Fix powerhsell context info value split (elastic#11938)

Alphayeeeet · Dec 2, 2024 · 3b41c93 · 3b41c93
1 parent 99419ce
commit 3b41c93
Show file tree

Hide file tree

Showing 6 changed files with 12 additions and 7 deletions.
diff --git a/packages/windows/changelog.yml b/packages/windows/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.3.2"
+  changes:
+    - description: Fix powerhsell context info value split.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/11938
 - version: "2.3.1"
   changes:
     - description: Fix improper parsing of Path for Windows Defender, add more winlog fields

diff --git a/...es/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml b/...es/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml
@@ -8,7 +8,7 @@ processors:
       field_split: "\n"
       trim_key: " \n\t"
       trim_value: " \n\t"
-      value_split: "="
+      value_split: "[:=]"
       if: ctx?.winlog?.event_id == "4103"
   - script:
       description: Remove spaces from all event_data keys.

diff --git a/packages/windows/data_stream/powershell_operational/_dev/test/pipeline/test-events.json b/packages/windows/data_stream/powershell_operational/_dev/test/pipeline/test-events.json
@@ -49,7 +49,7 @@
                 "version": 1,
                 "event_data": {
                     "Payload": "CommandInvocation(cmd.exe): \"cmd.exe\"\nCommandInvocation(Out-Null): \"Out-Null\"\nParameterBinding(Out-Null): name=\"InputObject\"; value=\"symbolic link created for C:\\vagrant \u003c\u003c===\u003e\u003e \\\\vboxsvr\\vagrant\"",
-                    "ContextInfo": "        Severity = Informational\n        Host Name = ServerRemoteHost\n        Host Version = 1.0.0.0\n        Host ID = ed57761b-ba0f-4d11-87d9-fac33820d20e\n        Host Application = C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n        Engine Version = 5.1.17763.1007\n        Runspace ID = 0729459a-8646-4176-8b02-024421a9632e\n        Pipeline ID = 1\n        Command Name = cmd.exe\n        Command Type = Application\n        Script Name =\n        Command Path = C:\\Windows\\system32\\cmd.exe\n        Sequence Number = 34\n        User = VAGRANT\\vagrant\n        Connected User = VAGRANT\\vagrant\n        Shell ID = Microsoft.PowerShell"
+                    "ContextInfo": "        Severity : Informational\n        Host Name : ServerRemoteHost\n        Host Version : 1.0.0.0\n        Host ID : ed57761b-ba0f-4d11-87d9-fac33820d20e\n        Host Application = C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n        Engine Version = 5.1.17763.1007\n        Runspace ID = 0729459a-8646-4176-8b02-024421a9632e\n        Pipeline ID = 1\n        Command Name = cmd.exe\n        Command Type = Application\n        Script Name =\n        Command Path = C:\\Windows\\system32\\cmd.exe\n        Sequence Number = 34\n        User = VAGRANT\\vagrant\n        Connected User = VAGRANT\\vagrant\n        Shell ID = Microsoft.PowerShell"
                 },
                 "channel": "Microsoft-Windows-PowerShell/Operational",
                 "event_id": "4103",
@@ -77,7 +77,7 @@
                 "level": "information"
             },
             "event": {
-                "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4103\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e106\u003c/Task\u003e\u003cOpcode\u003e20\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-15T08:11:47.897949500Z'/\u003e\u003cEventRecordID\u003e3885\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{1aca0717-2acb-0002-c208-ca1acb2ad601}'/\u003e\u003cExecution ProcessID='3984' ThreadID='3616'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ContextInfo'\u003e        Severity = Informational\n        Host Name = ServerRemoteHost\n        Host Version = 1.0.0.0\n        Host ID = ed57761b-ba0f-4d11-87d9-fac33820d20e\n        Host Application = C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n        Engine Version = 5.1.17763.1007\n        Runspace ID = 0729459a-8646-4176-8b02-024421a9632e\n        Pipeline ID = 1\n        Command Name = cmd.exe\n        Command Type = Application\n        Script Name =\n        Command Path = C:\\Windows\\system32\\cmd.exe\n        Sequence Number = 34\n        User = VAGRANT\\vagrant\n        Connected User = VAGRANT\\vagrant\n        Shell ID = Microsoft.PowerShell\n\u003c/Data\u003e\u003cData Name='UserData'\u003e\u003c/Data\u003e\u003cData Name='Payload'\u003eCommandInvocation(cmd.exe): \"cmd.exe\"\nCommandInvocation(Out-Null): \"Out-Null\"\nParameterBinding(Out-Null): name=\"InputObject\"; value=\"symbolic link created for C:\\vagrant \u0026lt;\u0026lt;===\u0026gt;\u0026gt; \\\\vboxsvr\\vagrant\"\n\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e\n\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4103\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e106\u003c/Task\u003e\u003cOpcode\u003e20\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-15T08:13:06.703293900Z'/\u003e\u003cEventRecordID\u003e3917\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{1aca0717-2acb-0003-db0b-ca1acb2ad601}'/\u003e\u003cExecution