From 4e6f3178f99d45356d227cb3a081af2d78388348 Mon Sep 17 00:00:00 2001 From: kirtisodhi Date: Thu, 23 Jul 2026 10:58:17 -0400 Subject: [PATCH 1/4] Update influencer fields for DED, LMD, DGA and ProblemChild jobs --- packages/ded/changelog.yml | 5 + .../pivot_transform_ea/fields/fields.yml | 8 +- .../pivot_transform_ea/transform.yml | 26 +++-- packages/ded/kibana/ml_module/ded-ml.json | 35 ++++-- packages/ded/manifest.yml | 2 +- packages/dga/changelog.yml | 5 + packages/dga/kibana/ml_module/dga-ml.json | 18 ++- packages/dga/manifest.yml | 2 +- packages/lmd/changelog.yml | 5 + .../pivot_transform_ea/transform.yml | 5 +- packages/lmd/kibana/ml_module/lmd-ml.json | 32 ++++-- packages/lmd/manifest.yml | 2 +- packages/problemchild/changelog.yml | 5 + .../kibana/ml_module/problemchild-ml.json | 108 ++++++++++++++++-- packages/problemchild/manifest.yml | 2 +- 15 files changed, 214 insertions(+), 46 deletions(-) diff --git a/packages/ded/changelog.yml b/packages/ded/changelog.yml index a6f81681c7a..f9426d0aa2f 100644 --- a/packages/ded/changelog.yml +++ b/packages/ded/changelog.yml @@ -1,3 +1,8 @@ +- version: "3.4.0" + changes: + - description: Add file and process influencers to ML jobs and extend the network transform group_by with process and network fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/123 - version: "3.3.0" changes: - description: Update transform source index to scope to the relevant data streams. diff --git a/packages/ded/elasticsearch/transform/pivot_transform_ea/fields/fields.yml b/packages/ded/elasticsearch/transform/pivot_transform_ea/fields/fields.yml index 6b6dce4f146..596abe07394 100644 --- a/packages/ded/elasticsearch/transform/pivot_transform_ea/fields/fields.yml +++ b/packages/ded/elasticsearch/transform/pivot_transform_ea/fields/fields.yml @@ -4,8 +4,6 @@ name: host.id - external: ecs name: user.name -- external: ecs - name: user.id - external: ecs name: event.module - external: ecs @@ -22,6 +20,12 @@ name: source.ip - external: ecs name: process.name +- external: ecs + name: network.transport +- external: ecs + name: process.executable +- external: ecs + name: process.parent.name - external: ecs name: process.code_signature.subject_name - external: ecs diff --git a/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml b/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml index ed4542d44a0..e9557b03a2d 100644 --- a/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml +++ b/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml @@ -1,12 +1,12 @@ dest: - index: ml_network_ded_ea-3.3.0 + index: ml_network_ded_ea-3.4.0 aliases: - alias: ml_network_ded_ea.latest move_on_creation: true - alias: ml_network_ded_ea.all move_on_creation: false - pipeline: 3.3.0-ml_ded_ingest_pipeline + pipeline: 3.4.0-ml_ded_ingest_pipeline description: This transform runs every 30 minutes and collects network logs to detect data exfiltration in your environment for the past month up to the runtime. frequency: 30m pivot: @@ -26,10 +26,9 @@ pivot: field: host.id 'user.name': terms: - field: user.name - user.id: - terms: - field: user.id + script: + source: "return doc.containsKey('user.name') && !doc['user.name'].isEmpty() ? doc['user.name'].value : ''" + lang: painless event.module: terms: field: event.module @@ -66,6 +65,17 @@ pivot: 'process.name': terms: field: process.name + 'network.transport': + terms: + field: network.transport + 'process.executable': + terms: + field: process.executable + 'process.parent.name': + terms: + script: + source: "return doc.containsKey('process.parent.name') && !doc['process.parent.name'].isEmpty() ? doc['process.parent.name'].value : ''" + lang: painless 'process.code_signature.subject_name': terms: script: @@ -77,7 +87,7 @@ pivot: source: "return doc.containsKey('process.code_signature.trusted') && !doc['process.code_signature.trusted'].isEmpty() ? doc['process.code_signature.trusted'].value.toString() : ''" lang: painless source: - index: "logs-endpoint.events.network-*,logs-network_traffic.