github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 09:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

[8.11] Fix EQL search snapshots (#169437) (#169599)

Browse source 
# Backport

This will backport the following commits from `main` to `8.11`:
- [Fix EQL search snapshots
(#169437)](https://github.com/elastic/kibana/pull/169437)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Lukas
Olson","email":"lukas@elastic.co"},"sourceCommit":{"committedDate":"2023-10-23T23:41:48Z","message":"Fix
EQL search snapshots (#169437)\n\n## Summary\r\n\r\nFixes the snapshots
from https://github.com/elastic/kibana/pull/169181.\r\nIt was
accidentally merged before I could address feedback.\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n- [ ] Any text added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n-
[
]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas
added for features that require explanation or tutorials\r\n- [ ] [Unit
or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [ ] Any UI
touched in this PR is usable by keyboard only (learn more\r\nabout
[keyboard accessibility](https://webaim.org/techniques/keyboard/))\r\n-
[ ] Any UI touched in this PR does not create any new axe
failures\r\n(run axe in
browser:\r\n[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),\r\n[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))\r\n-
[ ] If a plugin configuration key changed, check if it needs to
be\r\nallowlisted in the cloud and added to the
[docker\r\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\r\n-
[ ] This renders correctly on smaller devices using a
responsive\r\nlayout. (You can test this [in
your\r\nbrowser](https://www.browserstack.com/guide/responsive-testing-on-local-server))\r\n-
[ ] This was checked for
[cross-browser\r\ncompatibility](https://www.elastic.co/support/matrix#matrix_browsers)\r\n\r\n\r\n###
Risk Matrix\r\n\r\nDelete this section if it is not applicable to this
PR.\r\n\r\nBefore closing this PR, invite QA, stakeholders, and other
developers to\r\nidentify risks that should be tested prior to the
change/feature\r\nrelease.\r\n\r\nWhen forming the risk matrix, consider
some of the following examples\r\nand how they may potentially impact
the change:\r\n\r\n| Risk | Probability | Severity | Mitigation/Notes
|\r\n\r\n|---------------------------|-------------|----------|-------------------------|\r\n|
Multiple Spaces&mdash;unexpected behavior in non-default Kibana
Space.\r\n| Low | High | Integration tests will verify that all features
are still\r\nsupported in non-default Kibana Space and when user
switches between\r\nspaces. |\r\n| Multiple nodes&mdash;Elasticsearch
polling might have race conditions\r\nwhen multiple Kibana nodes are
polling for the same tasks. | High | Low\r\n| Tasks are idempotent, so
executing them multiple times will not result\r\nin logical error, but
will degrade performance. To test for this case we\r\nadd plenty of unit
tests around this logic and document manual testing\r\nprocedure. |\r\n|
Code should gracefully handle cases when feature X or plugin Y
are\r\ndisabled. | Medium | High | Unit tests will verify that any
feature flag\r\nor plugin combination still results in our service
operational. |\r\n| [See more potential
risk\r\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
|\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for
breaking API changes and was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"01ebda0cf43613f0dfbfa2b4f674981774b4dcfc","branchLabelMapping":{"^v8.12.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v8.11.0","v8.12.0","v8.11.1"],"number":169437,"url":"https://github.com/elastic/kibana/pull/169437","mergeCommit":{"message":"Fix
EQL search snapshots (#169437)\n\n## Summary\r\n\r\nFixes the snapshots
from https://github.com/elastic/kibana/pull/169181.\r\nIt was
