Skip to content

Commit 8711ef8

Browse files
bjmcnicbjmcnic
authored
Fix powershell error on events 40961 and 40962 (#10792)
Fix pipeline_error for powershell_operational events 40961 and 40962.
1 parent 7b14f75 commit 8711ef8

File tree

12 files changed

+214
-1
lines changed

12 files changed

+214
-1
lines changed

‎packages/windows/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.0.2"
3+
changes:
4+
- description: Fix powershell error on events 40961 and 40962 (at minimum)
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/10792
27
- version: "2.0.1"
38
changes:
49
- description: Fix IPv6 cleanup step.

‎packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,51 @@
216216
},
217217
"version": 1
218218
}
219+
},
220+
{
221+
"@timestamp": "2024-09-09T16:53:34.055Z",
222+
"event": {
223+
"action": "PowerShell Console Startup",
224+
"code": "40961",
225+
"created": "2024-09-09T17:08:14.566Z",
226+
"kind": "event",
227+
"provider": "Microsoft-Windows-PowerShell"
228+
},
229+
"host": {
230+
"name": "vagrant"
231+
},
232+
"log": {
233+
"level": "information"
234+
},
235+
"message": "PowerShell console is starting up",
236+
"tags": [
237+
"forwarded"
238+
],
239+
"winlog": {
240+
"activity_id": "{9b36ffb2-ffc3-0007-7f34-379bc3ffda01}",
241+
"api": "wineventlog",
242+
"channel": "Microsoft-Windows-PowerShell/Operational",
243+
"computer_name": "DESKTOP-H1QFQE0.bensdomain.com",
244+
"event_id": "40961",
245+
"opcode": "Start",
246+
"process": {
247+
"pid": 8824,
248+
"thread": {
249+
"id": 1472
250+
}
251+
},
252+
"provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}",
253+
"provider_name": "Microsoft-Windows-PowerShell",
254+
"record_id": 206,
255+
"task": "PowerShell Console Startup",
256+
"user": {
257+
"domain": "NT AUTHORITY",
258+
"identifier": "S-1-5-18",
259+
"name": "SYSTEM",
260+
"type": "Well Known Group"
261+
},
262+
"version": 1
263+
}
219264
}
220265
]
221266
}

‎packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json-expected.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,67 @@
421421
},
422422
"version": 1
423423
}
424+
},
425+
{
426+
"@timestamp": "2024-09-09T16:53:34.055Z",
427+
"ecs": {
428+
"version": "8.0.0"
429+
},
430+
"event": {
431+
"action": "PowerShell Console Startup",
432+
"category": [
433+
"process"
434+
],
435+
"code": "40961",
436+
"created": "2024-09-09T17:08:14.566Z",
437+
"kind": "event",
438+
"provider": "Microsoft-Windows-PowerShell",
439+
"type": [
440+
"info"
441+
]
442+
},
443+
"host": {
444+
"name": "vagrant",
445+
"os": {
446+
"family": "windows",
447+
"type": "windows"
448+
}
449+
},
450+
"log": {
451+
"level": "information"
452+
},
453+
"message": "PowerShell console is starting up",
454+
"tags": [
455+
"forwarded"
456+
],
457+
"user": {
458+
"id": "S-1-5-18"
459+
},
460+
"winlog": {
461+
"activity_id": "{9b36ffb2-ffc3-0007-7f34-379bc3ffda01}",
462+
"api": "wineventlog",
463+
"channel": "Microsoft-Windows-PowerShell/Operational",
464+
"computer_name": "DESKTOP-H1QFQE0.bensdomain.com",
465+
"event_id": "40961",
466+
"opcode": "Start",
467+
"process": {
468+
"pid": 8824,
469+
"thread": {
470+
"id": 1472
471+
}
472+
},
473+
"provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}",
474+
"provider_name": "Microsoft-Windows-PowerShell",
475+
"record_id": "206",
476+
"task": "PowerShell Console Startup",
477+
"user": {
478+
"domain": "NT AUTHORITY",
479+
"identifier": "S-1-5-18",
480+
"name": "SYSTEM",
481+
"type": "Well Known Group"
482+
},
483+
"version": 1
484+
}
424485
}
425486
]
426487
}

‎packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -449,6 +449,7 @@ processors:
449449
description: Remove all empty values from event_data.
450450
lang: painless
451451
source: ctx?.winlog?.event_data?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals(""));
452+
if: ctx?.winlog?.event_data != null
452453
- remove:
453454
description: Remove empty event data.
454455
field: winlog.event_data

‎packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -532,6 +532,7 @@ processors:
532532
description: Remove all empty values from event_data.
533533
lang: painless
534534
source: ctx?.winlog?.event_data?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals(""));
535+
if: ctx?.winlog?.event_data != null
535536
- remove:
536537
description: Remove empty event data.
537538
field: winlog.event_data

