Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new cluster name to ecs schema #4454

Merged

Conversation

ofiriro3
Copy link
Contributor

@ofiriro3 ofiriro3 commented Oct 12, 2022

What does this PR do?

This PR adds the orchestrator.cluster.name field to the ECS schema and enables the new Cloudbeat processor so Cloudbeat will fetch the cluster name along with each finding.
This version will only support Kubernetes Vanilla, we will add support in EKS in a different PR.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Related issues

@elasticmachine
Copy link

elasticmachine commented Oct 12, 2022

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-10-20T07:36:24.777+0000

  • Duration: 14 min 51 sec

Test stats 🧪

Test Results
Failed 0
Passed 2
Skipped 0
Total 2

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link

elasticmachine commented Oct 12, 2022

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (0/0) 💚
Files 100.0% (0/0) 💚 2.508
Classes 100.0% (0/0) 💚 2.508
Methods 25.0% (1/4) 👎 -65.312
Lines 100.0% (0/0) 💚 7.65
Conditionals 100.0% (0/0) 💚

@ofiriro3 ofiriro3 marked this pull request as ready for review October 12, 2022 20:30
@ofiriro3 ofiriro3 requested a review from a team as a code owner October 12, 2022 20:30
@@ -30,7 +30,8 @@ fetchers:
]
processors:
- add_cluster_id: ~
- add_environment_metadata: ~
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isn't the processor name been changed? add_orchestrator_metadata

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

another question, why don't we use the same processor for eks as well?

@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.0.2"
changes:
- description: Add cluster name to the ecs schema and enabling the relevant processor in the eks hbs file.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the description points to eks hbs file but the change was in vanilla hbs file.

@ofiriro3 ofiriro3 requested review from a team as code owners October 19, 2022 10:17
@ofiriro3 ofiriro3 changed the base branch from main to 1password_itemusage_action October 19, 2022 10:18
@ofiriro3 ofiriro3 requested a review from a team as a code owner October 19, 2022 10:18
@ofiriro3 ofiriro3 changed the base branch from 1password_itemusage_action to main October 19, 2022 10:19
@ofiriro3 ofiriro3 marked this pull request as draft October 19, 2022 10:20
@ofiriro3 ofiriro3 removed request for a team October 19, 2022 10:21
@ofiriro3 ofiriro3 marked this pull request as ready for review October 19, 2022 10:22
Copy link
Member

@ChrsMark ChrsMark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Copy link
Contributor

@kfirpeled kfirpeled left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@@ -1,7 +1,12 @@
# newer versions go on top
- version: "1.0.4"
changes:
- description: Add cluster name to the ecs schema.
Copy link
Contributor

@kfirpeled kfirpeled Oct 19, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I think a clearer description would be, Updated mapping to include orchastrator.cluster.name or Added mapping to orchastrator.cluster.name

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NP

@ofiriro3 ofiriro3 merged commit f56a8c3 into elastic:main Oct 20, 2022
@kfirpeled kfirpeled linked an issue Oct 25, 2022 that may be closed by this pull request
12 tasks
@kfirpeled kfirpeled added the Team:Cloud Security Label for the Cloud Security team label Jun 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Cloud Security Label for the Cloud Security team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add cluster name to findings - using existing impl. in libbeat
4 participants