Skip to content

Update fortinet to ECS 8.2 #2800

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
taylor-swanson merged 9 commits into from
Apr 25, 2022
Merged

Update fortinet to ECS 8.2 #2800

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
0ed1d1e
Update fortinet to ECS 8.2
taylor-swanson Mar 9, 2022
7ef5fd5
Update changelog with PR number
taylor-swanson Mar 9, 2022
7442e71
Use append for email addresses
taylor-swanson Mar 9, 2022
0d4f5d6
Remove event.ingested and improve changelog message
taylor-swanson Mar 15, 2022
d94c68f
Make change minor
taylor-swanson Mar 22, 2022
1e8c0ad
Merge branch 'main' into ecs8.2-fortinet
taylor-swanson Mar 22, 2022
5be4bf5
Regen expected file
taylor-swanson Mar 23, 2022
f6bad7f
Merge branch 'main' into ecs8.2-fortinet
taylor-swanson Apr 5, 2022
8ed7c20
Regen files after merge
taylor-swanson Apr 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/fortinet/_dev/build/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
dependencies:
ecs:
reference: git@8.0
reference: git@8.2
5 changes: 5 additions & 0 deletions packages/fortinet/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.5.0"
changes:
- description: Update to ECS 8.2.0 to use new email field set.
type: enhancement
link: https://github.com/elastic/integrations/pull/2800
- version: "1.4.3"
changes:
- description: Add documentation for multi-fields
Expand Down
500 changes: 100 additions & 400 deletions ...s/fortinet/data_stream/clientendpoint/_dev/test/pipeline/test-generated.log-expected.json
View file
Open in desktop

Large diffs are not rendered by default.

6 changes: 1 addition & 5 deletions packages/fortinet/data_stream/clientendpoint/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,9 @@
description: Pipeline for Fortinet FortiClient Endpoint Security

processors:
# ECS event.ingested
- set:
field: event.ingested
value: '{{_ingest.timestamp}}'
- set:
field: ecs.version
value: '8.0.0'
value: '8.2.0'
# User agent
- user_agent:
field: user_agent.original
Expand Down
2 changes: 1 addition & 1 deletion packages/fortinet/data_stream/clientendpoint/sample_event.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@
"port": 3994
},
"ecs": {
"version": "1.12.0"
"version": "8.2.0"
},
"elastic_agent": {
"id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0",
Expand Down
Loading