accidentally merged before I could address feedback.\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n- [ ] Any text added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n-
[
]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas
added for features that require explanation or tutorials\r\n- [ ] [Unit
or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [ ] Any UI
touched in this PR is usable by keyboard only (learn more\r\nabout
[keyboard accessibility](https://webaim.org/techniques/keyboard/))\r\n-
[ ] Any UI touched in this PR does not create any new axe
failures\r\n(run axe in
browser:\r\n[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),\r\n[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))\r\n-
[ ] If a plugin configuration key changed, check if it needs to
be\r\nallowlisted in the cloud and added to the
[docker\r\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\r\n-
[ ] This renders correctly on smaller devices using a
responsive\r\nlayout. (You can test this [in
your\r\nbrowser](https://www.browserstack.com/guide/responsive-testing-on-local-server))\r\n-
[ ] This was checked for
[cross-browser\r\ncompatibility](https://www.elastic.co/support/matrix#matrix_browsers)\r\n\r\n\r\n###
Risk Matrix\r\n\r\nDelete this section if it is not applicable to this
PR.\r\n\r\nBefore closing this PR, invite QA, stakeholders, and other
developers to\r\nidentify risks that should be tested prior to the
change/feature\r\nrelease.\r\n\r\nWhen forming the risk matrix, consider
some of the following examples\r\nand how they may potentially impact
the change:\r\n\r\n| Risk | Probability | Severity | Mitigation/Notes
|\r\n\r\n|---------------------------|-------------|----------|-------------------------|\r\n|
Multiple Spaces&mdash;unexpected behavior in non-default Kibana
Space.\r\n| Low | High | Integration tests will verify that all features
are still\r\nsupported in non-default Kibana Space and when user
switches between\r\nspaces. |\r\n| Multiple nodes&mdash;Elasticsearch
polling might have race conditions\r\nwhen multiple Kibana nodes are
polling for the same tasks. | High | Low\r\n| Tasks are idempotent, so
executing them multiple times will not result\r\nin logical error, but
will degrade performance. To test for this case we\r\nadd plenty of unit
tests around this logic and document manual testing\r\nprocedure. |\r\n|
Code should gracefully handle cases when feature X or plugin Y
are\r\ndisabled. | Medium | High | Unit tests will verify that any
feature flag\r\nor plugin combination still results in our service
operational. |\r\n| [See more potential
risk\r\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
|\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for
breaking API changes and was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"01ebda0cf43613f0dfbfa2b4f674981774b4dcfc"}},"sourceBranch":"main","suggestedTargetBranches":["8.11"],"targetPullRequestStates":[{"branch":"8.11","label":"v8.11.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.12.0","labelRegex":"^v8.12.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/169437","number":169437,"mergeCommit":{"message":"Fix
EQL search snapshots (#169437)\n\n## Summary\r\n\r\nFixes the snapshots
from https://github.com/elastic/kibana/pull/169181.\r\nIt was
accidentally merged before I could address feedback.\r\n\r\n###
Checklist\r\n\r\nDelete any items that are not applicable to this
PR.\r\n\r\n- [ ] Any text added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n-
[
]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas
added for features that require explanation or tutorials\r\n- [ ] [Unit
or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [ ] Any UI
touched in this PR is usable by keyboard only (learn more\r\nabout
[keyboard accessibility](https://webaim.org/techniques/keyboard/))\r\n-
