-
Notifications
You must be signed in to change notification settings - Fork 392
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
crowdstrike/fdr: Prevent ingesting documents without @timestamp
#3484
crowdstrike/fdr: Prevent ingesting documents without @timestamp
#3484
Conversation
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
🌐 Coverage report
|
packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
"@timestamp": "2022-06-08T10:59:53.840983900Z", | ||
"crowdstrike": { | ||
"AgentLoadFlags": "0", | ||
"AgentLocalTime": "2021-11-09T05:47:19.952Z", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Did you consider using AgentLocalTime
?
I think Time
could also be considered (probably before the _ingest.timestamp). That is supposed to be the timestamp of when the event was received by CrowdStrike cloud. (docs are hard to come by and I don't know what type of event this is, but I'm looking at this page)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks. For now I used AgentLocalTime. This covers all our samples.
In some cases, FDR documents can lack the `@timestamp` field due to missing timestamp source fields (`timestamp`/`CreationTimestamp`). This adds support for the `UTCTimestamp` field and also adds a last-chance processor to set `@timestamp` to the ingest timestamp in case all fields are missing.
What does this PR do?
In some cases, FDR documents can lack the
@timestamp
field due tomissing timestamp source fields (
timestamp
/CreationTimestamp
).This adds support for the
UTCTimestamp
field and also adds alast-chance processor to set
@timestamp
to the ingest timestamp incase all fields are missing.
Checklist
changelog.yml
file.