Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Refactor cisco_ise integration #4653

Merged
merged 5 commits into from
Nov 18, 2022
Merged

Refactor cisco_ise integration #4653

merged 5 commits into from
Nov 18, 2022

Conversation

Bernhard-Fluehmann
Copy link
Contributor

@Bernhard-Fluehmann Bernhard-Fluehmann commented Nov 15, 2022 •
edited
Loading

  • No kv parsing to root level anymore (user log_details_object flattened field instead
  • More sophisticated parsing of av-pairs
  • Enhanced error handling
  • Bug-fixes

What does this PR do?

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@Bernhard-Fluehmann Bernhard-Fluehmann requested a review from a team as a code owner November 15, 2022 17:27
@cla-checker-service
Copy link

cla-checker-service bot commented Nov 15, 2022 •
edited
Loading

💚 CLA has been signed

@Bernhard-Fluehmann
Copy link
Contributor Author

Bernhard-Fluehmann commented Nov 15, 2022 •
edited
Loading

@efd6 Next try. Now with changed author email address. CLA check still failing. What's the problem now?

@elasticmachine
Copy link

elasticmachine commented Nov 15, 2022 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-11-18T08:04:34.017+0000

  • Duration: 16 min 15 sec

Test stats 🧪

Test Results
Failed 0
Passed 90
Skipped 0
Total 90

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@efd6
Copy link
Contributor

efd6 commented Nov 15, 2022

@Bernhard-Fluehmann Are you able to jump onto the community slack to work through this? Alternatively, can you post the commit details for the change, output from git log fix_cisco_ise~1..fix_cisco_ise should be enough (GitHub unfortunately doesn't make this available through the UI and I can't look at your branch until the CLA checker is happy).

@Bernhard-Fluehmann Bernhard-Fluehmann force-pushed the fix_cisco_ise branch 2 times, most recently from a255797 to ece4ab8 Compare November 16, 2022 08:34
@Bernhard-Fluehmann
Copy link
Contributor Author

@efd6 Now?

@efd6
Copy link
Contributor

efd6 commented Nov 16, 2022

Yay! That is working. Thanks for being patient and persistent.

@efd6
Copy link
Contributor

efd6 commented Nov 16, 2022

/test

@elasticmachine
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

elasticmachine commented Nov 16, 2022 •
edited
Loading

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 100.0% (17/17) 💚 2.534
Classes 100.0% (17/17) 💚 2.534
Methods 100.0% (179/179) 💚 9.134
Lines 98.792% (3845/3892) 👍 7.086
Conditionals 100.0% (0/0) 💚

efd6
efd6 reviewed Nov 16, 2022
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this, the processing is a lot cleaner. I have some suggestions for improvement.

Please re-run elastic-package test -g; some of the pipline test expectations are not correctly formatted.

Also, this will need to have a changelog entry in changelog.yml and a version bump in manifest.yml. Since this includes enhancements, it should be bumped to "1.3.0".

packages/cisco_ise/data_stream/log/fields/fields.yml Outdated
Comment on lines 832 to 833
- name: tmp
type: flattened
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please delete this.

packages/cisco_ise/data_stream/log/fields/fields.yml Outdated
Comment on lines 471 to 470
- name: log_details_object
type: flattened
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should not be needed since it is only being used temporarily.

packages/cisco_ise/data_stream/log/fields/fields.yml Outdated
Comment on lines 469 to 470
- name: log_details
type: text
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If cisco_ise.log.log_details is being deleted as it now is, this does not need to be in the fields definitions.

I think though that it would be better to leave it here and change it to a flattened and rename the current cisco_ise.log.log_details_object to cisco_ise.log.log_details in the pipeline sources and this field to cisco_ise.log.log_details_raw as the temporary string to work from. Then if there are any fields that come up in new versions those fields will become clearly visible in this object since they won't have been deleted in the sub-pipelines.

@efd6 efd6 self-assigned this Nov 16, 2022
@efd6 efd6 added bug Something isn't working, use only for issues enhancement New feature or request Team:Security-External Integrations Integration:cisco_ise Cisco ISE labels Nov 17, 2022
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@Bernhard-Fluehmann
Refactor cisco_ise integration
410aca4 
- No kv parsing to root level anymore (user log_details_object flattened
  field instead
- More sophisticated parsing of av-pairs
- Enhanced error handling
- Bug-fixes
@Bernhard-Fluehmann
Changes recommended by @efd6
7da246c
@Bernhard-Fluehmann
Copy link
Contributor Author

@efd6 Recommended changes implemented. Please review

@efd6
Copy link
Contributor

efd6 commented Nov 17, 2022

/test

efd6
efd6 reviewed Nov 17, 2022
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The README.md will need to be regenerated to incorporate the new sample_event.json. Please run elastic-package build.

@Bernhard-Fluehmann
Copy link
Contributor Author

@efd6 Done

@efd6
Copy link
Contributor

efd6 commented Nov 18, 2022

/test

efd6
efd6 approved these changes Nov 18, 2022
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@efd6 efd6 merged commit 83c93d8 into elastic:main Nov 18, 2022
@Bernhard-Fluehmann
Copy link
Contributor Author

@efd6 Thanks for your fast response and assistance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@efd6 efd6 efd6 approved these changes

Assignees

@efd6 efd6

Labels
bug Something isn't working, use only for issues enhancement New feature or request Integration:cisco_ise Cisco ISE
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@Bernhard-Fluehmann @elasticmachine @efd6