-
Notifications
You must be signed in to change notification settings - Fork 419
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[ESET PROTECT] Normalize ECS hash fields enabling indicator match rules #9465
Conversation
…atching. Fixed grok parse error when object_uri equals 'script'.
packages/eset_protect/data_stream/detection/_dev/test/pipeline/test-detection.log
Outdated
Show resolved
Hide resolved
packages/eset_protect/data_stream/detection/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
packages/eset_protect/data_stream/event/_dev/test/pipeline/test-event.log
Outdated
Show resolved
Hide resolved
packages/eset_protect/data_stream/event/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
packages/eset_protect/data_stream/event/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
/test |
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
|
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks
You are referencing the wrong pull request in the changelog |
@efd6 How do I go about fixing this, issue and PR? |
Sorry about that, I should have caught it. You can send another PR to fix the line. No other change is required. Otherwise I can do it tomorrow. |
[Enhancement]
This PR aims to improve compatibility with threat intelligence and other security integrations, including ESET Threat Intelligence #9255, by lowercasing the ECS hash fields
threat.indicator.file.hash.sha1
,file.hash.sha
andrelated.hash
, which is more in line with similar security integrations. This would enable one to use indicator match rules more easily as well.Also fixes a parsing error when
object_uri
equalsscript
.Proposed commit message
Lowercase related hash and indicator hash to support indicator rule matching. Fixed grok parse error when
object_uri
equalsscript
.Checklist
changelog.yml
file.