all: migrate ssi packages to ecs@mappings by efd6 · Pull Request #10135 · elastic/integrations

efd6 · 2024-06-11T23:55:08Z

Proposed commit message

Migration performed using ecs-update.

  go run github.com/andrewkroh/go-examples/ecs-update@014b35dfe4c9832b51e7c909a39a48257d6a005d \
    -ecs-version=8.11.0 \
    -ecs-git-ref=v8.11.0 \
    -fields-yml-drop-ecs \
    -kibana-version=^8.13.0 \
    -drop-import-mappings \
    -pr=10135 \
    -owner=elastic/security-service-integrations \
    packages/*

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

[ ]

How to test this PR locally

Related issues

Depends all: fix sample events to agree with ECS #10136
Depends cylance,ti_opencti: fix up package validation issues #10134
Depends sentinel_one: fix sample event mac address #10186

Screenshots

andrewkroh · 2024-06-12T00:30:23Z

From a user perspective, do you think this second sentence is confusing? Maybe we should mention the ecs@mappings component template in some way. Like

Removed ECS field definitions that have been made redundant by the ecs@mappings component template.

That seems reasonable.

andrewkroh/go-examples#36

elasticmachine · 2024-06-12T12:22:23Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2024-06-19T02:52:19Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

chrisberkhout · 2024-06-19T12:50:33Z

~~An issue to be aware of for integrations with transforms: elastic/elastic-package#1641~~

Correction: actually not an issue since we're not importing them now. They should just be there, presumably for transform destination indexes as well as data streams.

chrisberkhout · 2024-06-19T13:38:15Z

~~An issue to be aware of for integrations with transforms: elastic/elastic-package#1641~~

Correction: actually not an issue since we're not importing them now. They should just be there, presumably for transform destination indexes as well as data streams.

Update: Transform destination indexes don't get the ECS dynamic templates that data streams get. This PR doesn't remove the manual definitions in transforms, so it still works (checked for ti_opencti).

chrisberkhout

I looked at the full diffs for 4 or 5 integrations and checked out the impact on transforms in detail for ti_opencti. All looks good.

The conditions.kibana.version in the package manifest changed from ^8.12.0 to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. [git-generate] go run github.com/andrewkroh/go-examples/ecs-update@v0.0.0-20240617213809-014b35dfe4c9 -ecs-version=8.11.0 -ecs-git-ref=git@v8.11.0 -drop-import-mappings -kibana-version=^8.13.0 -pr=10135 -fields-yml-drop-ecs packages/1password

The conditions.kibana.version in the package manifest changed from ^8.12.0 to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. [git-generate] go run github.com/andrewkroh/go-examples/ecs-update@v0.0.0-20240617213809-014b35dfe4c9 -ecs-version=8.11.0 -ecs-git-ref=git@v8.11.0 -drop-import-mappings -kibana-version=^8.13.0 -pr=10135 -fields-yml-drop-ecs packages/akamai

Removed import_mappings. The conditions.kibana.version in the package manifest changed from ^8.12.0 to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. [git-generate] go run github.com/andrewkroh/go-examples/ecs-update@v0.0.0-20240617213809-014b35dfe4c9 -ecs-version=8.11.0 -ecs-git-ref=git@v8.11.0 -drop-import-mappings -kibana-version=^8.13.0 -pr=10135 -fields-yml-drop-ecs packages/amazon_security_lake

The conditions.kibana.version in the package manifest changed from ^8.12.0 to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. [git-generate] go run github.com/andrewkroh/go-examples/ecs-update@v0.0.0-20240617213809-014b35dfe4c9 -ecs-version=8.11.0 -ecs-git-ref=git@v8.11.0 -drop-import-mappings -kibana-version=^8.13.0 -pr=10135 -fields-yml-drop-ecs packages/atlassian_bitbucket

The conditions.kibana.version in the package manifest changed from ^8.12.0 to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. [git-generate] go run github.com/andrewkroh/go-examples/ecs-update@v0.0.0-20240617213809-014b35dfe4c9 -ecs-version=8.11.0 -ecs-git-ref=git@v8.11.0 -drop-import-mappings -kibana-version=^8.13.0 -pr=10135 -fields-yml-drop-ecs packages/atlassian_confluence

The conditions.kibana.version in the package manifest changed from ^8.12.0 to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. [git-generate] go run github.com/andrewkroh/go-examples/ecs-update@v0.0.0-20240617213809-014b35dfe4c9 -ecs-version=8.11.0 -ecs-git-ref=git@v8.11.0 -drop-import-mappings -kibana-version=^8.13.0 -pr=10135 -fields-yml-drop-ecs packages/atlassian_jira

The conditions.kibana.version in the package manifest changed from ^8.12.0 to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. [git-generate] go run github.com/andrewkroh/go-examples/ecs-update@v0.0.0-20240617213809-014b35dfe4c9 -ecs-version=8.11.0 -ecs-git-ref=git@v8.11.0 -drop-import-mappings -kibana-version=^8.13.0 -pr=10135 -fields-yml-drop-ecs packages/auth0

The conditions.kibana.version in the package manifest changed from ^8.12.0 to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. [git-generate] go run github.com/andrewkroh/go-examples/ecs-update@v0.0.0-20240617213809-014b35dfe4c9 -ecs-version=8.11.0 -ecs-git-ref=git@v8.11.0 -drop-import-mappings -kibana-version=^8.13.0 -pr=10135 -fields-yml-drop-ecs packages/aws_bedrock