‎packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/sysmon_operational.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1402,6 +1402,7 @@ processors:
14021402
description: Remove all empty values from event_data.
14031403
lang: painless
14041404
source: ctx?.winlog?.event_data?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals("") || entry.getValue().equals("-"));
1405+
if: ctx?.winlog?.event_data != null
14051406
- remove:
14061407
description: Remove empty event data.
14071408
field: winlog.event_data

‎packages/windows/data_stream/powershell/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -476,6 +476,7 @@ processors:
476476
description: Remove all empty values from event_data.
477477
lang: painless
478478
source: ctx?.winlog?.event_data?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals(""));
479+
if: ctx?.winlog?.event_data != null
479480
- remove:
480481
description: Remove empty event data.
481482
field: winlog.event_data

‎packages/windows/data_stream/powershell_operational/_dev/test/pipeline/test-events.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,48 @@
216216
},
217217
"version": 1
218218
}
219+
},
220+
{
221+
"@timestamp": "2024-09-03T15:27:45.847Z",
222+
"event": {
223+
"action": "PowerShell Console Startup",
224+
"code": "40961",
225+
"created": "2024-09-05T20:18:14.254Z",
226+
"kind": "event",
227+
"provider": "Microsoft-Windows-PowerShell"
228+
},
229+
"host": {
230+
"name": "vagrant"
231+
},
232+
"log": {
233+
"level": "information"
234+
},
235+
"message": "PowerShell console is starting up",
236+
"winlog": {
237+
"activity_id": "{3ee7a05a-f7fc-0006-f0d2-e73efcf7da01}",
238+
"api": "wineventlog",
239+
"channel": "Microsoft-Windows-PowerShell/Operational",
240+
"computer_name": "vagrant",
241+
"event_id": "40961",
242+
"opcode": "Start",
243+
"process": {
244+
"pid": 2364,
245+
"thread": {
246+
"id": 8092
247+
}
248+
},
249+
"provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}",
250+
"provider_name": "Microsoft-Windows-PowerShell",
251+
"record_id": 143,
252+
"task": "PowerShell Console Startup",
253+
"user": {
254+
"domain": "NT AUTHORITY",
255+
"identifier": "S-1-5-18",
256+
"name": "SYSTEM",
257+
"type": "Well Known Group"
258+
},
259+
"version": 1
219260
}
261+
}
220262
]
221263
}

‎packages/windows/data_stream/powershell_operational/_dev/test/pipeline/test-events.json-expected.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -402,6 +402,60 @@
402402
},
403403
"version": 1
404404
}
405+
},
406+
{
407+
"@timestamp": "2024-09-03T15:27:45.847Z",
408+
"ecs": {
409+
"version": "8.0.0"
410+
},
411+
"event": {
412+
"action": "PowerShell Console Startup",
413+
"category": [
414+
"process"
415+
],
416+
"code": "40961",
417+
"created": "2024-09-05T20:18:14.254Z",
418+
"kind": "event",
419+
"provider": "Microsoft-Windows-PowerShell",
420+
"type": [
421+
"info"
422+
]
423+
},
424+
"host": {
425+
"name": "vagrant"
426+
},
427+
"log": {
428+
"level": "information"
429+
},
430+
"message": "PowerShell console is starting up",
431+
"user": {
432+
"id": "S-1-5-18"
433+
},
434+
"winlog": {
435+
"activity_id": "{3ee7a05a-f7fc-0006-f0d2-e73efcf7da01}",
436+
"api": "wineventlog",
437+
"channel": "Microsoft-Windows-PowerShell/Operational",
438+
"computer_name": "vagrant",
439+
"event_id": "40961",
440+
"opcode": "Start",
441+
"process": {
442+
"pid": 2364,
443+
"thread": {
444+
"id": 8092
445+
}
446+
},
447+
"provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}",
448+
"provider_name": "Microsoft-Windows-PowerShell",
449+
"record_id": "143",
450+
"task": "PowerShell Console Startup",
451+
"user": {
452+
"domain": "NT AUTHORITY",
453+
"identifier": "S-1-5-18",
454+
"name": "SYSTEM",
455+
"type": "Well Known Group"
456+
},
457+
"version": 1
458+
}
405459
}
406460
]
407461
}

‎packages/windows/data_stream/powershell_operational/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,7 @@ processors:
537537
description: Remove all empty values from event_data.
538538
lang: painless
539539
source: ctx?.winlog?.event_data?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals(""));
540+
if: ctx?.winlog?.event_data != null
540541
- remove:
541542
description: Remove empty event data.
542543
field: winlog.event_data

0 commit comments

Comments
 (0)