Adding the user that initiated a task on the task log entry about redelk HOT 3 CLOSED

I like the idea. We never had need for filtering down per user, but I guess it depends on workflow. And to be fair, it is really easy to filter the operator's name in the input line.

Im not sure about tying it to the input line as well. There is a reason that with CS we nowhere connect input with task or outputs: in our experience corner case such as you mention above actually do happen and happen more than we like to, including the situation when filebeat-logstash play catch up and ES hasnt stored the data yet. This results in parsing errors and overal lesser usability.

Now if you know a way to make this 100% working correctly that would be great! If not, I still happily accept your PR for filtering the operator name in the input name.

I kindly ask you to develop against maindev branch. That branch will be version 2 of RedELK and has significant changes incl ES upgrade, renamed fields, neo4j and jupyter integration, etc. Should be stable enough for you start devving against in a few weeks time.

from redelk.

I'm currently investigating the sleep plugin to see if logstash can wait for a small amount of time for the input line to be processed before the input line.
I'll test it for a while and if it's reliable I'll add it as a PR.

FYI I'm using RedELK with the latest version of ELK, I just needed to make some small changes in fields used by filebeat.

from redelk.

Im closing this right now. I've added a registration of the name of the red team operator per input in commit 3216a8f

Feel free to reopen when you feel differently.

from redelk.