ProcessID='5032' ThreadID='4160'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ContextInfo'\u003e        Severity = Informational\n        Host Name = ConsoleHost\n        Host Version = 5.1.17763.1007\n        Host ID = aae5217d-054f-435f-9968-4b5bebf12116\n        Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -noexit -command 'C:\\Gopath\\src\\github.com\\elastic\\beats'\n        Engine Version = 5.1.17763.1007\n        Runspace ID = a87e8389-57c7-4997-95ff-f82f644965bf\n        Pipeline ID = 9\n        Command Name = Resolve-Path\n        Command Type = Cmdlet\n        Script Name =\n        Command Path =\n        Sequence Number = 22\n        User = VAGRANT\\vagrant\n        Connected User =\n        Shell ID = Microsoft.PowerShell\n\u003c/Data\u003e\u003cData Name='UserData'\u003e\u003c/Data\u003e\u003cData Name='Payload'\u003eCommandInvocation(Resolve-Path): \"Resolve-Path\"\nParameterBinding(Resolve-Path): name=\"ErrorAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"WarningAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"InformationAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"Verbose\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Debug\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Path\"; value=\"C:\\Gopath\\src\\github.com\\elastic\\beats\\x*\"\n\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e",
+                "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4103\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e106\u003c/Task\u003e\u003cOpcode\u003e20\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-15T08:11:47.897949500Z'/\u003e\u003cEventRecordID\u003e3885\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{1aca0717-2acb-0002-c208-ca1acb2ad601}'/\u003e\u003cExecution ProcessID='3984' ThreadID='3616'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ContextInfo'\u003e        Severity : Informational\n        Host Name : ServerRemoteHost\n        Host Version : 1.0.0.0\n        Host ID : ed57761b-ba0f-4d11-87d9-fac33820d20e\n        Host Application = C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n        Engine Version = 5.1.17763.1007\n        Runspace ID = 0729459a-8646-4176-8b02-024421a9632e\n        Pipeline ID = 1\n        Command Name = cmd.exe\n        Command Type = Application\n        Script Name =\n        Command Path = C:\\Windows\\system32\\cmd.exe\n        Sequence Number = 34\n        User = VAGRANT\\vagrant\n        Connected User = VAGRANT\\vagrant\n        Shell ID = Microsoft.PowerShell\n\u003c/Data\u003e\u003cData Name='UserData'\u003e\u003c/Data\u003e\u003cData Name='Payload'\u003eCommandInvocation(cmd.exe): \"cmd.exe\"\nCommandInvocation(Out-Null): \"Out-Null\"\nParameterBinding(Out-Null): name=\"InputObject\"; value=\"symbolic link created for C:\\vagrant \u0026lt;\u0026lt;===\u0026gt;\u0026gt; \\\\vboxsvr\\vagrant\"\n\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e\n\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4103\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e106\u003c/Task\u003e\u003cOpcode\u003e20\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-15T08:13:06.703293900Z'/\u003e\u003cEventRecordID\u003e3917\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{1aca0717-2acb-0003-db0b-ca1acb2ad601}'/\u003e\u003cExecution ProcessID='5032' ThreadID='4160'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ContextInfo'\u003e        Severity = Informational\n        Host Name = ConsoleHost\n        Host Version = 5.1.17763.1007\n        Host ID = aae5217d-054f-435f-9968-4b5bebf12116\n        Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -noexit -command 'C:\\Gopath\\src\\github.com\\elastic\\beats'\n        Engine Version = 5.1.17763.1007\n        Runspace ID = a87e8389-57c7-4997-95ff-f82f644965bf\n        Pipeline ID = 9\n        Command Name = Resolve-Path\n        Command Type = Cmdlet\n        Script Name =\n        Command Path =\n        Sequence Number = 22\n        User = VAGRANT\\vagrant\n        Connected User =\n        Shell ID = Microsoft.PowerShell\n\u003c/Data\u003e\u003cData Name='UserData'\u003e\u003c/Data\u003e\u003cData Name='Payload'\u003eCommandInvocation(Resolve-Path): \"Resolve-Path\"\nParameterBinding(Resolve-Path): name=\"ErrorAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"WarningAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"InformationAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"Verbose\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Debug\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Path\"; value=\"C:\\Gopath\\src\\github.com\\elastic\\beats\\x*\"\n\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e",
                 "code": "4103",
                 "kind": "event",
                 "provider": "Microsoft-Windows-PowerShell"

