[O365] updating o365 ECS version and adding event.original options #1117
Conversation
P1llus
added
enhancement
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
Trends 🧪 |
| target: '_conf.tenants' | ||
| fields: | ||
| mappings: | ||
| {{#if processors}} |
There was a problem hiding this comment.
I think this condition needs to be a bit different, because if I understand it correctly you want to have processors: if any of tenant_names or processors are set. As it is now it will always require to have tenant_names set or processors will be ignored.
There was a problem hiding this comment.
Good catch, totally missed the encapsulated IF statement there
There was a problem hiding this comment.
Can you check if this new commit fixes it @marc-gr ? I needed to check for processors twice, once to add it if there is no tenant names, and another to always add the actual processors at the bottom.
…lastic#1117) * updating o365 ECS version and adding event.original options * add changelog and linting * update config
…lastic#1117) * updating o365 ECS version and adding event.original options * add changelog and linting * update config
What does this PR do?
Updates package ECS version to 1.10.
Sync module changes to packages if any.
Adds Preserve Raw event functionality if not already exists.
Adds pipeline tests if missing.
Adds missing tags + moving tags to advanced settings.
Adds possibility to add custom processors.
Checklist
changelog.ymlfile.manifest.ymlfile to point to the latest Elastic stack release (e.g.^7.13.0).Related issues