-
Notifications
You must be signed in to change notification settings - Fork 419
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fortinet_fortiedr: new package for Fortinet FortiEDR ingestion #4070
Conversation
🌐 Coverage report
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as |
@@ -0,0 +1,3 @@ | |||
dependencies: | |||
ecs: | |||
reference: git@v8.3.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shall we bump this one?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done
field: message | ||
target_field: event.original | ||
ignore_missing: true | ||
ignore_failure: true |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Any reason for needing ignore_failure
? We usually don't want to have that unless absolutely necessary
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Removed
- name: rsa_fields | ||
type: bool | ||
title: Add non-ECS fields | ||
required: false | ||
show_user: true | ||
default: true | ||
- name: keep_raw_fields | ||
type: bool | ||
title: Keep raw parser fields | ||
required: false | ||
show_user: false | ||
default: false |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are these maybe from older package?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, these were residual in fortinet_fortimanager. I'll drop them.
license: basic | ||
categories: ["security"] | ||
conditions: | ||
kibana.version: "^7.14.1 || ^8.0.0" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We could bump this to 7.17 maybe? Don't know how far back we want to support this, up to @jamiehynds
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@P1llus sounds good - supporting 7.17 or later is what we've done with most other new integrations so best to bump FortiEDR to 7.17 too.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done
🚀 Benchmarks reportTo see the full report comment with |
@efd6 I'm a day late and a dollar short, but Fortinet have just provided me with an NFR license for FortiEDR. If it's still of use for integration testing, I can provide the details. |
@jamiehynds Thanks. That will be useful for the dashboard. |
What does this PR do?
This adds a package for Fortinet FortiEDR ingestion.
Checklist
changelog.yml
file.Author's Checklist
How to test this PR locally
Related issues
Screenshots