Skip to content

[cisco_secure_email_gateway] Add Cisco ESA package#3040

Merged
andrewkroh merged 7 commits intoelastic:mainfrom
darshan-elastic:package_cisco_esa
May 2, 2022
Merged

[cisco_secure_email_gateway] Add Cisco ESA package#3040
andrewkroh merged 7 commits intoelastic:mainfrom
darshan-elastic:package_cisco_esa

Conversation

@darshan-elastic
Copy link
Contributor

@darshan-elastic darshan-elastic commented Apr 11, 2022

What does this PR do?

  • Generated the skeleton of the Cisco ESA integration package.
  • Added a data stream.
  • Added data collection logic to the data stream.
  • Added the ingest pipeline for the data stream.
  • Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files
  • Added dashboards and visualizations.
  • Added test for pipeline for the data stream.
  • Added system test cases for the data stream.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

  • Clone integrations repo.
  • Install elastic-package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/cisco_esa directory.
  • Run the following command to run tests.
    elastic-package test

Screenshots

image
image
image
image
image

@darshan-elastic darshan-elastic requested a review from a team as a code owner April 11, 2022 07:38
@elasticmachine
Copy link

elasticmachine commented Apr 11, 2022 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-05-02T13:28:49.760+0000

  • Duration: 16 min 48 sec

Test stats 🧪

Test Results
Failed 0
Passed 77
Skipped 0
Total 77

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

jsoriano
jsoriano reviewed Apr 11, 2022
View reviewed changes
@elasticmachine
Copy link

elasticmachine commented Apr 12, 2022

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@andrewkroh andrewkroh added Integration:cisco_secure_email_gateway Cisco Secure Email Gateway New Integration Issue or pull request for creating a new integration package. labels Apr 12, 2022
@andrewkroh andrewkroh requested a review from a team April 12, 2022 13:51
andrewkroh
andrewkroh reviewed Apr 18, 2022
View reviewed changes
packages/cisco_esa/_dev/build/docs/README.md Outdated
@@ -0,0 +1,201 @@
# Cisco ESA

The Cisco ESA integration collects and parses data from Cisco ESA using TCP/UDP and logfile.
Copy link
Member

@andrewkroh andrewkroh Apr 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's include that ESA is Email Security Appliance. And is there a product link that can be included?

Copy link
Contributor Author

@darshan-elastic darshan-elastic Apr 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andrewkroh, Can I use this link as a product link https://www.cisco.com/c/en/us/products/security/email-security/index.html?

Copy link
Member

@andrewkroh andrewkroh Apr 23, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question. That page makes me think our integration should be titled Cisco Secure Email. It says "Cisco Secure Email (formerly Email Security)". And the "appliance" part seems to be de-emphasized given they have multiple deployment options (cloud, virtual, on-prem, hybrid).

@jamiehynds Maybe this should be renamed?

Copy link
Member

@andrewkroh andrewkroh Apr 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From: https://www.cisco.com/c/en/us/products/security/email-security/index.html#~capabilities.

... Cisco Secure Email Gateway (formerly Email Security Appliance) for cloud, hybrid, or on-premises.

Based on that I think we should change the name to cisco_secure_email_gateway / "Cisco Secure Email Gateway".

@andrewkroh
Copy link
Member

andrewkroh commented Apr 21, 2022

/test

@elasticmachine
Copy link

elasticmachine commented Apr 27, 2022 •
edited
Loading

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 83.333% (10/12) 👎 -13.853
Classes 83.333% (10/12) 👎 -13.853
Methods 89.286% (50/56) 👍 0.981
Lines 84.029% (463/551) 👎 -4.897
Conditionals 100.0% (0/0) 💚

@andrewkroh andrewkroh changed the title [cisco_esa] Add Cisco ESA package [cisco_secure_email_gateway] Add Cisco ESA package May 2, 2022
@andrewkroh
Copy link
Member

andrewkroh commented May 2, 2022

/test

@andrewkroh andrewkroh merged commit 218556f into elastic:main May 2, 2022
@andrewkroh andrewkroh mentioned this pull request May 2, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jsoriano jsoriano jsoriano left review comments

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees

No one assigned

Labels

Integration:cisco_secure_email_gateway Cisco Secure Email Gateway New Integration Issue or pull request for creating a new integration package.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@darshan-elastic @elasticmachine @andrewkroh @jsoriano