*" + index: "logs-endpoint.events.network-*,logs-network_traffic*" query: bool: filter: @@ -113,5 +123,5 @@ sync: delay: 120s field: "@timestamp" _meta: - fleet_transform_version: 3.3.0 + fleet_transform_version: 3.4.0 run_as_kibana_system: false diff --git a/packages/ded/kibana/ml_module/ded-ml.json b/packages/ded/kibana/ml_module/ded-ml.json index 8ccdf2bcf96..c8b7e94d3bf 100644 --- a/packages/ded/kibana/ml_module/ded-ml.json +++ b/packages/ded/kibana/ml_module/ded-ml.json @@ -72,7 +72,6 @@ "host.id", "user.name", "event.module", - "user.id", "process.name", "source.ip", "destination.ip", @@ -81,7 +80,9 @@ "destination.geo.country_iso_code", "source.bytes", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "process.executable", + "process.parent.name" ] }, "data_description": { @@ -123,13 +124,16 @@ "host.id", "user.name", "event.module", - "user.id", "process.name", "source.ip", "destination.ip", "source.bytes", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "destination.port", + "network.transport", + "process.executable", + "process.parent.name" ] }, "data_description": { @@ -171,14 +175,16 @@ "host.id", "user.name", "event.module", - "user.id", "process.name", "source.ip", "destination.ip", "destination.port", "source.bytes", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "network.transport", + "process.executable", + "process.parent.name" ] }, "data_description": { @@ -222,7 +228,6 @@ "host.id", "user.name", "event.module", - "user.id", "process.name", "source.ip", "destination.ip", @@ -230,7 +235,9 @@ "destination.geo.region_name", "source.bytes", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "process.executable", + "process.parent.name" ] }, "data_description": { @@ -279,7 +286,11 @@ "process.name", "file.size", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "file.extension", + "process.executable", + "process.parent.name", + "file.hash.sha256" ] }, "data_description": { @@ -377,7 +388,11 @@ "process.name", "file.size", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "file.extension", + "process.executable", + "process.parent.name", + "file.hash.sha256" ] }, "data_description": { diff --git a/packages/ded/manifest.yml b/packages/ded/manifest.yml index 2a107d2ab71..f3a598ce6f1 100644 --- a/packages/ded/manifest.yml +++ b/packages/ded/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.0 name: ded title: "Data Exfiltration Detection" -version: 3.3.0 +version: 3.4.0 source: license: "Elastic-2.0" description: "ML package to detect data exfiltration in your network and file data." diff --git a/packages/dga/changelog.yml b/packages/dga/changelog.yml index 0d8948c3034..959756a29b0 100644 --- a/packages/dga/changelog.yml +++ b/packages/dga/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.2.0" + changes: + - description: Add runtime_mappings for process signature influencers on the ML datafeed. + type: enhancement + link: https://github.com/elastic/integrations/pull/123 - version: "3.1.0" changes: - description: Add process signature fields as influencers to ML jobs. diff --git a/packages/dga/kibana/ml_module/dga-ml.json b/packages/dga/kibana/ml_module/dga-ml.json index 27199515262..70ac0fe943f 100644 --- a/packages/dga/kibana/ml_module/dga-ml.json +++ b/packages/dga/kibana/ml_module/dga-ml.json @@ -51,8 +51,8 @@ "host.name", "host.id", "process.name", - "process.code_signature.subject_name", - "process.code_signature.trusted" + "process_code_signature_subject_name", + "process_code_signature_trusted" ] }, "data_description": { @@ -113,6 +113,20 @@ } ] } + }, + "runtime_mappings": { + "process_code_signature_subject_name": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.subject_name') && doc['process.code_signature.subject_name'].size() != 0) { emit(doc['process.code_signature.subject_name'].value); } else { emit('None'); }" + } + }, + "process_code_signature_trusted": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.trusted') && doc['process.code_signature.trusted'].size() != 0) { emit(doc['process.code_signature.trusted'].value.toString()); } else { emit('None'); }" + } + } } } } diff --git a/packages/dga/manifest.yml b/packages/dga/manifest.yml index e23dd3884f3..d07faaaa82e 100644 --- a/packages/dga/manifest.yml +++ b/packages/dga/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.4 name: dga title: "Domain Generation Algorithm Detection" -version: 3.1.0 +version: 3.2.0 source: license: "Elastic-2.0" description: "ML solution package to detect domain generation algorithm (DGA) activity in your network data." diff --git a/packages/lmd/changelog.yml b/packages/lmd/changelog.yml index 9f69c53c1a8..f186ee29c20 100644 --- a/packages/lmd/changelog.yml +++ b/packages/lmd/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.4.0" + changes: + - description: Add file and session influencers to ML jobs and restrict RDP transform source to Windows hosts. + type: enhancement + link: https://github.com/elastic/integrations/pull/123 - version: "3.3.0" changes: - description: Update transform source index to scope to the relevant data streams. diff --git a/packages/lmd/elasticsearch/transform/pivot_transform_ea/transform.yml b/packages/lmd/elasticsearch/transform/pivot_transform_ea/transform.yml index 9cfd54e3a7f..4eedb4af3dc 100644 --- a/packages/lmd/elasticsearch/transform/pivot_transform_ea/transform.yml +++ b/packages/lmd/elasticsearch/transform/pivot_transform_ea/transform.yml @@ -23,6 +23,9 @@ source: - term: 'process.Ext.session_info.logon_type': value: RemoteInteractive + - term: + 'host.os.type': + value: windows runtime_mappings: 'destination.ip': type: ip @@ -86,5 +89,5 @@ sync: delay: 60s field: '@timestamp' _meta: - fleet_transform_version: 3.3.0 + fleet_transform_version: 3.4.0 run_as_kibana_system: false diff --git a/packages/lmd/kibana/ml_module/lmd-ml.json b/packages/lmd/kibana/ml_module/lmd-ml.json index e3bec407591..55a1e1d196b 100644 --- a/packages/lmd/kibana/ml_module/lmd-ml.json +++ b/packages/lmd/kibana/ml_module/lmd-ml.json @@ -66,7 +66,11 @@ "event.action", "process.name", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "file.path", + "file.extension", + "file.name", + "file.hash.sha256" ] }, "data_description": { @@ -113,7 +117,11 @@ "process.name", "file.size", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "file.path", + "file.extension", + "file.name", + "file.hash.sha256" ] }, "data_description": { @@ -163,7 +171,9 @@ "file.name", "process.name", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "file.path", + "file.hash.sha256" ] }, "data_description": { @@ -211,7 +221,10 @@ "file.path", "process.name", "process.code_signature.subject_name", - "process.code_signature.trusted" + "process.code_signature.trusted", + "file.extension", + "file.name", + "file.hash.sha256" ] }, "data_description": { @@ -264,7 +277,9 @@ "user.id", "source.ip", "destination.ip", - "session.duration" + "session.duration", + "number_processes_per_session", + "total_length_process_args" ] }, "data_description": { @@ -318,7 +333,8 @@ "user.id", "source.ip", "destination.ip", - "session.duration" + "session.duration", + "number_processes_per_session" ] }, "data_description": { @@ -417,7 +433,9 @@ "event.module", "user.id", "destination.ip", - "source.ip" + "source.ip", + "session.duration", + "total_length_process_args" ] }, "data_description": { diff --git a/packages/lmd/manifest.yml b/packages/lmd/manifest.yml index 871622ac881..6be301b5cb4 100644 --- a/packages/lmd/manifest.yml +++ b/packages/lmd/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.0 name: lmd title: "Lateral Movement Detection" -version: 3.3.0 +version: 3.4.0 source: license: "Elastic-2.0" description: "ML package to detect lateral movement based on file transfer activity and Windows RDP events." diff --git a/packages/problemchild/changelog.yml b/packages/problemchild/changelog.yml index 0ac93c0360e..18a8df42e4b 100644 --- a/packages/problemchild/changelog.yml +++ b/packages/problemchild/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "3.2.0" + changes: + - description: Add runtime_mappings for process signature influencers on ML datafeeds. + type: enhancement + link: https://github.com/elastic/integrations/pull/123 - version: "3.1.0" changes: - description: Add process signature fields as influencers to ML jobs. diff --git a/packages/problemchild/kibana/ml_module/problemchild-ml.json b/packages/problemchild/kibana/ml_module/problemchild-ml.json index 1520afbde74..541f7dd0911 100644 --- a/packages/problemchild/kibana/ml_module/problemchild-ml.json +++ b/packages/problemchild/kibana/ml_module/problemchild-ml.json @@ -60,8 +60,8 @@ "event.module", "user.id", "process.command_line", - "process.code_signature.subject_name", - "process.code_signature.trusted" + "process_code_signature_subject_name", + "process_code_signature_trusted" ] }, "data_description": { @@ -114,8 +114,8 @@ "user.id", "process.command_line", "blocklist_label", - "process.code_signature.subject_name", - "process.code_signature.trusted" + "process_code_signature_subject_name", + "process_code_signature_trusted" ] }, "data_description": { @@ -161,8 +161,8 @@ "host.name", "host.id", "process.command_line", - "process.code_signature.subject_name", - "process.code_signature.trusted" + "process_code_signature_subject_name", + "process_code_signature_trusted" ] }, "data_description": { @@ -209,8 +209,8 @@ "user.name", "event.module", "user.id", - "process.code_signature.subject_name", - "process.code_signature.trusted" + "process_code_signature_subject_name", + "process_code_signature_trusted" ] }, "data_description": { @@ -264,8 +264,8 @@ "host.id", "process.command_line", "blocklist_label", - "process.code_signature.subject_name", - "process.code_signature.trusted" + "process_code_signature_subject_name", + "process_code_signature_trusted" ] }, "data_description": { @@ -320,8 +320,8 @@ "event.module", "user.id", "blocklist_label", - "process.code_signature.subject_name", - "process.code_signature.trusted" + "process_code_signature_subject_name", + "process_code_signature_trusted" ] }, "data_description": { @@ -386,6 +386,20 @@ } ] } + }, + "runtime_mappings": { + "process_code_signature_subject_name": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.subject_name') && doc['process.code_signature.subject_name'].size() != 0) { emit(doc['process.code_signature.subject_name'].value); } else { emit('None'); }" + } + }, + "process_code_signature_trusted": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.trusted') && doc['process.code_signature.trusted'].size() != 0) { emit(doc['process.code_signature.trusted'].value.toString()); } else if (doc.containsKey('winlog.event_data.SignatureStatus') && doc['winlog.event_data.SignatureStatus'].size() != 0) { emit(doc['winlog.event_data.SignatureStatus'].value); } else { emit('None'); }" + } + } } } }, @@ -433,6 +447,20 @@ } ] } + }, + "runtime_mappings": { + "process_code_signature_subject_name": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.subject_name') && doc['process.code_signature.subject_name'].size() != 0) { emit(doc['process.code_signature.subject_name'].value); } else { emit('None'); }" + } + }, + "process_code_signature_trusted": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.trusted') && doc['process.code_signature.trusted'].size() != 0) { emit(doc['process.code_signature.trusted'].value.toString()); } else if (doc.containsKey('winlog.event_data.SignatureStatus') && doc['winlog.event_data.SignatureStatus'].size() != 0) { emit(doc['winlog.event_data.SignatureStatus'].value); } else { emit('None'); }" + } + } } } }, @@ -480,6 +508,20 @@ } ] } + }, + "runtime_mappings": { + "process_code_signature_subject_name": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.subject_name') && doc['process.code_signature.subject_name'].size() != 0) { emit(doc['process.code_signature.subject_name'].value); } else { emit('None'); }" + } + }, + "process_code_signature_trusted": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.trusted') && doc['process.code_signature.trusted'].size() != 0) { emit(doc['process.code_signature.trusted'].value.toString()); } else if (doc.containsKey('winlog.event_data.SignatureStatus') && doc['winlog.event_data.SignatureStatus'].size() != 0) { emit(doc['winlog.event_data.SignatureStatus'].value); } else { emit('None'); }" + } + } } } }, @@ -527,6 +569,20 @@ } ] } + }, + "runtime_mappings": { + "process_code_signature_subject_name": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.subject_name') && doc['process.code_signature.subject_name'].size() != 0) { emit(doc['process.code_signature.subject_name'].value); } else { emit('None'); }" + } + }, + "process_code_signature_trusted": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.trusted') && doc['process.code_signature.trusted'].size() != 0) { emit(doc['process.code_signature.trusted'].value.toString()); } else if (doc.containsKey('winlog.event_data.SignatureStatus') && doc['winlog.event_data.SignatureStatus'].size() != 0) { emit(doc['winlog.event_data.SignatureStatus'].value); } else { emit('None'); }" + } + } } } }, @@ -574,6 +630,20 @@ } ] } + }, + "runtime_mappings": { + "process_code_signature_subject_name": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.subject_name') && doc['process.code_signature.subject_name'].size() != 