[Kubernetes] Add audit logs fields #4081
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>
Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>
Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
🌐 Coverage report
|
|
@tetianakravchenko if you run I am not sure how it slipped away but do you mind applying it? |
gsantoro
reviewed
Aug 26, 2022
| @@ -106,6 +106,9 @@ | |||
| - name: message | |||
| type: text | |||
| description: A human-readable description of the status of this operation | |||
| - name: reason | |||
There was a problem hiding this comment.
While working on other integrations, I found it quite useful to have a sample_event.json that cover as many fields as possible. That made me discover that some fields that were supposed to be there were not documented. I am wondering if it makes sense to do the same here for these extra fields like reason.
There was a problem hiding this comment.
I've updates sample_event. Though fields of the event depends on the type of action, and fields can vary and not all fields defined in fields folder might be present in single event
gsantoro
approved these changes
Aug 26, 2022
gizas
approved these changes
Aug 29, 2022
|
@gizas I've left a comment on it in the issue - #3664 (comment) |
Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>
Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>
I've run |
|
hey @tetianakravchenko the change I am talking about is at https://github.com/tetianakravchenko/integrations/blob/1e4cf2d769cd7c4d3dff83b89042bd52bac5174b/packages/kubernetes/data_stream/state_job/fields/fields.yml#L8. The field kubernetes.job.name seems to have changed the description but the docs haven't changed yet. |
|
Also since the new fields has been added to the sample_event.json I get these test failures now. |
4 tasks
|
@tetianakravchenko below is the sample log you've asked for, I hope it is helpful and thank you for all your work! |
Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>
Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>
Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>
I can see this has been resolved. I'm adding this comment for future reference. |
Signed-off-by: Tetiana Kravchenko <tetiana.kravchenko@elastic.co>
| - name: procMount | ||
| type: keyword | ||
| - name: capabilities.add | ||
| type: keyword |
There was a problem hiding this comment.
example of the document:
"securityContext": {
"capabilities": {
"add": [
"MKNOD",
"SYS_ADMIN",
"SYS_MODULE",
"SYS_RAWIO",
"NET_ADMIN",
"SYS_CHROOT",
"SYS_PTRACE",
"NET_RAW",
"SYS_BOOT",
"SYSLOG",
""
],
"drop": [
"all"
]
}
},
there is no need to define it as an array, because in ElasticSearch every field is already an array, doc: https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html#types-array-handling
Any field can contain zero or more values by default
This was referenced Sep 13, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Add some audit log fields, defined in #3664
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots
requestObject.spec.*fields: