat-default-api
marc-gr 62ca5fd
fix github action
marc-gr 6dd9cf9
Update winlogbeat/sys/wineventlog/metadata_store_test.go
marc-gr f2cab51
simplify sysmon script
marc-gr 56d88e9
Add retries and simplify call
marc-gr 27de210
Remove unused function
marc-gr 70e7a42
Merge remote-tracking branch 'upstream/main' into winlogbeat-default-api
marc-gr File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| $downloadUrl = "https://live.sysinternals.com/Sysmon64.exe" | ||
| $tempFolder = "$env:TEMP\SysmonDownload" | ||
| $sysmonPath = "$tempFolder\Sysmon64.exe" | ||
|
|
||
| function Retry() | ||
| { | ||
| param( | ||
| [Parameter(Mandatory=$true)][Action]$action, | ||
| [Parameter(Mandatory=$false)][int]$maxAttempts = 3 | ||
| ) | ||
|
|
||
| $attempts=1 | ||
| $ErrorActionPreferenceToRestore = $ErrorActionPreference | ||
| $ErrorActionPreference = "Stop" | ||
|
|
||
| do | ||
| { | ||
| try | ||
| { | ||
| $action.Invoke(); | ||
| break; | ||
| } | ||
| catch [Exception] | ||
| { | ||
| Write-Host $_.Exception.Message | ||
| } | ||
|
|
||
| # exponential backoff delay | ||
| $attempts++ | ||
| if ($attempts -le $maxAttempts) { | ||
| Write-Host("Action failed. Waiting " + $retryDelaySeconds + " seconds before attempt " + $attempts + " of " + $maxAttempts + ".") | ||
| Start-Sleep 5 | ||
| } | ||
| else { | ||
| $ErrorActionPreference = $ErrorActionPreferenceToRestore | ||
| Write-Error $_.Exception.Message | ||
| } | ||
| } while ($attempts -le $maxAttempts) | ||
| $ErrorActionPreference = $ErrorActionPreferenceToRestore | ||
| } | ||
|
|
||
| if (!(Test-Path $tempFolder)) { | ||
| New-Item -ItemType Directory -Path $tempFolder | ||
| } | ||
|
|
||
| $ProgressPreference = 'SilentlyContinue' | ||
| function ParseErrorForResponseBody($Error) { | ||
| if ($PSVersionTable.PSVersion.Major -lt 6) { | ||
| if ($Error.Exception.Response) { | ||
| $Reader = New-Object System.IO.StreamReader($Error.Exception.Response.GetResponseStream()) | ||
| $Reader.BaseStream.Position = 0 | ||
| $Reader.DiscardBufferedData() | ||
| $ResponseBody = $Reader.ReadToEnd() | ||
| if ($ResponseBody.StartsWith('{')) { | ||
| $ResponseBody = $ResponseBody | ConvertFrom-Json | ||
| } | ||
| return $ResponseBody | ||
| } | ||
| } | ||
| else { | ||
| return $Error.ErrorDetails.Message | ||
| } | ||
| } | ||
|
|
||
| $attempts=1 | ||
| do | ||
| { | ||
| $attempts++ | ||
| try { | ||
| [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 | ||
| $result = Invoke-WebRequest -Uri $downloadUrl -OutFile $sysmonPath -UseBasicParsing | ||
| break | ||
| } | ||
| catch { | ||
| $resp = ParseErrorForResponseBody($_) | ||
| Write-Host "$resp" | ||
| if ($attempts -gt 5) { | ||
| exit 1 | ||
| } | ||
| } | ||
| } while ($attempts -le 5) | ||
|
|
||
| Write-Host "Sysmon64.exe downloaded successfully." | ||
|
|
||
| if ($sysmonPath) { | ||
| Start-Process -FilePath $sysmonPath -ArgumentList "-m" -Wait | ||
|
|
||
| Write-Host "Sysmon event manifest installation completed." | ||
| } else { | ||
| Write-Host "Sysmon executable not found in the downloaded archive." | ||
| } | ||
|
|
||
| Remove-Item -Path $tempFolder -Force -Recurse |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[Question]
Why is this not needed any more?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We previously had
wineventlogandwineventlog-experimentalapi's. The experimental API has been recently GA'd aswineventlog-rawin 8.18. For 9.0.0 we want to remove the oldwineventlogapi as it is less performant and the old way of rendering the events can be still achieved through config while using the newwineventlog-rawapi.So we will have a single api moving forward, that is why we can remove the winlog.api field references.
note that this changes are not going to be backported