0) { emit(doc['process.code_signature.subject_name'].value); } else { emit('None'); }" + } + }, + "process_code_signature_trusted": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.trusted') && doc['process.code_signature.trusted'].size() != 0) { emit(doc['process.code_signature.trusted'].value.toString()); } else if (doc.containsKey('winlog.event_data.SignatureStatus') && doc['winlog.event_data.SignatureStatus'].size() != 0) { emit(doc['winlog.event_data.SignatureStatus'].value); } else { emit('None'); }" + } + } } } }, @@ -621,6 +691,20 @@ } ] } + }, + "runtime_mappings": { + "process_code_signature_subject_name": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.subject_name') && doc['process.code_signature.subject_name'].size() != 0) { emit(doc['process.code_signature.subject_name'].value); } else { emit('None'); }" + } + }, + "process_code_signature_trusted": { + "type": "keyword", + "script": { + "source": "if (doc.containsKey('process.code_signature.trusted') && doc['process.code_signature.trusted'].size() != 0) { emit(doc['process.code_signature.trusted'].value.toString()); } else if (doc.containsKey('winlog.event_data.SignatureStatus') && doc['winlog.event_data.SignatureStatus'].size() != 0) { emit(doc['winlog.event_data.SignatureStatus'].value); } else { emit('None'); }" + } + } } } } diff --git a/packages/problemchild/manifest.yml b/packages/problemchild/manifest.yml index 55b24f118ce..13a7c9a7218 100644 --- a/packages/problemchild/manifest.yml +++ b/packages/problemchild/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.0 name: problemchild title: "Living off the Land Attack Detection" -version: 3.1.0 +version: 3.2.0 source: license: "Elastic-2.0" description: "ML solution package to detect Living off the Land (LotL) attacks in your environment. Requires a Platinum subscription." From 3da6f1e1c3a2ff1339cf7ac444b648878037ebc9 Mon Sep 17 00:00:00 2001 From: kirtisodhi Date: Thu, 23 Jul 2026 11:16:35 -0400 Subject: [PATCH 2/4] Update transform source index for windows PAD --- packages/pad/changelog.yml | 5 +++++ packages/pad/docs/README.md | 4 ++-- .../pivot_transform_okta_sessions_ea/transform.yml | 4 ++-- .../pivot_transform_win_privilege_list_ea/transform.yml | 6 +++--- packages/pad/manifest.yml | 2 +- 5 files changed, 13 insertions(+), 8 deletions(-) diff --git a/packages/pad/changelog.yml b/packages/pad/changelog.yml index e54d59dcf1f..af4c2244ddb 100644 --- a/packages/pad/changelog.yml +++ b/packages/pad/changelog.yml @@ -1,3 +1,8 @@ +- version: "2.4.0" + changes: + - description: Update Windows privilege transform source index to `logs-system.security-*` only. + type: enhancement + link: https://github.com/elastic/integrations/pull/123 - version: "2.3.0" changes: - description: Update transform source index to scope to the relevant data streams. diff --git a/packages/pad/docs/README.md b/packages/pad/docs/README.md index 64a6a958bc4..54ac8b7fb71 100644 --- a/packages/pad/docs/README.md +++ b/packages/pad/docs/README.md @@ -87,9 +87,9 @@ To inspect the installed assets, you can navigate to **Stack Management > Data > | Transform name | Purpose | Source index | Destination index | Alias | Supported Platform | |-------------------------------------------|-------------------------------------------------------------------|--------------|-------------------------------------------------|-------------------------------------------|--------------------| | pad.pivot_transform_okta_sessions_ea | Collects user session information for Okta events | `logs-okta.system-*` | ml_okta_multiple_user_sessions_pad_ea-[version] | ml_okta_multiple_user_sessions_pad_ea.all | Okta | -| pad.pivot_transform_win_privilege_list_ea | Collects special privileges assigned to a user for Windows events | `logs-system.security-*,logs-windows.*` | ml_windows_privilege_type_pad_ea-[version] | ml_windows_privilege_type_pad_ea.all | Windows | +| pad.pivot_transform_win_privilege_list_ea | Collects special privileges assigned to a user for Windows events | `logs-system.security-*` | ml_windows_privilege_type_pad_ea-[version] | ml_windows_privilege_type_pad_ea.all | Windows | -**Source index patterns**: `logs-okta.system-*` holds Okta system logs collected by the [Okta](https://www.elastic.co/docs/reference/integrations/okta) integration, `logs-system.security-*` holds Windows security event logs collected by the [System](https://www.elastic.co/docs/reference/integrations/system) integration, and `logs-windows.