Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Crowdstrike] Overhaul of Crowdstrike Falcon pipelines and mappings #6668

Merged
merged 11 commits into from Jun 28, 2023

Conversation

P1llus
Copy link
Member

@P1llus P1llus commented Jun 22, 2023

What does this PR do?

This PR is created to update the older crowdstrike falcon datastream to todays standard, this PR includes a lot of updates, trying to list them all here. This PR is also a preparation to a follow-up PR which adds new event types.

  1. Adding what I believe is a complete set of test data in pipeline tests of the event types we currently support, new events will be in separate PR.
  2. Removing unecessary ignore_failures, which only hides possible issues and makes it hard to troubleshoot.
  3. Significant updates to ECS mappings, and removing unecessary custom fields, as they are mapped to ECS.
  4. Moves processors from default.yml to their respective pipelines, to make it more obvious what event types the processors are meant to cover, and causes less issues.
  5. Fixes wrong ECS mappings.
  6. Add on_failure and event.kind for pipeline errors + tags for all processors.
  7. Slight update to the docs.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Related issues

@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link

elasticmachine commented Jun 22, 2023

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-06-27T09:07:56.335+0000

  • Duration: 16 min 40 sec

Test stats 🧪

Test Results
Failed 0
Passed 21
Skipped 0
Total 21

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@P1llus P1llus changed the title [Crowdstrike] Rewriting ingest pipelines for Crowdstrike Falcon [Crowdstrike] Overhaul of Crowdstrike Falcon pipelines and mappings Jun 22, 2023
@elasticmachine
Copy link

elasticmachine commented Jun 22, 2023

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (2/2) 💚
Files 100.0% (9/9) 💚
Classes 100.0% (9/9) 💚
Methods 98.413% (62/63) 👍 5.079
Lines 94.735% (2861/3020) 👎 -2.306
Conditionals 100.0% (0/0) 💚

Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍🏼 Some minor clarifications

@P1llus P1llus merged commit fb21a5e into elastic:main Jun 28, 2023
4 checks passed
@elasticmachine
Copy link

Package crowdstrike - 1.15.0 containing this change is available at https://epr.elastic.co/search?package=crowdstrike

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants