elastic · r00tu53r · Jan 13, 2022 · Jan 10, 2022
diff --git a/packages/azure/_dev/build/build.yml b/packages/azure/_dev/build/build.yml
@@ -1,3 +1,3 @@
 dependencies:
   ecs:
-    reference: git@1.12
+    reference: git@8.0
diff --git a/packages/azure/changelog.yml b/packages/azure/changelog.yml
@@ -1,3 +1,8 @@
+- version: "0.12.3"
+  changes:
+    - description: Update to ECS 8.0
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/2479
 # newer versions go on top
 - version: "0.12.2"
   changes:

diff --git a/...data_stream/activitylogs/_dev/test/pipeline/test-activitylogs-edgecases.log-expected.json b/...data_stream/activitylogs/_dev/test/pipeline/test-activitylogs-edgecases.log-expected.json
@@ -6,14 +6,14 @@
             },
             "@timestamp": "2021-05-25T22:04:07.220Z",
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "log": {
                 "level": "Information"
             },
             "event": {
                 "action": "Microsoft.Resourcehealth/healthevent/Updated/action",
-                "ingested": "2021-12-14T14:35:43.079282922Z",
+                "ingested": "2022-01-09T23:56:18.931056170Z",
                 "original": "{\"category\":\"ResourceHealth\",\"correlationId\":\"1c867fe2-050c-4a74-bb1c-a83b15246fdd\",\"level\":\"Information\",\"operationName\":\"Microsoft.Resourcehealth/healthevent/Updated/action\",\"properties\":{\"eventCategory\":\"ResourceHealth\",\"eventProperties\":{\"cause\":\"PlatformInitiated\"}},\"resourceId\":\"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.domainRegistration\",\"resultType\":\"Updated\",\"time\":\"2021-05-25T22:04:07.22Z\"}",
                 "kind": "event"
             },

diff --git a/...azure/data_stream/activitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json b/...azure/data_stream/activitylogs/_dev/test/pipeline/test-activitylogs-raw.log-expected.json
@@ -39,7 +39,7 @@
             },
             "@timestamp": "2019-10-24T00:13:46.355Z",
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "related": {
                 "ip": [
@@ -52,7 +52,7 @@
             "event": {
                 "duration": 0,
                 "action": "MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/LISTKEYS/ACTION",
-                "ingested": "2021-12-14T14:35:43.155209455Z",
+                "ingested": "2022-01-09T23:56:19.163757335Z",
                 "original": "{\"callerIpAddress\":\"81.2.69.144\",\"category\":\"Action\",\"correlationId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"durationMs\":0,\"identity\":{\"authorization\":{\"action\":\"Microsoft.EventHub/namespaces/authorizationRules/listKeys/action\",\"evidence\":{\"principalId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"principalType\":\"ServicePrincipal\",\"role\":\"Azure EventGrid Service BuiltIn Role\",\"roleAssignmentId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"roleAssignmentScope\":\"/subscriptions/8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"roleDefinitionId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\"},\"scope\":\"/subscriptions/8a4de8b5-095c-47d0-a96f-a75130c61d53/resourceGroups/sa-hem/providers/Microsoft.EventHub/namespaces/azurelsevents/authorizationRules/RootManageSharedAccessKey\"},\"claims\":{\"aio\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"appid\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"appidacr\":\"2\",\"aud\":\"https://management.core.windows.net/\",\"exp\":\"1571904826\",\"http://schemas.microsoft.com/identity/claims/identityprovider\":\"https://sts.windows.net/8a4de8b5-095c-47d0-a96f-a75130c61d53/\",\"http://schemas.microsoft.com/identity/claims/objectidentifier\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"http://schemas.microsoft.com/identity/claims/tenantid\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"iat\":\"1571875726\",\"iss\":\"https://sts.windows.net/8a4de8b5-095c-47d0-a96f-a75130c61d53/\",\"nbf\":\"1571875726\",\"uti\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"ver\":\"1.0\"}},\"level\":\"Information\",\"location\":\"global\",\"operationName\":\"MICROSOFT.EVENTHUB/NAMESPACES/AUTHORIZATIONRULES/LISTKEYS/ACTION\",\"resourceId\":\"/SUBSCRIPTIONS/8a4de8b5-095c-47d0-a96f-a75130c61d53/RESOURCEGROUPS/SA-HEMA/PROVIDERS/MICROSOFT.EVENTHUB/NAMESPACES/AZURELSEVENTS/AUTHORIZATIONRULES/ROOTMANAGESHAREDACCESSKEY\",\"resultSignature\":\"Started.\",\"resultType\":\"Start\",\"time\":\"2019-10-24T00:13:46.3554259Z\"}",
                 "type": [
                     "change"

