ti_otx: append hashes and IPs to related.* (#8323)

elastic · Dec 5, 2023 · cc5e245 · cc5e245
1 parent f3eef11
commit cc5e245
Show file tree

Hide file tree

Showing 7 changed files with 419 additions and 1 deletion.
diff --git a/packages/ti_otx/changelog.yml b/packages/ti_otx/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.23.0"
+  changes:
+    - description: Append hash and IP values to related.* fields
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/8323
 - version: "1.22.0"
   changes:
     - description: Limit request tracer log count to five.

diff --git a/...i_otx/data_stream/threat/_dev/test/pipeline/test-otx-no-preserve-ndjson.log-expected.json b/...i_otx/data_stream/threat/_dev/test/pipeline/test-otx-no-preserve-ndjson.log-expected.json
@@ -14,6 +14,11 @@
                 ]
             },
             "otx": {},
+            "related": {
+                "ip": [
+                    "89.160.20.156"
+                ]
+            },
             "threat": {
                 "indicator": {
                     "ip": "89.160.20.156",
@@ -38,6 +43,11 @@
                 "description": "MD5 of a5725af4391d21a232dc6d4ad33d7d915bd190bdac9b1826b73f364dc5c1aa65",
                 "title": "Win32:Hoblig-B"
             },
+            "related": {
+                "hash": [
+                    "90421f8531f963d81cf54245b72cde80"
+                ]
+            },
             "threat": {
                 "indicator": {
                     "file": {
@@ -86,6 +96,11 @@
                 ]
             },
             "otx": {},
+            "related": {
+                "ip": [
+                    "89.160.20.156"
+                ]
+            },
             "threat": {
                 "indicator": {
                     "ip": "89.160.20.156",
@@ -107,6 +122,11 @@
                 ]
             },
             "otx": {},
+            "related": {
+                "hash": [
+                    "d8c70ca70fd3555a0828fede6cc1f59e2c320ede80157039b6a2f09c336d5f7a"
+                ]
+            },
             "threat": {
                 "indicator": {
                     "file": {
@@ -134,6 +154,11 @@
             "otx": {
                 "description": "MD5 of df9b37477a83189cd4541674e64ce29bf7bf98338ed0d635276660e0c6419d09"
             },
+            "related": {
+                "hash": [
+                    "f8e58af3ffefd4037fef246e93a55dc8"
+                ]
+            },
             "threat": {
                 "indicator": {
                     "file": {