[ ] Any UI touched in this PR does not create any new axe
failures\r\n(run axe in
browser:\r\n[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),\r\n[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))\r\n-
[ ] If a plugin configuration key changed, check if it needs to
be\r\nallowlisted in the cloud and added to the
[docker\r\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\r\n-
[ ] This renders correctly on smaller devices using a
responsive\r\nlayout. (You can test this [in
your\r\nbrowser](https://www.browserstack.com/guide/responsive-testing-on-local-server))\r\n-
[ ] This was checked for
[cross-browser\r\ncompatibility](https://www.elastic.co/support/matrix#matrix_browsers)\r\n\r\n\r\n###
Risk Matrix\r\n\r\nDelete this section if it is not applicable to this
PR.\r\n\r\nBefore closing this PR, invite QA, stakeholders, and other
developers to\r\nidentify risks that should be tested prior to the
change/feature\r\nrelease.\r\n\r\nWhen forming the risk matrix, consider
some of the following examples\r\nand how they may potentially impact
the change:\r\n\r\n| Risk | Probability | Severity | Mitigation/Notes
|\r\n\r\n|---------------------------|-------------|----------|-------------------------|\r\n|
Multiple Spaces&mdash;unexpected behavior in non-default Kibana
Space.\r\n| Low | High | Integration tests will verify that all features
are still\r\nsupported in non-default Kibana Space and when user
switches between\r\nspaces. |\r\n| Multiple nodes&mdash;Elasticsearch
polling might have race conditions\r\nwhen multiple Kibana nodes are
polling for the same tasks. | High | Low\r\n| Tasks are idempotent, so
executing them multiple times will not result\r\nin logical error, but
will degrade performance. To test for this case we\r\nadd plenty of unit
tests around this logic and document manual testing\r\nprocedure. |\r\n|
Code should gracefully handle cases when feature X or plugin Y
are\r\ndisabled. | Medium | High | Unit tests will verify that any
feature flag\r\nor plugin combination still results in our service
operational. |\r\n| [See more potential
risk\r\nexamples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
|\r\n\r\n\r\n### For maintainers\r\n\r\n- [ ] This was checked for
breaking API changes and was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"01ebda0cf43613f0dfbfa2b4f674981774b4dcfc"}}]}]
BACKPORT-->

Co-authored-by: Lukas Olson <lukas@elastic.co>
This commit is contained in:
Kibana Machine 2023-10-23 21:08:17 -04:00 • committed by GitHub
parent fdbf5a0984
commit 89f16335e1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 1436 additions and 905 deletions
Download patch file Download diff file Expand all files Collapse all files

1796
x-pack/plugins/timelines/server/search_strategy/timeline/eql/__mocks__/index.ts
View file

File diff suppressed because it is too large Load diff

545
x-pack/plugins/timelines/server/search_strategy/timeline/eql/helpers.test.ts
View file

@ -178,7 +178,273 @@ describe('Search Strategy EQL helper', () => {
eventsResponse
);
expect(result.edges).toMatchInlineSnapshot(`Array []`);
expect(result.edges).toMatchInlineSnapshot(`
Array [
Object {
"cursor": Object {
"tiebreaker": null,
"value": "",
},
"node": Object {
"_id": "qhymg3cBX5UUcOOYP3Ec",
"_index": ".ds-logs-endpoint.events.security-default-2021.02.05-000005",
"data": Array [
Object {
"field": "@timestamp",
"value": Array [
"2021-02-08T21:50:28.3377092Z",
],
},
Object {
"field": "event.action",
"value": Array [
"log_on",
],
},
Object {
"field": "event.category",
"value": Array [
"authentication",
"session",
],
},
Object {
"field": "host.name",
"value": Array [
"win2019-endpoint-mr-pedro",
],
},
Object {
"field": "message",
"value": Array [
"Endpoint security event",
],
},
],
"ecs": Object {
"@timestamp": Array [
"2021-02-08T21:50:28.3377092Z",
],
"_id": "qhymg3cBX5UUcOOYP3Ec",
