Skip to content

SysmonForLinux | New integration to support Sysmon logs for Linux#4531

Merged
kcreddy merged 10 commits into
elastic:mainfrom
kcreddy:sysmon_linux
Dec 8, 2022
Merged

SysmonForLinux | New integration to support Sysmon logs for Linux#4531
kcreddy merged 10 commits into
elastic:mainfrom
kcreddy:sysmon_linux

Conversation

@kcreddy

@kcreddy kcreddy commented Nov 2, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

This new integration adds support for syslog from Sysmon events in Linux environments

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Related issues

@kcreddy kcreddy added the enhancement New feature or request label Nov 2, 2022
@elasticmachine

elasticmachine commented Nov 2, 2022 •
edited
Loading

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-12-08T10:53:55.940+0000

  • Duration: 14 min 22 sec

Test stats 🧪

Test Results
Failed 0
Passed 6
Skipped 0
Total 6

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine

elasticmachine commented Nov 14, 2022

Copy link
Copy Markdown

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine

elasticmachine commented Nov 14, 2022 •
edited
Loading

Copy link
Copy Markdown

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 100.0% (1/1) 💚 2.927
Classes 100.0% (1/1) 💚 2.927
Methods 86.667% (13/15) 👎 -0.913
Lines 54.137% (530/979) 👎 -38.417
Conditionals 100.0% (0/0) 💚

@kcreddy kcreddy marked this pull request as ready for review November 14, 2022 14:43
@elasticmachine

elasticmachine commented Nov 14, 2022

Copy link
Copy Markdown

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

andrewkroh
andrewkroh reviewed Nov 14, 2022
View reviewed changes

@andrewkroh andrewkroh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just leaving some high level comments. I did not review the ingest node pipeline.

Comment thread packages/sysmon/_dev/build/docs/README.md Outdated
Comment thread packages/sysmon/_dev/build/docs/README.md Outdated
Comment thread packages/sysmon/_dev/deploy/docker/docker-compose.yml
Comment thread packages/sysmon/data_stream/log/_dev/test/pipeline/test-common-config.yml Outdated
Comment thread packages/sysmon/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated
Comment thread packages/sysmon/data_stream/log/_dev/test/pipeline/test-sysmon.json-expected.json Outdated
@andrewkroh andrewkroh added the Integration:sysmon_linux Sysmon for Linux label Nov 14, 2022
P1llus
P1llus reviewed Nov 15, 2022
View reviewed changes

@P1llus P1llus left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Outside of some small things it seems good. Lets resolve Andrews comments first.

Comment thread packages/sysmon/manifest.yml
@kcreddy kcreddy self-assigned this Nov 16, 2022
@kcreddy kcreddy changed the title Sysmon | New integration to support Sysmon logs for Linux SysmonForLinux | New integration to support Sysmon logs for Linux Nov 16, 2022
@kcreddy kcreddy mentioned this pull request Dec 8, 2022
Closed
@kcreddy kcreddy merged commit 5c6167b into elastic:main Dec 8, 2022
@elasticmachine

elasticmachine commented Dec 8, 2022

Copy link
Copy Markdown

Package sysmon_linux - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=sysmon_linux

@jamesspi

jamesspi commented Dec 8, 2022

Copy link
Copy Markdown

Great to see this come to life 🙌

@andrewkroh andrewkroh added the New Integration Issue or pull request for creating a new integration package. label Aug 13, 2024
@kcreddy kcreddy deleted the sysmon_linux branch February 7, 2025 08:37
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@kcreddy
SysmonForLinux | New integration to support Sysmon logs for Linux (el…
05e03bd 
…astic#4531)

* initial sysmon commit

* remove grok processor; add dissect module

* tests

* run tests

* add simpler logic in filestream

* add code owners for sysmon

* sysmon_linux instead of sysmon and PR review

* update name in codeowners

* add dockercompo

* Drop if not sysmon process
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@P1llus P1llus P1llus left review comments
@andrewkroh andrewkroh andrewkroh approved these changes

Assignees

@kcreddy kcreddy

Labels

enhancement New feature or request Integration:sysmon_linux Sysmon for Linux New Integration Issue or pull request for creating a new integration package.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Sysmon for Linux

5 participants

@kcreddy @elasticmachine @jamesspi @andrewkroh @P1llus