diff --git a/packages/azure/data_stream/activitylogs/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/activitylogs/elasticsearch/ingest_pipeline/default.yml
@@ -6,7 +6,7 @@ processors:
       value: '{{_ingest.timestamp}}'
   - set:
       field: ecs.version
-      value: '1.12.0'
+      value: '8.0.0'
   - rename:
       field: azure
       target_field: azure-eventhub

diff --git a/packages/azure/data_stream/auditlogs/_dev/test/pipeline/test-auditlogs-raw.log-expected.json b/packages/azure/data_stream/auditlogs/_dev/test/pipeline/test-auditlogs-raw.log-expected.json
@@ -6,15 +6,15 @@
             },
             "@timestamp": "2019-10-18T15:30:51.027Z",
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "log": {
                 "level": "Informational"
             },
             "event": {
                 "duration": 0,
                 "action": "Update device",
-                "ingested": "2021-12-14T14:35:43.558271296Z",
+                "ingested": "2022-01-09T23:56:20.546245946Z",
                 "original": "{\"category\":\"AuditLogs\",\"correlationId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"durationMs\":0,\"identity\":\"Device Registration Service\",\"level\":\"Informational\",\"operationName\":\"Update device\",\"operationVersion\":\"1.0\",\"properties\":{\"activityDateTime\":\"2019-10-18T15:30:51.0273716+00:00\",\"activityDisplayName\":\"Update device\",\"category\":\"Device\",\"correlationId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"id\":\"Directory_ESQ\",\"initiatedBy\":{\"app\":{\"appId\":\"id\",\"displayName\":\"Device Registration Service\",\"servicePrincipalId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"servicePrincipalName\":\"Core\"}},\"loggedByService\":\"Core Directory\",\"operationType\":\"Update\",\"result\":\"success\",\"resultReason\":\"\",\"targetResources\":[{\"displayName\":\"LAPTOP-12\",\"id\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"modifiedProperties\":[{\"displayName\":\"Included Updated Properties\",\"newValue\":\"\\\"\\\"\",\"oldValue\":\"\"}],\"type\":\"Device\"}]},\"resourceId\":\"/tenants/8a4de8b5-095c-47d0-a96f-a75130c61d53/providers/Microsoft.aadiam\",\"resultSignature\":\"None\",\"tenantId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"time\":\"2019-10-18T15:30:51.0273716Z\"}",
                 "kind": "event",
                 "outcome": "success"

diff --git a/packages/azure/data_stream/auditlogs/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/auditlogs/elasticsearch/ingest_pipeline/default.yml
@@ -6,7 +6,7 @@ processors:
       value: '{{_ingest.timestamp}}'
   - set:
       field: ecs.version
-      value: '1.12.0'
+      value: '8.0.0'
   - rename:
       field: azure
       target_field: azure-eventhub

diff --git a/packages/azure/data_stream/eventhub/_dev/test/pipeline/test-eventhub-raw.log-expected.json b/packages/azure/data_stream/eventhub/_dev/test/pipeline/test-eventhub-raw.log-expected.json
@@ -3,11 +3,11 @@
         {
             "message": "{\"category\":\"AuditLogs\",\"correlationId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"durationMs\":0,\"identity\":\"Device Registration Service\",\"level\":\"Informational\",\"operationName\":\"Update device\",\"operationVersion\":\"1.0\",\"properties\":{\"activityDateTime\":\"2019-10-18T15:30:51.0273716+00:00\",\"activityDisplayName\":\"Update device\",\"category\":\"Device\",\"correlationId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"id\":\"Directory_ESQ\",\"initiatedBy\":{\"app\":{\"appId\":\"id\",\"displayName\":\"Device Registration Service\",\"servicePrincipalId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"servicePrincipalName\":\"Core\"}},\"loggedByService\":\"Core Directory\",\"operationType\":\"Update\",\"result\":\"success\",\"resultReason\":\"\",\"targetResources\":[{\"displayName\":\"LAPTOP-12\",\"id\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"modifiedProperties\":[{\"displayName\":\"Included Updated Properties\",\"newValue\":\"\\\"\\\"\",\"oldValue\":\"\"}],\"type\":\"Device\"}]},\"resourceId\":\"/tenants/8a4de8b5-095c-47d0-a96f-a75130c61d53/providers/Microsoft.aadiam\",\"resultSignature\":\"None\",\"tenantId\":\"8a4de8b5-095c-47d0-a96f-a75130c61d53\",\"time\":\"2019-10-18T15:30:51.0273716Z\"}",
             "event": {
-                "ingested": "2021-12-14T14:35:43.988896537Z",
+                "ingested": "2022-01-09T23:56:21.799663417Z",
                 "kind": "event"
             },
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "tags": [
                 "preserve_original_event"

diff --git a/packages/azure/data_stream/eventhub/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/eventhub/elasticsearch/ingest_pipeline/default.yml
@@ -6,7 +6,7 @@ processors:
       value: '{{_ingest.timestamp}}'
   - set:
       field: ecs.version
-      value: '1.12.0'
+      value: '8.0.0'
   - rename:
       field: azure
       target_field: azure-eventhub

diff --git a/...ta_stream/platformlogs/_dev/test/pipeline/test-platformlogs-invalid-raw.log-expected.json b/...ta_stream/platformlogs/_dev/test/pipeline/test-platformlogs-invalid-raw.log-expected.json
@@ -6,11 +6,11 @@
             },
             "@timestamp": "2020-10-11T20:30:59.000Z",
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "event": {
                 "action": "ApplicationGatewayAccess",
-                "ingested": "2021-12-14T14:35:44.368671668Z",
+                "ingested": "2022-01-09T23:56:22.990566874Z",
                 "original": "{ \"resourceId\": \"/SUBSCRIPTIONS/SUBSCRIPTION/RESOURCEGROUPS/ET-AZURE-INTEGRATION-TESTING/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/LANGERGATEWAY\", \"operationName\": \"ApplicationGatewayAccess\", \"time\": \"2020-10-11T20:30:59Z\", \"category\": \"ApplicationGatewayAccessLog\", \"properties\": {\"instanceId\":\"ApplicationGatewayRole_IN_1\",\"clientIP\":\"172.105.13.165\",\"clientPort\":18234,\"httpMethod\":\"GET\",\"requestUri\":\"/nmaplowercheck1602448229\",\"requestQuery\":\"X-AzureApplicationGateway-CACHE-HIT=0\",\"userAgent\":\"Mozilla/5.0\",\"httpStatus\":502,\"httpVersion\":\"HTTP/1.1\",\"receivedBytes\":108,\"sentBytes\":1636,\"timeTaken\":78,\"sslEnabled\":\"off\",\"host\":\"IP\",\"originalHost\":\"IP\"}},{ \"resourceId\": \"/SUBSCRIPTIONS/SUBSCRIPTION/RESOURCEGROUPS/ET-AZURE-INTEGRATION-TESTING/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/LANGERGATEWAY\", \"operationName\": \"ApplicationGatewayAccess\", \"time\": \"2020-10-11T20:30:59Z\", \"category\": \"ApplicationGatewayAccessLog\", \"properties\": {\"instanceId\":\"ApplicationGatewayRole_IN_1\",\"clientIP\":\"172.105.13.165\",\"clientPort\":18706,\"httpMethod\":\"GET\",\"requestUri\":\"/evox/about\",\"requestQuery\":\"X-AzureApplicationGateway-CACHE-HIT=0\",\"userAgent\":\"Mozilla/5.0\",\"httpStatus\":502,\"httpVersion\":\"HTTP/1.1\",\"receivedBytes\":94,\"sentBytes\":1636,\"timeTaken\":62,\"sslEnabled\":\"off\",\"host\":\"IP\",\"originalHost\":\"IP\"}}]}",
                 "kind": "event"
             },

diff --git a/...zure/data_stream/platformlogs/_dev/test/pipeline/test-platformlogs-kube.log-expected.json b/...zure/data_stream/platformlogs/_dev/test/pipeline/test-platformlogs-kube.log-expected.json
@@ -6,11 +6,11 @@
             },
             "@timestamp": "2020-11-09T10:57:31.000Z",
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "event": {
                 "action": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
-                "ingested": "2021-12-14T14:35:44.421779579Z",
+                "ingested": "2022-01-09T23:56:23.212917863Z",
                 "original": "{\"Cloud\":\"AzureCloud\",\"Environment\":\"prod\",\"category\":\"kube-audit\",\"ccpNamespace\":\"5e4bf4baee195b00017cdbfa\",\"operationName\":\"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read\",\"properties\":{\"log\":\"{\\\"kind\\\":\\\"Event\\\"}\",\"pod\":\"kube-apiserver-666bd4b459-hjgdc\"},\"resourceId\":\"/SUBSCRIPTIONS/70BD6E77-4B1E-4835-8896-DB77B8EEF364/RESOURCEGROUPS/OBS-INFRASTRUCTURE/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/OBSKUBE\",\"time\":\"2020-11-09T10:57:31.0000000Z\"}",
                 "kind": "event"
             },

diff --git a/...azure/data_stream/platformlogs/_dev/test/pipeline/test-platformlogs-raw.log-expected.json b/...azure/data_stream/platformlogs/_dev/test/pipeline/test-platformlogs-raw.log-expected.json
@@ -7,11 +7,11 @@
             },
             "@timestamp": "2020-11-03T09:06:42.000Z",
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "event": {
                 "action": "Retreive ConsumerGroup",
-                "ingested": "2021-12-14T14:35:44.477324350Z",
+                "ingested": "2022-01-09T23:56:23.288456662Z",
                 "original": "{\"ActivityId\":\"30ed877c-a36b-491a-bd4d-ddd847fe55b8\",\"Caller\":\"Portal\",\"Environment\":\"PROD\",\"EventName\":\"Retreive ConsumerGroup\",\"EventProperties\":\"{\\\"SubscriptionId\\\":\\\"7657426d-c4c3-44ac-88a2-3b2cd59e6dba\\\",\\\"Namespace\\\":\\\"obstesteventhubs\\\",\\\"Via\\\":\\\"sb://obstesteventhubs.servicebus.windows.net/insights-logs-operationallogs/consumergroups?api-version=2017-04\\u0026$skip=0\\u0026$top=100\\\",\\\"TrackingId\\\":\\\"30ed877c-a36b-491a-bd4d-ddd847fe55b8_M2CH3_M2CH3_G3S2\\\"}\",\"EventTimeString\":\"11/3/2020 9:06:42 AM +00:00\",\"Region\":\"West Europe\",\"ScaleUnit\":\"PROD-AM3-AZ501\",\"Status\":\"Succeeded\",\"category\":\"OperationalLogs\",\"resourceId\":\"/SUBSCRIPTIONS/7657426D-C4C3-44AC-88A2-3B2CD59E6DBA/RESOURCEGROUPS/OBS-TEST/PROVIDERS/MICROSOFT.EVENTHUB/NAMESPACES/OBSTESTEVENTHUBS\"}",
                 "kind": "event",
                 "outcome": "succeeded"
@@ -52,11 +52,11 @@
             },
             "@timestamp": "2020-11-03T09:06:42.000Z",
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "event": {
                 "action": "Retreive ConsumerGroup",
-                "ingested": "2021-12-14T14:35:44.477326822Z",
+                "ingested": "2022-01-09T23:56:23.288459821Z",
                 "original": "{\"ActivityId\":\"30ed877c-a36b-491a-bd4d-ddd847fe55b8\",\"Caller\":\"Portal\",\"Environment\":\"PROD\",\"EventName\":\"Retreive ConsumerGroup\",\"EventProperties\":\"{\\\"SubscriptionId\\\":\\\"7657426d-c4c3-44ac-88a2-3b2cd59e6dba\\\",\\\"Namespace\\\":\\\"obstesteventhubs\\\"}\",\"EventTimeString\":\"11/3/2020 9:06:42 AM +00:00\",\"Region\":\"West Europe\",\"ScaleUnit\":\"PROD-AM3-AZ501\",\"Status\":\"Succeeded\",\"category\":\"OperationalLogs\",\"resourceId\":\"/SUBSCRIPTIONS/7657426D-C4C3-44AC-88A2-3B2CD59E6DBA/RESOURCEGROUPS/OBS-TEST/PROVIDERS/MICROSOFT.EVENTHUB/NAMESPACES/OBSTESTEVENTHUBS\"}",
                 "kind": "event",
                 "outcome": "succeeded"

