Merge branch 'main' into main

elastic · Sep 5, 2023 · 677b31b · 677b31b
2 parents 9e29abc + 3b02b8a
commit 677b31b
Show file tree

Hide file tree

Showing 6 changed files with 31 additions and 7 deletions.
diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
@@ -3,6 +3,24 @@
 :issue: https://github.com/elastic/beats/issues/
 :pull: https://github.com/elastic/beats/pull/
 
+[[release-notes-8.9.2]]
+=== Beats version 8.9.2
+https://github.com/elastic/beats/compare/v8.9.1\...v8.9.2[View commits]
+
+==== Bugfixes
+
+*Filebeat*
+
+- Fix panic when redact option is not provided to CEL input. {issue}36387[36387] {pull}36388[36388]
+- Update mito CEL extension library to v1.5.0. {pull}36146[36146]
+
+==== Added
+
+*Metricbeat*
+
+- Add Azure resource tags support to Azure Billing module {pull}36428[36428]
+
+
 [[release-notes-8.9.1]]
 === Beats version 8.9.1
 https://github.com/elastic/beats/compare/v8.9.0\...v8.9.1[View commits]

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -102,6 +102,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix Filebeat Cisco module with missing escape character {issue}36325[36325] {pull}36326[36326]
 - Fix panic when redact option is not provided to CEL input. {issue}36387[36387] {pull}36388[36388]
 - Remove 'onFilteredOut' and 'onDroppedOnPublish' callback logs {issue}36299[36299] {pull}36399[36399]
+- Added a fix for Crowdstrike pipeline handling process arrays {pull}36496[36496]
 
 *Heartbeat*
 
@@ -303,3 +304,6 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 
 
 
+
+
+
diff --git a/libbeat/docs/release.asciidoc b/libbeat/docs/release.asciidoc
@@ -8,6 +8,7 @@ This section summarizes the changes in each release. Also read
 <<breaking-changes>> for more detail about changes that affect
 upgrade.
 
+* <<release-notes-8.9.2>>
 * <<release-notes-8.9.1>>
 * <<release-notes-8.9.0>>
 * <<release-notes-8.8.2>>

diff --git a/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml b/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml
@@ -281,7 +281,7 @@ processors:
           commandLine = commandLine.trim();
 
           if (commandLine != "") {
-            def args = Arrays.asList(/ /.split(commandLine));
+            def args = new ArrayList(Arrays.asList(/ /.split(commandLine)));
             args.removeIf(arg -> arg == "");
 
             ctx['process'] = new HashMap();

diff --git a/x-pack/filebeat/module/crowdstrike/falcon/test/falcon-events.log b/x-pack/filebeat/module/crowdstrike/falcon/test/falcon-events.log
@@ -19,7 +19,7 @@
         "SeverityName": "High",
         "FileName": "explorer.exe",
         "FilePath": "\\Device\\HarddiskVolume1\\Windows",
-        "CommandLine": "C:\\Windows\\Explorer.EXE",
+        "CommandLine": "C:\\Windows\\Explorer.EXE  --test",
         "SHA256String": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a",
         "MD5String": "ac4c51eb24aa95b77f705ab159189e24",
         "MachineDomain": "CORP-DOMAIN",

diff --git a/x-pack/filebeat/module/crowdstrike/falcon/test/falcon-events.log-expected.json b/x-pack/filebeat/module/crowdstrike/falcon/test/falcon-events.log-expected.json
@@ -1,6 +1,6 @@
 [
     {
-        "crowdstrike.event.CommandLine": "C:\\Windows\\Explorer.EXE",
+        "crowdstrike.event.CommandLine": "C:\\Windows\\Explorer.EXE  --test",
         "crowdstrike.event.ComputerName": "alice-laptop",
         "crowdstrike.event.DetectDescription": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.",
         "crowdstrike.event.DetectId": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584",
@@ -67,9 +67,10 @@
         "log.offset": 0,
         "message": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.",
         "process.args": [
-            "C:\\Windows\\Explorer.EXE"
+            "C:\\Windows\\Explorer.EXE",
+            "--test"
         ],
-        "process.command_line": "C:\\Windows\\Explorer.EXE",
+        "process.command_line": "C:\\Windows\\Explorer.EXE  --test",
         "process.executable": "C:\\Windows\\Explorer.EXE",
         "process.name": "explorer.exe",
         "process.pid": 38684386611,
@@ -126,7 +127,7 @@
         "log.flags": [
             "multiline"
         ],
-        "log.offset": 2063,
+        "log.offset": 2071,
         "message": "Incident score 1.2",
         "service.type": "crowdstrike",
         "tags": [
@@ -169,7 +170,7 @@
         "log.flags": [
             "multiline"
         ],
-        "log.offset": 2579,
+        "log.offset": 2587,
         "message": "quarantined_file_update",
         "related.user": [
             "Crowdstrike"