Skip to content

Update related to elastic integrations issue 14767 #47266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
+49 −0
Open

Update related to elastic integrations issue 14767 #47266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
9a8ab38
Update resolves issue #14767
veritasr3x Oct 22, 2025
4b1a494
Merge branch 'main' into main
veritasr3x Oct 22, 2025
d30d1ef
Merge branch 'main' into main
veritasr3x Oct 26, 2025
45bb192
Merge branch 'elastic:main' into main
veritasr3x Oct 27, 2025
f070486
Add 'process.args_count' to winlogbeat ingest pipeline
veritasr3x Oct 28, 2025
47e965d
Merge branch 'elastic:main' into main
veritasr3x Oct 30, 2025
0da2aef
Merge branch 'main' into main
veritasr3x Oct 30, 2025
3a04aff
Merge branch 'elastic:main' into main
veritasr3x Nov 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions changelog/fragments/1761610213-add-process-args-count.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
# REQUIRED
# Kind can be one of:
# - breaking-change: a change to previously-documented behavior
# - deprecation: functionality that is being removed in a later release
# - bug-fix: fixes a problem in a previous version
# - enhancement: extends functionality but does not break or fix existing behavior
# - feature: new functionality
# - known-issue: problems that we are aware of in a given version
# - security: impacts on the security of a product or a user’s deployment.
# - upgrade: important information for someone upgrading from a prior version
# - other: does not fit into any of the other categories
kind: enhancement

# REQUIRED for all kinds
# Change summary; a 80ish characters long description of the change.
summary: Adds 'process.args_count' to winlogbeat windows security ingest pipeline

# REQUIRED for breaking-change, deprecation, known-issue
# Long description; in case the summary is not enough to describe the change
# this field accommodate a description without length limits.
# description:

# REQUIRED for breaking-change, deprecation, known-issue
# impact:

# REQUIRED for breaking-change, deprecation, known-issue
# action:

# REQUIRED for all kinds
# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
component: winlogbeat

# AUTOMATED
# OPTIONAL to manually add other PR URLs
# PR URL: A link the PR that added the changeset.
# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
# Please provide it if you are adding a fragment for a different PR.
# pr: https://github.com/owner/repo/1234

# AUTOMATED
# OPTIONAL to manually add other issue URLs
# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
# If not present is automatically filled by the tooling with the issue linked to the PR number.
# issue: https://github.com/owner/repo/1234
4 changes: 4 additions & 0 deletions x-pack/winlogbeat/module/security/ingest/security_standard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3716,6 +3716,10 @@ processors:
ctx.process.put("args", al);
ctx.process.put("command_line", ctx.winlog.event_data.CommandLine);
}
def args = ctx?.process.args;
if (args != null && args != "") {
ctx.process.args_count = ctx.process.args.length;
}
Comment on lines +3719 to +3722
Copy link
Member

@andrewkroh andrewkroh Oct 28, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
def args = ctx?.process.args;
if (args != null && args != "") {
ctx.process.args_count = ctx.process.args.length;
}
if (ctx.process?.args instanceof List) { ctx.process.args_count = ctx.process.args.size(); }

This will ensure process.args is a non null List before trying to access the .size().

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure that's needed.

If I'm reading correctly, lines 3690 to 3711 above this area handle the null checking since populating process.args is directly derived from line 3690 where there's a validation of whether the CommandLine field is null.

If not null, it sets the CommandLine value into an array list and isolates each component into the array list via the variable args that then populates the process.args (lines 3712 to 3716).

The suggested code change does another null check on the args condition, as derived from the previous null check leveraged against the CommandLine field.

All that being said, I think the non-null checking is already present. I'm very new to diving this deep, so please correct me if I'm mistaken.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andrewkroh What do you think?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My suggestion is safe to use independent of the what happens before.

If you want to depend on the previous block's behavior then move the addition of the process.args_count into that block and directly reference the ArrayList's size().

         ctx.process.put("args", al);
+        ctx.process.put("args_count", al.size());
         ctx.process.put("command_line", ctx.winlog.event_data.CommandLine);

if ((ctx.winlog?.event_data?.TargetUserName != null) &&
(!ctx.winlog.event_data.TargetUserName.equals("-"))) {
if (ctx.related == null) {
Expand Down