Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crowdstrike: allow aidmaster metadata to be retained after host enrichment #8715

Merged
merged 1 commit into from
Dec 18, 2023
Merged

crowdstrike: allow aidmaster metadata to be retained after host enrichment #8715

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/crowdstrike/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.27.0"
changes:
- description: Allow aidmaster metadata to be retained after host enrichment.
type: enhancement
link: https://github.com/elastic/integrations/pull/8715
- version: "1.26.2"
changes:
- description: Do not populate `related.hosts` with IP values.
Expand Down
2 changes: 2 additions & 0 deletions packages/crowdstrike/data_stream/fdr/agent/stream/aws-s3.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,10 +76,12 @@ processors:
key_field: crowdstrike.aid
value_field: crowdstrike
ignore_missing: false
{{#unless keep_aidmaster}}
- drop_event:
when:
contains:
log.file.path: aidmaster
{{/unless}}
else:
- cache:
backend:
Expand Down
2 changes: 2 additions & 0 deletions packages/crowdstrike/data_stream/fdr/agent/stream/stream.yml.hbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,12 @@ processors:
key_field: crowdstrike.aid
value_field: crowdstrike
ignore_missing: false
{{#unless keep_aidmaster}}
- drop_event:
when:
contains:
log.file.path: aidmaster
{{/unless}}
else:
- cache:
backend:
Expand Down
16 changes: 16 additions & 0 deletions packages/crowdstrike/data_stream/fdr/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,14 @@ streams:
type: bool
multi: false
default: true
- name: keep_aidmaster
required: true
show_user: false
title: Keep Original Host Metadata
description: Keep the aidmaster document after it has been used for event host enrichment.
type: bool
multi: false
default: false
- name: host_metadata_ttl
required: true
show_user: true
Expand Down Expand Up @@ -216,6 +224,14 @@ streams:
type: bool
multi: false
default: true
- name: keep_aidmaster
required: true
show_user: false
title: Keep Original Host Metadata
description: Keep the aidmaster document after it has been used for event host enrichment.
type: bool
multi: false
default: false
- name: host_metadata_ttl
required: true
show_user: true
Expand Down
2 changes: 1 addition & 1 deletion packages/crowdstrike/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: crowdstrike
title: CrowdStrike
version: "1.26.2"
version: "1.27.0"
description: Collect logs from Crowdstrike with Elastic Agent.
type: integration
format_version: "3.0.0"
Expand Down