Skip to content

[Ingest] Add additional attributes to the Datasources Stored Object #65904

@paul-tavares

Description

@paul-tavares

In support of Endpoint Security, add the following additional attributes to datasources:

  • updated_on : Date (ISO). Should be set every time the SO is updated
  • updated_by : User. Should be set every time the SO is updated
  • created_on : Date (ISO). Should be set once only during create
  • created_by : User. Should be set once only during create

REST Impact

  1. New attributes should be returned with every response that includes the Datasource
  2. None of these new attributes should be accepted via the REST API (POST, PUT, etc.)
  3. ❓ These should NOT be included in the JSON/YAML that is sent to the Agent (cc/ @nchaulet)

UI Impact

  1. ❓ Should these be shown in the UI? (either on the Agent Config > Datasources list/table? or the Edit Datasource View?) (/cc @hbharding)

Metadata

Metadata

Assignees

Labels

Team:Defend Workflows“EDR Workflows” sub-team of Security SolutionTeam:FleetTeam label for Observability Data Collection Fleet team

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions