tenable_ot_security: change assets fingerprint to id plus timestamps by efd6 · Pull Request #17670 · elastic/integrations

efd6 · 2026-03-04T23:00:15Z

Proposed commit message

tenable_ot_security: change assets fingerprint to id plus timestamps

Change the assets document fingerprint from a full-body hash to a hash
of the asset id and all timestamp fields (firstSeen, lastSeen, lastHit,
lastSnapshot, lastUpdate, runStatusTime). This preserves update history;
a new document is created whenever a timestamp changes without the
duplicate-on-every-poll problem caused by the full-body hash.

Change the risk.total_risk field type from keyword to double. The field
carries a floating-point risk score and double is the correct type.
This type change also causes Fleet to trigger an automatic data stream
rollover on upgrade: the putMapping call fails with an
illegal_argument_exception when it tries to change the field type in
the existing backing index, and Fleet responds by rolling over. The
rollover starts the life-cycle clock on the old backing index so
duplicate documents from the _id scheme change age out without manual
intervention.

The Kibana version constraint is tightened to ^8.16.1 || ^9.1.4 so
that 9.x users see the breaking-change call-out. Where possible,
upgrading to 1.1.0 first and allowing at least one asset collection
interval before upgrading to 2.0.0 avoids the overlap period entirely.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

Depends tenable_ot_security: fix assets data stream stale cursor and timestamp #17669 (not to be merged before and only to be merged after reasonable interval)
Closes [tenable_ot_security.assets] Some assets are missing #17628

Screenshots

github-actions · 2026-03-04T23:02:18Z

✅ Vale Linting Results

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

elastic-vault-github-plugin-prod · 2026-03-04T23:23:05Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2026-03-10T09:59:09Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6 · 2026-03-12T03:47:46Z

@kcreddy I plan to sit on this for a while. Will convert to draft again until we are ready.

In draft

Change the assets document fingerprint from a full-body hash to a hash of the asset id and all timestamp fields (firstSeen, lastSeen, lastHit, lastSnapshot, lastUpdate, runStatusTime). This preserves update history — a new document is created whenever a timestamp changes — without the duplicate-on-every-poll problem caused by the full-body hash. This is a breaking change: the _id scheme change means every existing asset document will be duplicated until lifecycle policy removes the old versions. Customers upgrading from 1.0.0 should install 1.1.0 first and allow at least one successful asset collection interval before upgrading to this version. The kibana.version 9.0 constraint is removed; by requiring v9.1.4 or better, we ensure that those users will get a breaking change callout. The 8.19 users will not, but this is a trade off against not providing bug-fixes for them if we remove them from the constraint.

andrewkroh · 2026-03-31T05:25:24Z

+    - description: >-
+        The _id scheme change means every existing asset document will be
+        duplicated until lifecycle policy removes the old versions. Customers
+        upgrading from 1.0.0 should install 1.1.0 first and allow at least


I think we might have a problem with these instructions. It looks like on Serverless a user can only install latest if I'm understanding the UI.

This means that we need to leave this open for a while. I think that is a defect TBH.

kcreddy

Echoing same concern as Andrew, otherwise looks good.

andrewkroh · 2026-04-07T23:32:48Z

 conditions:
  kibana:
-    version: "^8.19.4 || ~9.0.7 || ^9.1.4"
+    version: "^8.19.4 || ^9.1.4"


Did you mean to modify the exchange package and the tenable_ot_security package?

efd6 · 2026-04-08T22:20:04Z

/test

elasticmachine · 2026-04-09T00:22:59Z

💚 Build Succeeded

Buildkite Build
Commit: 908d4f9

History

💔 Build #41109 failed e6fb903
💔 Build #41108 failed 4e8798f
💔 Build #41107 failed 8b9f932
💔 Build #41105 failed 8b9f932
💚 Build #41000 succeeded ff9be0d

cc @efd6

elastic-vault-github-plugin-prod · 2026-04-15T21:07:04Z

Package tenable_ot_security - 2.0.0 containing this change is available at https://epr.elastic.co/package/tenable_ot_security/2.0.0/

efd6 self-assigned this Mar 4, 2026

efd6 added enhancement New feature or request breaking change Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:tenable_ot_security Tenable OT Security labels Mar 4, 2026

efd6 force-pushed the 17628-tenable_ot_security-fingerprinting branch from 1e53601 to a243eca Compare March 4, 2026 23:00

efd6 force-pushed the 17628-tenable_ot_security-fingerprinting branch from a243eca to 9a03959 Compare March 5, 2026 06:40

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Mar 5, 2026

efd6 mentioned this pull request Mar 9, 2026

tenable_ot_security: fix assets data stream stale cursor and timestamp #17669

Merged

5 tasks

efd6 force-pushed the 17628-tenable_ot_security-fingerprinting branch 3 times, most recently from 991695c to 80b6359 Compare March 10, 2026 09:58

efd6 marked this pull request as ready for review March 10, 2026 09:59

efd6 requested a review from a team as a code owner March 10, 2026 09:59

kcreddy previously approved these changes Mar 12, 2026

View reviewed changes

efd6 marked this pull request as draft March 12, 2026 03:47

andrewkroh removed the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Mar 15, 2026

efd6 force-pushed the 17628-tenable_ot_security-fingerprinting branch from 80b6359 to 1112533 Compare March 31, 2026 02:17

efd6 marked this pull request as ready for review March 31, 2026 03:21

efd6 requested review from andrewkroh and kcreddy March 31, 2026 03:22

andrewkroh reviewed Mar 31, 2026

View reviewed changes

andrewkroh added the Integration:microsoft_exchange_online_message_trac Microsoft Exchange Online Message Trace label Apr 1, 2026

kcreddy approved these changes Apr 6, 2026

View reviewed changes

github-actions Bot mentioned this pull request Apr 6, 2026

[newbie-contributor] New contributor docs review — elastic-package install step omits required cd #18232

Closed

3 tasks

andrewkroh reviewed Apr 7, 2026

View reviewed changes

address pr comment

ff9be0d

andrewkroh removed the Integration:microsoft_exchange_online_message_trac Microsoft Exchange Online Message Trace label Apr 8, 2026

efd6 requested a review from andrewkroh April 8, 2026 21:41

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Apr 8, 2026

efd6 force-pushed the 17628-tenable_ot_security-fingerprinting branch 3 times, most recently from e6fb903 to 15143ea Compare April 8, 2026 23:49

macroscopeapp Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread packages/tenable_ot_security/data_stream/assets/elasticsearch/ingest_pipeline/default.yml

force roll-over on upgrade to 2.0.0

908d4f9

efd6 force-pushed the 17628-tenable_ot_security-fingerprinting branch from 15143ea to 908d4f9 Compare April 8, 2026 23:58

andrewkroh approved these changes Apr 15, 2026

View reviewed changes

efd6 merged commit 0af6f81 into elastic:main Apr 15, 2026
13 checks passed

github-actions Bot mentioned this pull request Apr 16, 2026

[breaking-change] Undocumented breaking changes detected (2026-04-16) #18431

Open

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tenable_ot_security: change assets fingerprint to id plus timestamps#17670

tenable_ot_security: change assets fingerprint to id plus timestamps#17670
efd6 merged 3 commits intoelastic:mainfrom
efd6:17628-tenable_ot_security-fingerprinting

efd6 commented Mar 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

elastic-vault-github-plugin-prod Bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

elasticmachine commented Mar 10, 2026

Uh oh!

efd6 commented Mar 12, 2026

Uh oh!

andrewkroh Mar 31, 2026

Uh oh!

efd6 Apr 6, 2026

Uh oh!

kcreddy left a comment

Uh oh!

andrewkroh Apr 7, 2026

Uh oh!

efd6 commented Apr 8, 2026

Uh oh!

Uh oh!

elasticmachine commented Apr 9, 2026

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

efd6 commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

github-actions Bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Vale Linting Results

Uh oh!

elastic-vault-github-plugin-prod Bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Uh oh!

elasticmachine commented Mar 10, 2026

Uh oh!

efd6 commented Mar 12, 2026

Uh oh!

andrewkroh Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

efd6 Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

andrewkroh Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

efd6 commented Apr 8, 2026

Uh oh!

Uh oh!

elasticmachine commented Apr 9, 2026

💚 Build Succeeded

History

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

efd6 commented Mar 4, 2026 •

edited

Loading

github-actions Bot commented Mar 4, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Mar 4, 2026 •

edited

Loading