"_index": ".ds-logs-endpoint.events.security-default-2021.02.05-000005",
"agent": Object {
"id": Array [
"1d15cf9e-3dc7-5b97-f586-743f7c2518b2",
],
"type": Array [
"endpoint",
],
},
"event": Object {
"action": Array [
"log_on",
],
"category": Array [
"authentication",
"session",
],
"created": Array [
"2021-02-08T21:50:28.3377092Z",
],
"dataset": Array [
"endpoint.events.security",
],
"id": Array [
"LzzWB9jjGmCwGMvk++++FG/O",
],
"kind": Array [
"event",
],
"module": Array [
"endpoint",
],
"outcome": Array [
"success",
],
"type": Array [
"start",
],
},
"host": Object {
"id": Array [
"d8ad572e-d224-4044-a57d-f5a84c0dfe5d",
],
"ip": Array [
"10.128.0.57",
"fe80::9ced:8f1c:880b:3e1f",
"127.0.0.1",
"::1",
],
"name": Array [
"win2019-endpoint-mr-pedro",
],
"os": Object {
"family": Array [
"windows",
],
"name": Array [
"Windows",
],
},
},
"message": Array [
"Endpoint security event",
],
"process": Object {
"entity_id": Array [
"MWQxNWNmOWUtM2RjNy01Yjk3LWY1ODYtNzQzZjdjMjUxOGIyLTUyODQtMTMyNTcyOTQ2MjMuOTk2NTkxMDAw",
],
"executable": Array [
"C:\\\\Program Files\\\\OpenSSH-Win64\\\\sshd.exe",
],
"name": Array [
"C:\\\\Program Files\\\\OpenSSH-Win64\\\\sshd.exe",
],
},
"timestamp": "2021-02-08T21:50:28.3377092Z",
"user": Object {
"domain": Array [
"NT AUTHORITY",
],
"name": Array [
"SYSTEM",
],
},
},
},
},
Object {
"cursor": Object {
"tiebreaker": null,
"value": "",
},
"node": Object {
"_id": "qxymg3cBX5UUcOOYP3Ec",
"_index": ".ds-logs-endpoint.events.security-default-2021.02.05-000005",
"data": Array [
Object {
"field": "@timestamp",
"value": Array [
"2021-02-08T21:50:28.3377142Z",
],
},
Object {
"field": "event.action",
"value": Array [
"log_on",
],
},
Object {
"field": "event.category",
"value": Array [
"authentication",
"session",
],
},
Object {
"field": "host.name",
"value": Array [
"win2019-endpoint-mr-pedro",
],
},
Object {
"field": "message",
"value": Array [
"Endpoint security event",
],
},
],
"ecs": Object {
"@timestamp": Array [
"2021-02-08T21:50:28.3377142Z",
],
"_id": "qxymg3cBX5UUcOOYP3Ec",
"_index": ".ds-logs-endpoint.events.security-default-2021.02.05-000005",
"agent": Object {
"id": Array [
"1d15cf9e-3dc7-5b97-f586-743f7c2518b2",
],
"type": Array [
"endpoint",
],
},
"event": Object {
"action": Array [
"log_on",
],
"category": Array [
"authentication",
"session",
],
"created": Array [
"2021-02-08T21:50:28.3377142Z",
],
"dataset": Array [
"endpoint.events.security",
],
"id": Array [
"LzzWB9jjGmCwGMvk++++FG/P",
],
"kind": Array [
"event",
],
"module": Array [
"endpoint",
],
"outcome": Array [
"success",
],
"type": Array [
"start",
],
},
"host": Object {
"id": Array [
"d8ad572e-d224-4044-a57d-f5a84c0dfe5d",
],
"ip": Array [
"10.128.0.57",
"fe80::9ced:8f1c:880b:3e1f",
"127.0.0.1",
"::1",
],
"name": Array [
"win2019-endpoint-mr-pedro",
],
"os": Object {
"family": Array [
"windows",
],
"name": Array [
"Windows",
],
},
},
"message": Array [
"Endpoint security event",
],
"process": Object {
"entity_id": Array [
"MWQxNWNmOWUtM2RjNy01Yjk3LWY1ODYtNzQzZjdjMjUxOGIyLTU4MC0xMzI1NTA3ODY2Ny45MTg5Njc1MDA=",
],
"executable": Array [
"C:\\\\Windows\\\\System32\\\\lsass.exe",
],
},
"timestamp": "2021-02-08T21:50:28.3377142Z",
"user": Object {
"domain": Array [
"NT AUTHORITY",
],
"name": Array [
"SYSTEM",
],
},
},
},
},
]
`);
});
it('sequence events', async () => {
const result = await parseEqlResponse(
@ -201,7 +467,282 @@ describe('Search Strategy EQL helper', () => {
},
sequenceResponse
);
expect(result.edges).toMatchInlineSnapshot(`Array []`);
expect(result.edges).toMatchInlineSnapshot(`
Array [
Object {
"cursor": Object {
"tiebreaker": null,
"value": "",
},
"node": Object {
"_id": "rBymg3cBX5UUcOOYP3Ec",
"_index": ".ds-logs-endpoint.events.security-default-2021.02.05-000005",
"data": Array [
Object {
"field": "@timestamp",
"value": Array [
"2021-02-08T21:50:28.3381013Z",
],
},
Object {
"field": "event.category",
"value": Array [],
},
Object {
