-
Notifications
You must be signed in to change notification settings - Fork 419
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
cisco_{asa,ftd}: harmonise pipelines #4380
Conversation
7e2c254
to
44243a4
Compare
🚀 Benchmarks reportPackage
|
Data stream | Previous EPS | New EPS | Diff (%) | Result |
---|---|---|---|---|
log |
292.91 | 244.56 | -48.35 (-16.51%) | 💔 |
To see the full report comment with /test benchmark fullreport
🌐 Coverage report
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
This brings the cisco_asa and cisco_ftd ingest pipelines more into agreement though parts dealing with ECS categorisation remain distinct. The changes in cisco_asa do not affect test outcomes and are for the most part cosmetic to reduce diff noise in future changes. It does add the malware event kind classification that exists in cisco_ftd. The changes in cisco_ftd fix incorrect handling of: - network.inner/cisco.ftd.tunnel_type fields - 305012 events. And add the network.community_id field to events.
44243a4
to
25ed220
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, only minor complaint is that the test file name test-ftd-fix.log
is a little vague, but it's easy enough to look up the git commit to see what the fix is.
@taylor-swanson Yeah, I was following the existing naming convention. I'm happy to change it if you would like. |
If you think of a good, short descriptive file name, go for it, otherwise I'm fine with it as-is. |
I'll leave it as is. |
What does this PR do?
This brings the cisco_asa and cisco_ftd ingest pipelines more into agreement though parts dealing with ECS categorisation remain distinct.
The changes in cisco_asa do not affect test outcomes and are for the most part cosmetic to reduce diff noise in future changes. It does add the malware event kind classification that exists in cisco_ftd.
The changes in cisco_ftd fix incorrect handling of:
And add the network.community_id field to events.
Checklist
changelog.yml
file.Author's Checklist
How to test this PR locally
Related issues
Screenshots