box_events: fingerprint the box.event_id field for doc deduplication

[efd6]

Proposed commit message

See https://developer.box.com/reference/resources/event/#param-event_id for field semantics.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[andrewkroh]

LGTM. I assume this ID is unique across Box accounts (in case users are running multiple instances of the integration).

[efd6]

The text in the docs could be interpreted that way, "The ID of the event object. You can use this to detect duplicate events". The language is not quite strong enough for me to be completely happy. We could inject the client ID into the ingest pipeline for inclusion in the fingerprint set and then remove it. I think this would make me happier, though this value is per application, not per owner, so it may move.

The Client ID of the application that is requesting to authenticate the user. To get the Client ID for your application, log in to your Box developer console and click the Edit Application link for the application you're working with. In the OAuth 2.0 Parameters section of the configuration page, find the item labelled client_id. The text of that item is your application's Client ID.

I am unable to find a definitively documented identifier that we could use, so this is probably the best we have.

[kcreddy]

I think this would make me happier, though this value is per application, not per owner, so it may move.

LGTM after adding client_id 👍🏼 although a test could be nice to have.

[kcreddy]

Is this required since there is a remove on _conf field later in the pipeline?

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 801ef7c

History

• 💚 Build #10126 succeeded f5a97ef
• 💚 Build #10052 succeeded 3ef4773

cc @efd6

[elasticmachine]

Package box_events - 2.8.0 containing this change is available at https://epr.elastic.co/search?package=box_events