Removed import_mappings. The conditions.kibana.version in the package manifest changed from ^8.12.0 to ^8.13.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. The ecs.version in sample_event.json files was changed to 8.11.0. Previously sample_event.json files contained 8.0.0. [git-generate] go run github.com/andrewkroh/go-examples/ecs-update@v0.0.0-20240617213809-014b35dfe4c9 -ecs-version=8.11.0 -ecs-git-ref=git@v8.11.0 -drop-import-mappings -kibana-version=^8.13.0 -pr=10135 -fields-yml-drop-ecs packages/azure_blob_storage

elasticmachine · 2024-06-21T21:36:03Z

Package panw_cortex_xdr - 1.27.0 containing this change is available at https://epr.elastic.co/search?package=panw_cortex_xdr

elasticmachine · 2024-06-21T21:36:03Z

Package ping_one - 1.16.0 containing this change is available at https://epr.elastic.co/search?package=ping_one

elasticmachine · 2024-06-21T21:36:04Z

Package pps - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=pps

elasticmachine · 2024-06-21T21:36:05Z

Package prisma_cloud - 1.3.0 containing this change is available at https://epr.elastic.co/search?package=prisma_cloud

elasticmachine · 2024-06-21T21:36:06Z

Package proofpoint_tap - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=proofpoint_tap

elasticmachine · 2024-06-21T21:36:06Z

Package pulse_connect_secure - 2.1.0 containing this change is available at https://epr.elastic.co/search?package=pulse_connect_secure

elasticmachine · 2024-06-21T21:36:07Z

Package qualys_vmdr - 3.3.0 containing this change is available at https://epr.elastic.co/search?package=qualys_vmdr

elasticmachine · 2024-06-21T21:36:08Z

Package rapid7_insightvm - 1.12.0 containing this change is available at https://epr.elastic.co/search?package=rapid7_insightvm

elasticmachine · 2024-06-21T21:36:09Z

Package santa - 3.18.0 containing this change is available at https://epr.elastic.co/search?package=santa

Jaos1992 · 2024-07-02T07:48:58Z

efd6 added enhancement New feature or request Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Jun 11, 2024

efd6 self-assigned this Jun 11, 2024

efd6 force-pushed the ecsmapping branch from 556d5b2 to fb8833b Compare June 12, 2024 00:02

andrewkroh reviewed Jun 12, 2024

View reviewed changes

efd6 mentioned this pull request Jun 12, 2024

all: fix sample events to agree with ECS #10136

Merged

4 tasks

agithomas mentioned this pull request Jun 12, 2024

[AWS][Pipeline Test] Multiple pipeline Test failure due to event.category mappings #10116

Closed

efd6 force-pushed the ecsmapping branch from fb8833b to ce5bf58 Compare June 12, 2024 11:48

efd6 force-pushed the ecsmapping branch 4 times, most recently from 09c8746 to 3e06b13 Compare June 18, 2024 20:56

efd6 mentioned this pull request Jun 18, 2024

sentinel_one: fix sample event mac address #10186

Merged

4 tasks

efd6 force-pushed the ecsmapping branch from 3e06b13 to c264753 Compare June 19, 2024 02:07

efd6 marked this pull request as ready for review June 19, 2024 02:52

efd6 requested a review from a team as a code owner June 19, 2024 02:52

chrisberkhout approved these changes Jun 19, 2024

View reviewed changes

Comment thread packages/ti_opencti/data_stream/indicator/fields/ecs.yml Outdated

efd6 added 9 commits June 20, 2024 13:22

Jaos1992 reviewed Jul 2, 2024

View reviewed changes

Comment thread packages/akamai/changelog.yml

Jaos1992 Jul 2, 2024

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

__

chemamartinez mentioned this pull request Jul 13, 2024

Initial release of Falco integration #9619

Merged

10 tasks

kcreddy mentioned this pull request Jan 24, 2025

Resolve #11741, bbot update based on testing using BBOT v2.1.2 #11742

Merged

7 tasks

efd6 deleted the ecsmapping branch February 5, 2025 22:07

Uh oh!

Conversation

efd6 commented Jun 11, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

andrewkroh Jun 12, 2024

Choose a reason for hiding this comment

Uh oh!

efd6 Jun 12, 2024

Choose a reason for hiding this comment

Uh oh!

efd6 Jun 12, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Jun 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Uh oh!

elasticmachine commented Jun 19, 2024

Uh oh!

chrisberkhout commented Jun 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chrisberkhout commented Jun 19, 2024

Uh oh!

chrisberkhout left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Jun 21, 2024

Uh oh!

elasticmachine commented Jun 21, 2024

Uh oh!

elasticmachine commented Jun 21, 2024

Uh oh!

elasticmachine commented Jun 21, 2024

Uh oh!

elasticmachine commented Jun 21, 2024

Uh oh!

elasticmachine commented Jun 21, 2024

Uh oh!

elasticmachine commented Jun 21, 2024

Uh oh!

elasticmachine commented Jun 21, 2024

Uh oh!

elasticmachine commented Jun 21, 2024

Uh oh!

Jaos1992 Jul 2, 2024

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

efd6 commented Jun 11, 2024 •

edited

Loading

elasticmachine commented Jun 12, 2024 •

edited

Loading

chrisberkhout commented Jun 19, 2024 •

edited

Loading