"field": "host.name",
"value": Array [
"win2019-endpoint-mr-pedro",
],
},
Object {
"field": "message",
"value": Array [
"Endpoint security event",
],
},
],
"ecs": Object {
"@timestamp": Array [
"2021-02-08T21:50:28.3381013Z",
],
"_id": "rBymg3cBX5UUcOOYP3Ec",
"_index": ".ds-logs-endpoint.events.security-default-2021.02.05-000005",
"agent": Object {
"id": Array [
"1d15cf9e-3dc7-5b97-f586-743f7c2518b2",
],
"type": Array [
"endpoint",
],
},
"eql": Object {
"parentId": "rBymg3cBX5UUcOOYP3Ec",
"sequenceNumber": "2-0",
},
"event": Object {
"category": Array [],
"created": Array [
"2021-02-08T21:50:28.3381013Z",
],
"dataset": Array [
"endpoint.events.security",
],
"id": Array [
"LzzWB9jjGmCwGMvk++++FG/Q",
],
"kind": Array [
"event",
],
"module": Array [
"endpoint",
],
"type": Array [],
},
"host": Object {
"id": Array [
"d8ad572e-d224-4044-a57d-f5a84c0dfe5d",
],
"ip": Array [
"10.128.0.57",
"fe80::9ced:8f1c:880b:3e1f",
"127.0.0.1",
"::1",
],
"name": Array [
"win2019-endpoint-mr-pedro",
],
"os": Object {
"family": Array [
"windows",
],
"name": Array [
"Windows",
],
},
},
"message": Array [
"Endpoint security event",
],
"process": Object {
"entity_id": Array [
"MWQxNWNmOWUtM2RjNy01Yjk3LWY1ODYtNzQzZjdjMjUxOGIyLTU4MC0xMzI1NTA3ODY2Ny45MTg5Njc1MDA=",
],
"executable": Array [
"C:\\\\Windows\\\\System32\\\\lsass.exe",
],
},
"timestamp": "2021-02-08T21:50:28.3381013Z",
"user": Object {
"domain": Array [
"NT AUTHORITY",
],
"name": Array [
"SYSTEM",
],
},
},
},
},
Object {
"cursor": Object {
"tiebreaker": null,
"value": "",
},
"node": Object {
"_id": "pxymg3cBX5UUcOOYP3Ec",
"_index": ".ds-logs-endpoint.events.process-default-2021.02.02-000005",
"data": Array [
Object {
"field": "@timestamp",
"value": Array [
"2021-02-08T21:50:28.3446355Z",
],
},
Object {
"field": "event.action",
"value": Array [
"start",
],
},
Object {
"field": "event.category",
"value": Array [
"process",
],
},
Object {
"field": "host.name",
"value": Array [
"win2019-endpoint-mr-pedro",
],
},
Object {
"field": "message",
"value": Array [
"Endpoint process event",
],
},
],
"ecs": Object {
"@timestamp": Array [
"2021-02-08T21:50:28.3446355Z",
],
"_id": "pxymg3cBX5UUcOOYP3Ec",
"_index": ".ds-logs-endpoint.events.process-default-2021.02.02-000005",
"agent": Object {
"id": Array [
"1d15cf9e-3dc7-5b97-f586-743f7c2518b2",
],
"type": Array [
"endpoint",
],
},
"eql": Object {
"parentId": "rBymg3cBX5UUcOOYP3Ec",
"sequenceNumber": "2-1",
},
"event": Object {
"action": Array [
"start",
],
"category": Array [
"process",
],
"created": Array [
"2021-02-08T21:50:28.3446355Z",
],
"dataset": Array [
"endpoint.events.process",
],
"id": Array [
"LzzWB9jjGmCwGMvk++++FG/K",
],
"kind": Array [
"event",
],
"module": Array [
"endpoint",
],
"type": Array [
"start",
],
},
"host": Object {
"id": Array [
"d8ad572e-d224-4044-a57d-f5a84c0dfe5d",
],
"ip": Array [
"10.128.0.57",
"fe80::9ced:8f1c:880b:3e1f",
"127.0.0.1",
"::1",
],
"name": Array [
"win2019-endpoint-mr-pedro",
],
"os": Object {
"family": Array [
"windows",
],
"name": Array [
"Windows",
],
},
},
"message": Array [
"Endpoint process event",
],
"process": Object {
"args": Array [
"C:\\\\Program Files\\\\OpenSSH-Win64\\\\sshd.exe",
"-y",
],
"entity_id": Array [
"MWQxNWNmOWUtM2RjNy01Yjk3LWY1ODYtNzQzZjdjMjUxOGIyLTYzNjgtMTMyNTcyOTQ2MjguMzQ0NjM1NTAw",
],
"executable": Array [
"C:\\\\Program Files\\\\OpenSSH-Win64\\\\sshd.exe",
],
"hash": Object {
"md5": Array [
"331ba0e529810ef718dd3efbd1242302",
],
"sha1": Array [
"631244d731f406394c17c7dfd85203e317c74814",
],
"sha256": Array [
"e6a972f9db27de18be225095b3b3141b945be8aadc4014c8704ae5acafe3e8e0",
],
},
"name": Array [
"sshd.exe",
],
"parent": Object {
"name": Array [
"sshd.exe",
],
"pid": Array [
"5284",
],
},
"pid": Array [
"6368",
],
},
"timestamp": "2021-02-08T21:50:28.3446355Z",
"user": Object {
"domain": Array [
"",
],
"name": Array [
"",
],
},
},
},
},
]
`);
});
});
});