fortinet_fortiedr: new package for Fortinet FortiEDR ingestion #4070

efd6 · 2022-08-26T07:33:28Z

What does this PR do?

This adds a package for Fortinet FortiEDR ingestion.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

[ ]

How to test this PR locally

Related issues

For Fortinet FortiEDR #1190

Screenshots

elasticmachine · 2022-08-26T07:36:37Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-10-26T21:40:49.919+0000
Duration: 17 min 15 sec

Test stats 🧪

Test	Results
Failed	0
Passed	7
Skipped	0
Total	7

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

Test case obtained from https://help.fortinet.com/fsiem/5-2-6_ESCG_HTML/FortiSIEM/ESCG/Fortinet_FortiEDR.htm

elasticmachine · 2022-08-26T08:02:09Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`1/1`)	💚
Files	100.0% (`1/1`)	💚 2.488
Classes	100.0% (`1/1`)	💚 2.488
Methods	100.0% (`12/12`)	💚 9.445
Lines	95.349% (`205/215`)	👍 3.779
Conditionals	100.0% (`0/0`)	💚

elasticmachine · 2022-08-26T08:03:45Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

botelastic · 2022-10-22T23:02:23Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

P1llus · 2022-10-26T08:08:14Z

packages/fortinet_fortiedr/_dev/build/build.yml

@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: git@v8.3.0


Shall we bump this one?

P1llus · 2022-10-26T08:13:36Z

packages/fortinet_fortiedr/data_stream/log/elasticsearch/ingest_pipeline/default.yml

+      field: message
+      target_field: event.original
+      ignore_missing: true
+      ignore_failure: true


Any reason for needing ignore_failure? We usually don't want to have that unless absolutely necessary

P1llus · 2022-10-26T08:19:44Z

packages/fortinet_fortiedr/data_stream/log/manifest.yml

+      - name: rsa_fields
+        type: bool
+        title: Add non-ECS fields
+        required: false
+        show_user: true
+        default: true
+      - name: keep_raw_fields
+        type: bool
+        title: Keep raw parser fields
+        required: false
+        show_user: false
+        default: false


Are these maybe from older package?

Yeah, these were residual in fortinet_fortimanager. I'll drop them.

P1llus · 2022-10-26T08:20:22Z

packages/fortinet_fortiedr/manifest.yml

+license: basic
+categories: ["security"]
+conditions:
+  kibana.version: "^7.14.1 || ^8.0.0"


We could bump this to 7.17 maybe? Don't know how far back we want to support this, up to @jamiehynds

@P1llus sounds good - supporting 7.17 or later is what we've done with most other new integrations so best to bump FortiEDR to 7.17 too.

elasticmachine · 2022-10-26T21:58:00Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

jamiehynds · 2022-11-22T15:49:30Z

@efd6 I'm a day late and a dollar short, but Fortinet have just provided me with an NFR license for FortiEDR. If it's still of use for integration testing, I can provide the details.

efd6 · 2022-11-23T05:08:48Z

@jamiehynds Thanks. That will be useful for the dashboard.

efd6 added enhancement New feature or request Team:Security-External Integrations Integration:Fortinet (Deprecated) Use one of the specific fortinet_X labels. labels Aug 26, 2022

efd6 self-assigned this Aug 26, 2022

efd6 force-pushed the 1190-fortiedr branch from a2dfcf6 to 605f8a8 Compare August 26, 2022 07:34

efd6 force-pushed the 1190-fortiedr branch from 605f8a8 to 048123d Compare August 26, 2022 07:38

fortinet_fortiedr: new package for Fortinet FortiEDR ingestion

55e25ea

Test case obtained from https://help.fortinet.com/fsiem/5-2-6_ESCG_HTML/FortiSIEM/ESCG/Fortinet_FortiEDR.htm

efd6 force-pushed the 1190-fortiedr branch from 048123d to 55e25ea Compare August 26, 2022 07:45

efd6 marked this pull request as ready for review August 26, 2022 08:03

efd6 requested a review from a team September 22, 2022 22:06

botelastic bot added the Stalled label Oct 22, 2022

efd6 removed the Stalled label Oct 23, 2022

narph requested a review from P1llus October 26, 2022 08:17

P1llus reviewed Oct 26, 2022

View reviewed changes

address pr comments

165ddb0

efd6 requested a review from P1llus October 28, 2022 02:46

P1llus approved these changes Oct 28, 2022

View reviewed changes

efd6 merged commit 1516eb6 into elastic:main Oct 28, 2022

andrewkroh added Integration:fortinet_fortiedr Fortinet FortiEDR Logs New Integration and removed Integration:Fortinet (Deprecated) Use one of the specific fortinet_X labels. labels Aug 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fortinet_fortiedr: new package for Fortinet FortiEDR ingestion #4070

fortinet_fortiedr: new package for Fortinet FortiEDR ingestion #4070

efd6 commented Aug 26, 2022

elasticmachine commented Aug 26, 2022 •

edited

Loading

Build stats

Test stats 🧪

elasticmachine commented Aug 26, 2022 •

edited

Loading

elasticmachine commented Aug 26, 2022

botelastic bot commented Oct 22, 2022

P1llus Oct 26, 2022

efd6 Oct 26, 2022

P1llus Oct 26, 2022

efd6 Oct 26, 2022

P1llus Oct 26, 2022

efd6 Oct 26, 2022

P1llus Oct 26, 2022

jamiehynds Oct 26, 2022

efd6 Oct 26, 2022

elasticmachine commented Oct 26, 2022

jamiehynds commented Nov 22, 2022

efd6 commented Nov 23, 2022 •

edited

Loading

fortinet_fortiedr: new package for Fortinet FortiEDR ingestion #4070

fortinet_fortiedr: new package for Fortinet FortiEDR ingestion #4070

Conversation

efd6 commented Aug 26, 2022

What does this PR do?

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

elasticmachine commented Aug 26, 2022 • edited Loading

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

elasticmachine commented Aug 26, 2022 • edited Loading

🌐 Coverage report

elasticmachine commented Aug 26, 2022

botelastic bot commented Oct 22, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Oct 26, 2022

🚀 Benchmarks report

jamiehynds commented Nov 22, 2022

efd6 commented Nov 23, 2022 • edited Loading

elasticmachine commented Aug 26, 2022 •

edited

Loading

elasticmachine commented Aug 26, 2022 •

edited

Loading

efd6 commented Nov 23, 2022 •

edited

Loading