Dan Kortschak

multiple spurious window events logged on mac after updating to monterey 12.2

3

- [x] I am on the [latest](https://github.com/ActivityWatch/activitywatch/releases/latest) ActivityWatch version. - [x] I have searched the issues of this repo and believe that this is not a duplicate. - **OS name...

packetbeat: clean up and add docs

2

## What does this PR do? This improves the documentation of the code in some of packetbeat's internals and improves the source locality of code. Some lint and code clean...

auditbeat,filebeat,packetbeat: format mac addresses according to ECS

2

## What does this PR do? This changes MAC address formatting to conform to the ECS specification. ## Why is it important? Currently MAC addresses are formatted in Go code...

libbeat/processors/util: GetNetInfo formats hardware addresses incorrectly.

1

`GetNetInfo` currently formats hardware addresses using the standard library's String method for the `net.HardwareAddr` type (lower case hex octets separated by colons) which does not conform the ECS spec ([upper...

auditbeat,filebeat,packetbeat: mac addresses are not formatted according to ECS

1

In a number of places in {auditbeat,filebeat,packetbeat}, the stdlib `net.HardwareAddr` `String` method is used to format MAC addresses. The format used by the standard library uses lowercase octets separated by...

libbeat/processors/util: make mac address rendering conform to ECS

6

## What does this PR do? This alters the syntax of hardware addresses to match the syntax that is [specified in ECS](https://www.elastic.co/guide/en/ecs/current/ecs-host.html#field-host-mac). ## Why is it important? Currently it does...

auditbeat/module/file_integrity: add file parsing processor

25

## What does this PR do? This adds a file parser and analyser framework along the lines of the approach described in elastic/beats#18048. The processor allows inspection of files visited...

packetbeat/decoder: reset multilayer decoding layers for each sniffed packet

3

The current logic for multilayer use means that sucessive packets in the stream from the sniffer can end up as parts of the multilayer although they are not related layers....

x-pack/filebeat/input/cel: new input

11

WIP ## What does this PR do? This adds a new input to filebeat that allows processing of datastreams using the Common Expression Language. ## Why is it important? It...

[Question]: Apply global indentation rules

7

Say I have an input like ``` root1: - element1 - element2 root2: - element3 root3: - element4 ``` and I want to canonicalise the indentation to some defined standard,...