*` holds Windows event logs collected by the [Windows](https://www.elastic.co/docs/reference/integrations/windows) integration. +**Source index patterns**: `logs-okta.system-*` holds Okta system logs collected by the [Okta](https://www.elastic.co/docs/reference/integrations/okta) integration, and `logs-system.security-*` holds Windows security event logs collected by the [System](https://www.elastic.co/docs/reference/integrations/system) integration. When querying the destination indices for Okta and Windows logs, we advise using the alias for the destination index (`ml_okta_multiple_user_sessions_pad_ea.all` and `ml_windows_privilege_type_pad_ea.all`). In the event that the underlying package is upgraded, the alias will aid in maintaining the previous findings. diff --git a/packages/pad/elasticsearch/transform/pivot_transform_okta_sessions_ea/transform.yml b/packages/pad/elasticsearch/transform/pivot_transform_okta_sessions_ea/transform.yml index fc4102ec0f6..db9ceec1812 100644 --- a/packages/pad/elasticsearch/transform/pivot_transform_okta_sessions_ea/transform.yml +++ b/packages/pad/elasticsearch/transform/pivot_transform_okta_sessions_ea/transform.yml @@ -18,7 +18,7 @@ source: - terms: '_tier': [ "data_cold", "data_frozen" ] dest: - index: ml_okta_multiple_user_sessions_pad_ea-2.3.0 + index: ml_okta_multiple_user_sessions_pad_ea-2.4.0 aliases: - alias: ml_okta_multiple_user_sessions_pad_ea.latest move_on_creation: true @@ -70,5 +70,5 @@ sync: delay: 60s field: '@timestamp' _meta: - fleet_transform_version: 2.3.0 + fleet_transform_version: 2.4.0 run_as_kibana_system: false \ No newline at end of file diff --git a/packages/pad/elasticsearch/transform/pivot_transform_win_privilege_list_ea/transform.yml b/packages/pad/elasticsearch/transform/pivot_transform_win_privilege_list_ea/transform.yml index ade7b068aea..18465d27fdd 100644 --- a/packages/pad/elasticsearch/transform/pivot_transform_win_privilege_list_ea/transform.yml +++ b/packages/pad/elasticsearch/transform/pivot_transform_win_privilege_list_ea/transform.yml @@ -1,5 +1,5 @@ source: - index: "logs-system.security-*,logs-windows.*" + index: "logs-system.security-*" query: bool: filter: @@ -20,7 +20,7 @@ source: - terms: '_tier': [ "data_cold", "data_frozen" ] dest: - index: ml_windows_privilege_type_pad_ea-2.3.0 + index: ml_windows_privilege_type_pad_ea-2.4.0 aliases: - alias: ml_windows_privilege_type_pad_ea.latest move_on_creation: true @@ -70,5 +70,5 @@ sync: delay: 60s field: '@timestamp' _meta: - fleet_transform_version: 2.3.0 + fleet_transform_version: 2.4.0 run_as_kibana_system: false \ No newline at end of file diff --git a/packages/pad/manifest.yml b/packages/pad/manifest.yml index 3f86fd821d9..3e37bcf5869 100644 --- a/packages/pad/manifest.yml +++ b/packages/pad/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.0 name: pad title: "Privileged Access Detection" -version: 2.3.0 +version: 2.4.0 source: license: "Elastic-2.0" description: "ML package to detect anomalous privileged access activity in Windows, Linux and Okta logs" From 2d215c6f7639183e1d77589559f84de4958f869d Mon Sep 17 00:00:00 2001 From: kirtisodhi Date: Thu, 23 Jul 2026 11:22:38 -0400 Subject: [PATCH 3/4] Update changelog.yml --- packages/ded/changelog.yml | 2 +- packages/dga/changelog.yml | 2 +- packages/lmd/changelog.yml | 2 +- packages/pad/changelog.yml | 2 +- packages/problemchild/changelog.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/ded/changelog.yml b/packages/ded/changelog.yml index f9426d0aa2f..85f87aff036 100644 --- a/packages/ded/changelog.yml +++ b/packages/ded/changelog.yml @@ -2,7 +2,7 @@ changes: - description: Add file and process influencers to ML jobs and extend the network transform group_by with process and network fields. type: enhancement - link: https://github.com/elastic/integrations/pull/123 + link: https://github.com/elastic/integrations/pull/20335 - version: "3.3.0" changes: - description: Update transform source index to scope to the relevant data streams. diff --git a/packages/dga/changelog.yml b/packages/dga/changelog.yml index 959756a29b0..6a7fdc50896 100644 --- a/packages/dga/changelog.yml +++ b/packages/dga/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Add runtime_mappings