Add Target.process.Ext.authentication_id and process.Ext.authentication_id to Security events

[ayfaouzi]

Add Target.process.Ext.authentication_id and process.Ext.authentication_id to Security events

Change Summary

Sample values

{
    "@timestamp": "2024-07-02T09:54:58.3992113Z",
    "Target": {
        "process": {
            "Ext": {
                "authentication_id": "0x3e7"
            }
        }
    },
    "agent": {
        "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
        "type": "endpoint",
        "version": "8.15.0-SNAPSHOT"
    },
    "data_stream": {
        "dataset": "endpoint.events.security",
        "namespace": "default",
        "type": "logs"
    },
    "ecs": {
        "version": "8.10.0"
    },
    "elastic": {
        "agent": {
            "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
        }
    },
    "event": {
        "action": "log_on",
        "category": [
            "authentication",
            "session"
        ],
        "code": "4624",
        "created": "2024-07-02T09:54:58.3992113Z",
        "dataset": "endpoint.events.security",
        "id": "NcDCKv79HHIfb3Vx++++++jJ",
        "kind": "event",
        "module": "endpoint",
        "outcome": "success",
        "sequence": 1751,
        "type": [
            "start"
        ]
    },
    "host": {
        "architecture": "x86_64",
        "hostname": "desktop-id050rc",
        "id": "dabadaba-0000-0000-0000-000000000000",
        "ip": [
            "10.224.0.7",
            "127.0.0.1",
            "::1"
        ],
        "mac": [
            "42-01-0a-e0-00-07"
        ],
        "name": "desktop-id050rc",
        "os": {
            "Ext": {
                "variant": "Windows 10 Pro"
            },
            "family": "windows",
            "full": "Windows 10 Pro 22H2 (10.0.19045.4529)",
            "kernel": "22H2 (10.0.19045.4529)",
            "name": "Windows",
            "platform": "windows",
            "type": "windows",
            "version": "22H2 (10.0.19045.4529)"
        }
    },
    "message": "Endpoint security event",
    "process": {
        "Ext": {
            "authentication_id": "0x3e7",
            "code_signature": [
                {
                    "exists": true,
                    "status": "trusted",
                    "subject_name": "Microsoft Windows Publisher",
                    "trusted": true
                }
            ],
            "session_info": {
                "logon_type": "Service"
            }
        },
        "code_signature": {
            "exists": true,
            "status": "trusted",
            "subject_name": "Microsoft Windows Publisher",
            "trusted": true
        },
        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTcwOC0xNzE5ODk3OTkxLjc0NTY0NjAw",
        "executable": "C:\\Windows\\System32\\services.exe",
        "name": "C:\\Windows\\System32\\services.exe"
    },
    "user": {
        "domain": "WORKGROUP",
        "effective": {
            "domain": "NT AUTHORITY",
            "id": "S-1-5-18",
            "name": "SYSTEM"
        },
        "id": "S-1-5-18",
        "name": "DESKTOP-ID050RC$"
    },
    "winlog": {
        "event_data": {
            "PrivilegeList": []
        }
    }
}

Release Target

Q/A

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• If this is a metadata change, I also updated both transform destination schemas to match

For Transform changes:

• The new transform successfully starts in Kibana
• The corresponding transform destination schema was updated if necessary

[pzl]

Looks good.

Can you please add sample values for these two fields to package/endpoint/data_stream/security/sample_event.json? That file is used in CI/automated testing for this repo

[ayfaouzi]

@pzl Thanks, I have just updated sample_event.json.

[pzl]

current set of changes look good

please add the winlogbeat fields in another PR