diff --git a/...dows/data_stream/powershell_operational/_dev/test/pipeline/test-events.json-expected.json b/...dows/data_stream/powershell_operational/_dev/test/pipeline/test-events.json-expected.json
@@ -72,7 +72,7 @@
                 ],
                 "code": "4103",
                 "kind": "event",
-                "original": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/><EventID>4103</EventID><Version>1</Version><Level>4</Level><Task>106</Task><Opcode>20</Opcode><Keywords>0x0</Keywords><TimeCreated SystemTime='2020-05-15T08:11:47.897949500Z'/><EventRecordID>3885</EventRecordID><Correlation ActivityID='{1aca0717-2acb-0002-c208-ca1acb2ad601}'/><Execution ProcessID='3984' ThreadID='3616'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>vagrant</Computer><Security UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/></System><EventData><Data Name='ContextInfo'>        Severity = Informational\n        Host Name = ServerRemoteHost\n        Host Version = 1.0.0.0\n        Host ID = ed57761b-ba0f-4d11-87d9-fac33820d20e\n        Host Application = C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n        Engine Version = 5.1.17763.1007\n        Runspace ID = 0729459a-8646-4176-8b02-024421a9632e\n        Pipeline ID = 1\n        Command Name = cmd.exe\n        Command Type = Application\n        Script Name =\n        Command Path = C:\\Windows\\system32\\cmd.exe\n        Sequence Number = 34\n        User = VAGRANT\\vagrant\n        Connected User = VAGRANT\\vagrant\n        Shell ID = Microsoft.PowerShell\n</Data><Data Name='UserData'></Data><Data Name='Payload'>CommandInvocation(cmd.exe): \"cmd.exe\"\nCommandInvocation(Out-Null): \"Out-Null\"\nParameterBinding(Out-Null): name=\"InputObject\"; value=\"symbolic link created for C:\\vagrant &lt;&lt;===&gt;&gt; \\\\vboxsvr\\vagrant\"\n</Data></EventData></Event>\n<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/><EventID>4103</EventID><Version>1</Version><Level>4</Level><Task>106</Task><Opcode>20</Opcode><Keywords>0x0</Keywords><TimeCreated SystemTime='2020-05-15T08:13:06.703293900Z'/><EventRecordID>3917</EventRecordID><Correlation ActivityID='{1aca0717-2acb-0003-db0b-ca1acb2ad601}'/><Execution ProcessID='5032' ThreadID='4160'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>vagrant</Computer><Security UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/></System><EventData><Data Name='ContextInfo'>        Severity = Informational\n        Host Name = ConsoleHost\n        Host Version = 5.1.17763.1007\n        Host ID = aae5217d-054f-435f-9968-4b5bebf12116\n        Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -noexit -command 'C:\\Gopath\\src\\github.com\\elastic\\beats'\n        Engine Version = 5.1.17763.1007\n        Runspace ID = a87e8389-57c7-4997-95ff-f82f644965bf\n        Pipeline ID = 9\n        Command Name = Resolve-Path\n        Command Type = Cmdlet\n        Script Name =\n        Command Path =\n        Sequence Number = 22\n        User = VAGRANT\\vagrant\n        Connected User =\n        Shell ID = Microsoft.PowerShell\n</Data><Data Name='UserData'></Data><Data Name='Payload'>CommandInvocation(Resolve-Path): \"Resolve-Path\"\nParameterBinding(Resolve-Path): name=\"ErrorAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"WarningAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"InformationAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"Verbose\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Debug\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Path\"; value=\"C:\\Gopath\\src\\github.com\\elastic\\beats\\x*\"\n</Data></EventData></Event>",