for process signature influencers on the ML datafeed. type: enhancement - link: https://github.com/elastic/integrations/pull/123 + link: https://github.com/elastic/integrations/pull/20335 - version: "3.1.0" changes: - description: Add process signature fields as influencers to ML jobs. diff --git a/packages/lmd/changelog.yml b/packages/lmd/changelog.yml index f186ee29c20..da6e18d2421 100644 --- a/packages/lmd/changelog.yml +++ b/packages/lmd/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Add file and session influencers to ML jobs and restrict RDP transform source to Windows hosts. type: enhancement - link: https://github.com/elastic/integrations/pull/123 + link: https://github.com/elastic/integrations/pull/20335 - version: "3.3.0" changes: - description: Update transform source index to scope to the relevant data streams. diff --git a/packages/pad/changelog.yml b/packages/pad/changelog.yml index af4c2244ddb..0b283ed7b67 100644 --- a/packages/pad/changelog.yml +++ b/packages/pad/changelog.yml @@ -2,7 +2,7 @@ changes: - description: Update Windows privilege transform source index to `logs-system.security-*` only. type: enhancement - link: https://github.com/elastic/integrations/pull/123 + link: https://github.com/elastic/integrations/pull/20335 - version: "2.3.0" changes: - description: Update transform source index to scope to the relevant data streams. diff --git a/packages/problemchild/changelog.yml b/packages/problemchild/changelog.yml index 18a8df42e4b..25afb608822 100644 --- a/packages/problemchild/changelog.yml +++ b/packages/problemchild/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Add runtime_mappings for process signature influencers on ML datafeeds. type: enhancement - link: https://github.com/elastic/integrations/pull/123 + link: https://github.com/elastic/integrations/pull/20335 - version: "3.1.0" changes: - description: Add process signature fields as influencers to ML jobs. From ebde7a26197c731ad98ab32a86e88c54d061d414 Mon Sep 17 00:00:00 2001 From: kirtisodhi Date: Mon, 27 Jul 2026 10:29:39 -0400 Subject: [PATCH 4/4] Update ded transform and README.md --- packages/ded/docs/README.md | 2 +- .../elasticsearch/transform/pivot_transform_ea/transform.yml | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/packages/ded/docs/README.md b/packages/ded/docs/README.md index 644c5515694..8f75e46ed48 100644 --- a/packages/ded/docs/README.md +++ b/packages/ded/docs/README.md @@ -45,7 +45,7 @@ To inspect the installed assets, you can navigate to **Stack Management > Data > **Source index patterns**: `logs-endpoint.events.network-*` holds network events collected by the [Elastic Defend](https://www.elastic.co/docs/reference/integrations/endpoint) integration, and `logs-network_traffic.*` holds network packet traffic collected by the [Network Packet Capture](https://www.elastic.co/docs/reference/integrations/network_traffic) integration. -**Note**: The transform applies only to network data and does not currently support macOS network logs. +**Note**: The transform applies only to network data and does not currently support macOS network logs. If you use Network Packet Capture as a data source, enable **`monitor_processes`** in the integration policy so network events are enriched with process fields used by the transform and ML jobs. This setting is disabled by default. See [monitor_processes](https://www.elastic.co/docs/reference/integrations/network_traffic#monitor_processes) in the Network Packet Capture documentation. When querying the destination index (`ml_network_ded_ea-`) for network logs, we advise using the alias for the destination index (`ml_network_ded_ea.all`). In the event that the underlying package is upgraded, the alias will aid in maintaining the previous findings. diff --git a/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml b/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml index e9557b03a2d..929bb84a8da 100644 --- a/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml +++ b/packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml @@ -26,9 +26,8 @@ pivot: field: host.id 'user.name': terms: - script: - source: "return doc.containsKey('user.name') && !doc['user.name'].isEmpty() ? doc['user.name'].value : ''" - lang: painless + field: user.name + missing_bucket: true event.module: terms: field: event.module