diff --git a/...ata_stream/platformlogs/_dev/test/pipeline/test-platformlogs-remote-raw.log-expected.json b/...ata_stream/platformlogs/_dev/test/pipeline/test-platformlogs-remote-raw.log-expected.json
@@ -6,11 +6,11 @@
             },
             "@timestamp": "2020-11-09T10:57:31.000Z",
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "event": {
                 "action": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
-                "ingested": "2021-12-14T14:35:44.571614650Z",
+                "ingested": "2022-01-09T23:56:23.420794628Z",
                 "original": "{\"Cloud\":\"AzureCloud\",\"Environment\":\"prod\",\"category\":\"kube-audit\",\"ccpNamespace\":\"5e4bf4baee195b00017cdbfa\",\"operationName\":\"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read\",\"properties\":{\"log\":\"{\\\"kind\\\":\\\"Event\\\",\\\"apiVersion\\\":\\\"audit.k8s.io/v1\\\",\\\"level\\\":\\\"Metadata\\\",\\\"auditID\\\":\\\"22af12c3-a1fe-4f2c-99a9-3cdde671dbfe\\\"}\",\"pod\":\"kube-apiserver-666bd4b459-hjgdc\",\"stream\":\"stdout\"},\"resourceId\":\"/SUBSCRIPTIONS/70BD6E77-4B1E-4835-8896-DB77B8EEF364/RESOURCEGROUPS/OBS-INFRASTRUCTURE/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/OBSKUBE\",\"time\":\"2020-11-09T10:57:31.0000000Z\"}",
                 "kind": "event"
             },

diff --git a/packages/azure/data_stream/platformlogs/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/platformlogs/elasticsearch/ingest_pipeline/default.yml
@@ -6,7 +6,7 @@ processors:
       value: '{{_ingest.timestamp}}'
   - set:
       field: ecs.version
-      value: '1.12.0'
+      value: '8.0.0'
   - rename:
       field: azure
       target_field: azure-eventhub

diff --git a/...s/azure/data_stream/signinlogs/_dev/test/pipeline/test-managed-identity.log-expected.json b/...s/azure/data_stream/signinlogs/_dev/test/pipeline/test-managed-identity.log-expected.json
@@ -14,14 +14,14 @@
             },
             "@timestamp": "2021-01-23T20:44:29.768Z",
             "ecs": {
-                "version": "1.12.0"
+                "version": "8.0.0"
             },
             "log": {
                 "level": "4"
             },
             "event": {
                 "duration": 0,
-                "ingested": "2021-12-14T14:35:44.888547736Z",
+                "ingested": "2022-01-09T23:56:23.901315492Z",
                 "original": "{\"Level\":4,\"category\":\"ManagedIdentitySignInLogs\",\"correlationId\":\"22222222-92d0-4887-9ead-46258539a699\",\"durationMs\":0,\"operationName\":\"Sign-in activity\",\"operationVersion\":\"1.0\",\"properties\":{\"appId\":\"22222222-b540-4792-a2a2-81818990a95b\",\"correlationId\":\"22222222-92d0-4887-9ead-46258539a699\",\"createdDateTime\":\"2021-01-23T20:44:29.7688982+00:00\",\"flaggedForReview\":false,\"id\":\"22222222-0b57-4b77-bf1a-317a88591a00\",\"ipAddress\":\"\",\"isInteractive\":false,\"location\":{\"city\":\"\",\"countryOrRegion\":\"\",\"geoCoordinates\":{\"latitude\":0,\"longitude\":0},\"state\":\"\"},\"processingTimeInMilliseconds\":0,\"resourceDisplayName\":\"Windows Azure Service Management API\",\"resourceId\":\"22222222-ba00-4fd7-ba43-dac1f8f63013\",\"riskDetail\":\"none\",\"riskLevelAggregated\":\"low\",\"riskLevelDuringSignIn\":\"low\",\"riskState\":\"none\",\"servicePrincipalId\":\"22222222-864d-4e00-9882-ff649530f186\",\"servicePrincipalName\":\"ASC provisioning Dependency agent for Linux\",\"status\":{\"errorCode\":0},\"tokenIssuerType\":\"AzureAD\",\"userId\":null},\"resourceId\":\"/tenants/tenantId/providers/Microsoft.aadiam\",\"resultSignature\":\"None\",\"resultType\":\"0\",\"tenantId\":\"tenantId\",\"time\":\"2021-01-23T20:44:29.7688982Z\"}",
                 "kind": "event",
                 "action": "Sign-in activity",