+                "original": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/><EventID>4103</EventID><Version>1</Version><Level>4</Level><Task>106</Task><Opcode>20</Opcode><Keywords>0x0</Keywords><TimeCreated SystemTime='2020-05-15T08:11:47.897949500Z'/><EventRecordID>3885</EventRecordID><Correlation ActivityID='{1aca0717-2acb-0002-c208-ca1acb2ad601}'/><Execution ProcessID='3984' ThreadID='3616'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>vagrant</Computer><Security UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/></System><EventData><Data Name='ContextInfo'>        Severity : Informational\n        Host Name : ServerRemoteHost\n        Host Version : 1.0.0.0\n        Host ID : ed57761b-ba0f-4d11-87d9-fac33820d20e\n        Host Application = C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n        Engine Version = 5.1.17763.1007\n        Runspace ID = 0729459a-8646-4176-8b02-024421a9632e\n        Pipeline ID = 1\n        Command Name = cmd.exe\n        Command Type = Application\n        Script Name =\n        Command Path = C:\\Windows\\system32\\cmd.exe\n        Sequence Number = 34\n        User = VAGRANT\\vagrant\n        Connected User = VAGRANT\\vagrant\n        Shell ID = Microsoft.PowerShell\n</Data><Data Name='UserData'></Data><Data Name='Payload'>CommandInvocation(cmd.exe): \"cmd.exe\"\nCommandInvocation(Out-Null): \"Out-Null\"\nParameterBinding(Out-Null): name=\"InputObject\"; value=\"symbolic link created for C:\\vagrant &lt;&lt;===&gt;&gt; \\\\vboxsvr\\vagrant\"\n</Data></EventData></Event>\n<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/><EventID>4103</EventID><Version>1</Version><Level>4</Level><Task>106</Task><Opcode>20</Opcode><Keywords>0x0</Keywords><TimeCreated SystemTime='2020-05-15T08:13:06.703293900Z'/><EventRecordID>3917</EventRecordID><Correlation ActivityID='{1aca0717-2acb-0003-db0b-ca1acb2ad601}'/><Execution ProcessID='5032' ThreadID='4160'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>vagrant</Computer><Security UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/></System><EventData><Data Name='ContextInfo'>        Severity = Informational\n        Host Name = ConsoleHost\n        Host Version = 5.1.17763.1007\n        Host ID = aae5217d-054f-435f-9968-4b5bebf12116\n        Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -noexit -command 'C:\\Gopath\\src\\github.com\\elastic\\beats'\n        Engine Version = 5.1.17763.1007\n        Runspace ID = a87e8389-57c7-4997-95ff-f82f644965bf\n        Pipeline ID = 9\n        Command Name = Resolve-Path\n        Command Type = Cmdlet\n        Script Name =\n        Command Path =\n        Sequence Number = 22\n        User = VAGRANT\\vagrant\n        Connected User =\n        Shell ID = Microsoft.PowerShell\n</Data><Data Name='UserData'></Data><Data Name='Payload'>CommandInvocation(Resolve-Path): \"Resolve-Path\"\nParameterBinding(Resolve-Path): name=\"ErrorAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"WarningAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"InformationAction\"; value=\"Ignore\"\nParameterBinding(Resolve-Path): name=\"Verbose\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Debug\"; value=\"False\"\nParameterBinding(Resolve-Path): name=\"Path\"; value=\"C:\\Gopath\\src\\github.com\\elastic\\beats\\x*\"\n</Data></EventData></Event>",
                 "provider": "Microsoft-Windows-PowerShell",
                 "sequence": 34,
                 "type": [
@@ -458,4 +458,4 @@
             }
         }
     ]
-}
+}
diff --git a/...ages/windows/data_stream/powershell_operational/elasticsearch/ingest_pipeline/default.yml b/...ages/windows/data_stream/powershell_operational/elasticsearch/ingest_pipeline/default.yml
@@ -8,7 +8,7 @@ processors:
       field_split: "\n"
       trim_key: " \n\t"
       trim_value: " \n\t"
-      value_split: "="
+      value_split: "[:=]"
       if: ctx?.winlog?.event_id == "4103"
   - script:
       description: Remove spaces from all event_data keys.

diff --git a/packages/windows/manifest.yml b/packages/windows/manifest.yml
@@ -1,6 +1,6 @@
 name: windows
 title: Windows
-version: 2.3.1
+version: 2.3.2
 description: Collect logs and metrics from Windows OS and services with Elastic Agent.
 type: integration
 categories: