Skip to content

[Filebeat] ETW input - Fix keywords fields representation in output events #43724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
chemamartinez opened this issue Apr 7, 2025 · 2 comments
Open

[Filebeat] ETW input - Fix keywords fields representation in output events #43724

chemamartinez opened this issue Apr 7, 2025 · 2 comments
Labels
Filebeat Filebeat Input:etw Related issues to the Event Tracing for Windows input Team:Security-Windows Platform Windows Platform Team in Security Solution

Comments

@chemamartinez
Copy link
Contributor

As has been reported in this thread, the keywords field in events delivered by the ETW input is represented as a large integer instead of an hexadecimal bit mask.

This field is represented as a ULONGLONG by the Microsoft API.

The ETW input maps this keywords field here ,converting the uint64 into a string, using base 10 instead of 16.
@chemamartinez chemamartinez added Filebeat Filebeat Input:etw Related issues to the Event Tracing for Windows input labels Apr 7, 2025
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Apr 7, 2025
@chemamartinez chemamartinez mentioned this issue Apr 7, 2025
Open
@chemamartinez chemamartinez added the Team:Security-Windows Platform Windows Platform Team in Security Solution label Apr 9, 2025
@elasticmachine
Copy link
Collaborator

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Apr 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Filebeat Filebeat Input:etw Related issues to the Event Tracing for Windows input Team:Security-Windows Platform Windows Platform Team in Security Solution
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@elasticmachine @chemamartinez