Prepare for 0.72.1 patch release #3470
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Since we no longer add the Sigma prefix by default to artifacts imported via `Server.Import.CuratedSigma` this filter will just confuse users.
Also: * fixed Demo.Plugins.GUI artifact as monitoring() plugin now requires client id parameter. * removed dead code in expand.go * keep building the initial notebook even if some of the cells failed. Otherwise the notebook will be half built and subsequent cells are lost. * Updated docs and config file references.
- CuratedSigma artifact can now import multiple sources - Improved the react-select component's appearance in all themes. Change also to it's behaviour so that it closes after each selection because if it stays open then it overlays the parameter control below it, which is particularly confusing when only 1 item remains to be selected in the list. --------- Co-authored-by: Mike Cohen <mike@velocidex.com>
I discovered that the `last_seen_at` parameter of the client_create
function doesn't seem to be implemented. This is my attempt to make it
work but it's still not working.
When I run
```sql
SELECT client_create(
hostname="windozer",
client_id="C.COJPAN59O9KJ1",
os="windows",
first_seen_at=timestamp(epoch=now() - 3600),
last_seen_at=timestamp(epoch=now()),
mac_addresses=["b8:ee:65:7c:0d:ff"],
labels=["lab","test"])
FROM scope()
```
it does return the client information with the correct `last_seen_at`
value (which it didn't do before this change).
But when I run
```sql
SELECT client_info(client_id="C.COJPAN59O9KJ1") FROM scope()
```
then the `last_seen_at` value is 0.
I've tried mirroring the code for `first_seen_at` but I can't see what
else needs to change to make this work.
ps. I might have messed up the protobuf stuff. I only needed the 1
change to vql.proto but when I ran `./make_proto.sh` it unexpectedly
made a lot of changes to all the .pb.go files.
---------
Co-authored-by: Mike Cohen <mike@velocidex.com>
This caused the dashboard to render the entire data set instead of last two hours only
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.