Winlogbeat security module - sometimes related.user field missing

[leweafan]

Describe the enhancement:

Add related.user for event codes 4627, 4800, 4797, 4742, 4801, 4793, 4696, 4738.

According to field description:

All the user names or other user identifiers seen on the event

The problem not only with this one module. Seems like there is no autotest to check related.user in case user.name field exists. Created feature request to add the autotest for this case.

Describe a specific use case for the enhancement or feature:

Event codes 4627, 4800, 4797, 4742, 4801, 4793, 4696, 4738 has user.name field and related.user field missing it affects security issues discovery. All other event codes have user.name and related.user fields.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

This issue doesn't have a Team:<team> label.

[efd6]

@leweafan Can you provide scrubbed XML examples of these event types?

[efd6]

Thanks, if you could provide XML samples that would be preferable. If not can you confirm that user in all cases of the event types you are concerned about is the TargetUserName or SubjectUserName?

[leweafan]

I can confirm that user in most cases is TargetUserName and in some cases SubjectUserName.
Sorry did know how I'm supposed to get xml format?

[efd6]

You can export the XML from the Windows event viewer.

Without knowing which of Target... or Subject... it's difficult to know which to put in user.name. related.user.name is fine since we just get it if it exists.

[leweafan]

I don't have access to windows hosts. I know that all event codes described on microsoft site and xml too.
Please check event id 4627 here

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)