diff --git a/packages/system/changelog.yml b/packages/system/changelog.yml index 22f37f85ff6..18d0242c96c 100644 --- a/packages/system/changelog.yml +++ b/packages/system/changelog.yml @@ -1,4 +1,10 @@ # later versions go on top +- version: "3.0.0" + changes: + - description: >- + The auth data stream no longer writes the affected account to `user.name`/`user.id` for useradd account creation, usermod group membership, userdel deletion, and PAM password change events. Since system 2.22.0 the affected account is available in `user.target.name` (and `user.target.id` for useradd), and `user.name` on these events is reserved for the acting user, matching ECS semantics. This completes the deprecation announced in 2.22.0. Before upgrading, update detection rules, saved searches, dashboards, and other content that reads the affected account from `user.name`/`user.id` on these events to use `user.target.*` instead — content still keyed on `user.name` will stop matching these events after this upgrade. The bundled New users and groups dashboard already uses `user.target.*` as of 2.23.0. + type: breaking-change + link: https://github.com/elastic/integrations/issues/20105 - version: "2.22.1" changes: - description: Fix `@timestamp` being overwritten by `ClientCreationTime` (process start time) on Windows Security events 5058, 5059, and 5061. The `date_clientcreationtime` processor was missing `target_field`, causing it to default to `@timestamp` instead of writing back to `winlog.event_data.ClientCreationTime`. diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json index be17f07db19..b5ed99d7e76 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json @@ -89,8 +89,7 @@ }, "id": "0" }, - "id": "107", - "name": "systemd-journal-remote", + "id": "1000", "target": { "id": "107", "name": "systemd-journal-remote" @@ -982,7 +981,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1061,7 +1059,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1140,7 +1137,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1360,7 +1356,6 @@ "id": "0" }, "id": "1000", - "name": "fred", "target": { "name": "fred" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json index 9f82922f64a..0c2677e8f9e 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json @@ -86,8 +86,7 @@ }, "id": "0" }, - "id": "107", - "name": "systemd-journal-remote", + "id": "1000", "target": { "id": "107", "name": "systemd-journal-remote" @@ -949,7 +948,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1025,7 +1023,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1104,7 +1101,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1315,7 +1311,6 @@ "id": "0" }, "id": "1000", - "name": "fred", "target": { "name": "fred" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json index a4331f7c3b8..c8221fa984c 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json @@ -83,7 +83,6 @@ "auth": {} }, "user": { - "name": "jce", "target": { "name": "jce" } @@ -129,7 +128,6 @@ "auth": {} }, "user": { - "name": "acris", "target": { "name": "acris" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json index fe741c65869..3e90606eee0 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json @@ -2477,8 +2477,6 @@ } }, "user": { - "id": "1001", - "name": "tsg", "target": { "id": "1001", "name": "tsg" @@ -2526,7 +2524,6 @@ "auth": {} }, "user": { - "name": "tsg", "target": { "name": "tsg" } @@ -4803,8 +4800,6 @@ } }, "user": { - "id": "106", - "name": "mysql", "target": { "id": "106", "name": "mysql" diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json index 5522c9c8278..36322aaaeab 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json @@ -553,8 +553,6 @@ } }, "user": { - "id": "48", - "name": "apache", "target": { "id": "48", "name": "apache" diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json index 815f8cbb43e..60a9d90390f 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json @@ -40,7 +40,6 @@ "auth": {} }, "user": { - "name": "user123", "target": { "name": "user123" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json index 405ab6d0c59..0f469eb5338 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json @@ -143,7 +143,6 @@ "auth": {} }, "user": { - "name": "jsmith", "target": { "name": "jsmith" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json index 488d7384be3..6b11e992f5d 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json @@ -138,7 +138,6 @@ "auth": {} }, "user": { - "name": "siem_test", "target": { "name": "siem_test" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json index f71fe32fba9..690ffb1df15 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json @@ -44,7 +44,6 @@ "auth": {} }, "user": { - "name": "testuser", "target": { "name": "testuser" } @@ -94,7 +93,6 @@ "auth": {} }, "user": { - "name": "testuser", "target": { "name": "testuser" } diff --git a/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml b/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml index 29899cfcfb3..a88c2f23d01 100644 --- a/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml +++ b/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml @@ -21,24 +21,6 @@ processors: - '^%{DATA:user.name} :( %{DATA:system.auth.sudo.error} ;)? TTY=%{DATA:system.auth.sudo.tty} ; PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}' - '^new group: name=%{DATA:group.name}, GID=%{NUMBER:group.id}' - '^new user: name=%{DATA:user.target.name}, UID=%{NUMBER:user.target.id}, GID=%{NUMBER:group.id}, home=%{DATA:system.auth.useradd.home}, shell=%{DATA:system.auth.useradd.shell}$' - - set: - description: >- - Deprecated duplication of user.target.name for backward compatibility; - will be removed for useradd events in a future major version. - tag: set_user_name_useradd_compat - field: user.name - copy_from: user.target.name - ignore_empty_value: true - if: ctx.user?.target?.name != null - - set: - description: >- - Deprecated duplication of user.target.id for backward compatibility; - will be removed for useradd events in a future major version. - tag: set_user_id_useradd_compat - field: user.id - copy_from: user.target.id - ignore_empty_value: true - if: ctx.user?.target?.id != null - append: tag: append_category_process field: event.category @@ -192,15 +174,6 @@ processors: copy_from: _temp.usermod_user ignore_empty_value: true if: ctx._temp?.usermod_user != null - - set: - description: >- - Deprecated duplication of user.target.name for backward compatibility; - will be removed for usermod events in a future major version. - tag: set_user_name_usermod_compat - field: user.name - copy_from: _temp.usermod_user - ignore_empty_value: true - if: ctx._temp?.usermod_user != null - set: tag: set_group_name_usermod_group field: group.name @@ -218,17 +191,6 @@ processors: copy_from: _temp.userdel_user ignore_empty_value: true if: ctx._temp?.userdel_user != null - - set: - description: >- - Deprecated duplication of user.target.name for backward compatibility; - will be removed for userdel events in a future major version. Limited - to "delete user" messages, matching the events that populated - user.name before user.target.name was introduced. - tag: set_user_name_userdel_compat - field: user.name - copy_from: _temp.userdel_user - ignore_empty_value: true - if: ctx._temp?.userdel_user != null && ctx.message != null && ctx.message.startsWith("delete user '") - set: tag: set_group_name_userdel field: group.name @@ -445,15 +407,6 @@ processors: ignore_missing: true ignore_failure: true if: ctx._temp?.pam_user != null && ctx._temp.pam_user != '' && (ctx.user?.name == null || ctx.user?.name == '') - - set: - description: >- - Deprecated duplication of user.target.name for backward compatibility; - will be removed for password change events in a future major version. - tag: set_user_name_pam_target_compat - field: user.name - copy_from: _temp.pam_target - ignore_empty_value: true - if: ctx._temp?.pam_target != null && ctx._temp.pam_target != '' && (ctx.user?.name == null || ctx.user?.name == '') - set: tag: set_user_target_name_chauthtok field: user.target.name diff --git a/packages/system/manifest.yml b/packages/system/manifest.yml index 4c87d5d4e76..73af1a23d10 100644 --- a/packages/system/manifest.yml +++ b/packages/system/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.4.0 name: system title: System -version: "2.22.1" +version: "3.0.0" description: Collect system logs and metrics from your servers with Elastic Agent. type: integration categories: