[AI-5441] DDS: ESET Protect: Integration v1.0.0 #20349
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
datadog-agent-integrations-bot
bot
added
documentation
dev/testing
dev/tooling
qa/skip-qa
savandalasaniya-crest
changed the title
temporal-github-worker-1
bot
added
agent/approved
and removed
agent/requested-changes
labels
buraizu
reviewed
Jun 2, 2025
eset_protect/assets/dashboards/eset_protect_filtered_websites_events.json
Outdated
Show resolved
Hide resolved
temporal-github-worker-1
bot
dismissed
sarah-witt’s stale review
Review from sarah-witt is dismissed. Related teams and files:
- agent-integrations
- eset_protect/README.md
- eset_protect/assets/dashboards/eset_protect_audit_events.json
- eset_protect/assets/dashboards/eset_protect_filtered_websites_events.json
- eset_protect/assets/dashboards/eset_protect_overview.json
- eset_protect/assets/dashboards/eset_protect_threat_events.json
temporal-github-worker-1
bot
added
agent/review-requested
and removed
agent/approved
labels
Wyrine
added
assets/no-dry-run
baturalp-dd
added
the
assets/deploy-logs-staging
baturalp-dd
approved these changes
Jun 4, 2025
| targetType: attribute | ||
| preserveSource: false | ||
| overrideOnConflict: false | ||
| - type: pipeline |
There was a problem hiding this comment.
Just asking to better understand the intention here; not a blocking comment.
- Did you create a sub-processor to skip logs with empty user attributes while running the attribute mapper?
There was a problem hiding this comment.
Yes, if any user-related fields are null or empty, we will skip the usr.name mapping.
| - type: grok-parser | ||
| name: Parsing the `occured` attribute to convert it into milliseconds | ||
| enabled: true | ||
| source: occured |
There was a problem hiding this comment.
just want to make sure that the source field is intentionally occured not occurred.
There was a problem hiding this comment.
In the live logs, we are getting field named occured
buraizu
reviewed
Jun 6, 2025
sarah-witt
approved these changes
Jun 10, 2025
temporal-github-worker-1
bot
added
agent/approved
and removed
agent/review-requested
labels
buraizu
approved these changes
Jun 10, 2025
temporal-github-worker-1
bot
added
docs/approved
and removed
docs/review-requested
labels
github-actions bot
pushed a commit
that referenced
this pull request
Jun 11, 2025
* Add ESET Protect integration with assets * adding codeowners and labeler * Adding datadog checks and configuration files * Updated log pipeline * Updating log pipeline * Updating about file version * Updating log pipeline for 1 sample * Updating code owner details * Updating dashboard and pipeline * Updating log pipeline * updating logs result * Updating versions as per suggestion * Resolved review comments and updated content * Readme suggested changes --------- Co-authored-by: Kirolos Shahat <kashahat@gmail.com> 94a10ce
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This is a initial release PR of ESET Protect integration including all the required assets.
Motivation
Review checklist (to be filled by reviewers)
qa/skip-qalabel if the PR doesn't need to be tested during QA.backport/<branch-name>label to the PR and it will automatically open a backport PR once this one is merged