-
Notifications
You must be signed in to change notification settings - Fork 8.6k
[Security Solution][Telemetry] Paginate ES queries #177263
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
29 commits
Select commit
Hold shift + click to select a range
ddee4f2
Update receiver api
szaffarano e91911e
Update receiver api
szaffarano 24f29fb
Paginate telemetry receiver ES query
szaffarano 444882f
Fix type validations
szaffarano a26ba17
Fix type validations
szaffarano 821211f
Code style
szaffarano 41b18d3
Code style
szaffarano 56d652a
wip
szaffarano 0a72713
Add more assertions
szaffarano 4935abf
Improve endpoint-meta queries
szaffarano 0b6f46a
Merge branch 'main' into szaffarano/receiver-review
szaffarano 324dccc
Fix FTR
szaffarano 4a01c87
Refactor endpoint task logic
szaffarano af38142
Code style changes
szaffarano dadd112
Update artifact configuration
szaffarano a9406a0
Merge branch 'main' into szaffarano/receiver-review
szaffarano dbda03e
Merge branch 'main' into szaffarano/receiver-review
szaffarano a2b1847
Manage policy config errors
szaffarano 8220147
Merge branch 'main' into szaffarano/receiver-review
szaffarano 3d63654
Close PIT
szaffarano 45a4ec5
Enrich task metrics doc
szaffarano 48b087e
Merge branch 'main' into szaffarano/receiver-review
szaffarano 5d3f315
Merge branch 'main' into szaffarano/receiver-review
szaffarano 29502bb
Merge branch 'main' into szaffarano/receiver-review
szaffarano 613a9fa
Merge branch 'main' into szaffarano/receiver-review
szaffarano ee2d88a
Merge branch 'main' into szaffarano/receiver-review
szaffarano a5d0246
Merge branch 'main' into szaffarano/receiver-review
szaffarano 90cccfc
Fix import
szaffarano 409f670
Fix type
szaffarano File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
874 changes: 874 additions & 0 deletions
874
...security_solution/server/integration_tests/__mocks__/endpoint-meta-telemetry-request.json
Large diffs are not rendered by default.
Oops, something went wrong.
251 changes: 251 additions & 0 deletions
251
x-pack/plugins/security_solution/server/integration_tests/__mocks__/endpoint-metadata.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,251 @@ | ||
| [ | ||
| { | ||
| "agent": { | ||
| "build": { | ||
| "original": "version: 8.6.0, compiled: Mon Jan 2 23:00:00 2023, branch: 8.6, commit: e2d09ff1b8e49bfb5f8940d317eb4ac96672d956" | ||
| }, | ||
| "id": "123", | ||
| "type": "endpoint", | ||
| "version": "8.6.0" | ||
| }, | ||
| "@timestamp": "2024-01-29T18:35:51.819450273Z", | ||
| "Endpoint": { | ||
| "capabilities": [ | ||
| "kill_process", | ||
| "suspend_process", | ||
| "running_processes", | ||
| "isolation", | ||
| "ebpf(auto)" | ||
| ], | ||
| "configuration": { | ||
| "isolation": false | ||
| }, | ||
| "state": { | ||
| "isolation": false | ||
| }, | ||
| "policy": { | ||
| "applied": { | ||
| "name": "123", | ||
| "id": "123", | ||
| "endpoint_policy_version": "1", | ||
| "version": "55", | ||
| "status": "success" | ||
| } | ||
| }, | ||
| "status": "enrolled" | ||
| }, | ||
| "ecs": { | ||
| "version": "1.11.0" | ||
| }, | ||
| "data_stream": { | ||
| "namespace": "default", | ||
| "type": "metrics", | ||
| "dataset": "endpoint.metadata" | ||
| }, | ||
| "elastic": { | ||
| "agent": { | ||
| "id": "123" | ||
| } | ||
| }, | ||
| "host": { | ||
| "hostname": "123", | ||
| "os": { | ||
| "Ext": { | ||
| "variant": "Amazon Linux" | ||
| }, | ||
| "kernel": "5.10.102-99.473.amzn2.x86_64 #1 SMP Wed Mar 2 19:14:12 UTC 2022", | ||
| "name": "Linux", | ||
| "family": "amazon linux", | ||
| "type": "linux", | ||
| "version": "2", | ||
| "platform": "amazon linux", | ||
| "full": "Amazon Linux 2" | ||
| }, | ||
| "ip": ["127.0.0.1", "::1"], | ||
| "name": "123", | ||
| "id": "123", | ||
| "mac": ["aa:aa:aa:aa:aa:aa"], | ||
| "architecture": "x86_64" | ||
| }, | ||
| "event": { | ||
| "agent_id_status": "verified", | ||
| "sequence": 34893855, | ||
| "ingested": "2024-01-29T18:35:53Z", | ||
| "created": "2024-01-29T18:35:51.819450273Z", | ||
| "kind": "metric", | ||
| "module": "endpoint", | ||
| "action": "endpoint_metadata", | ||
| "id": "123", | ||
| "category": ["host"], | ||
| "type": ["info"], | ||
| "dataset": "endpoint.metadata" | ||
| }, | ||
| "message": "Endpoint metadata" | ||
| }, | ||
| { | ||
| "agent": { | ||
| "build": { | ||
| "original": "version: 8.6.0, compiled: Mon Jan 2 23:00:00 2023, branch: 8.6, commit: e2d09ff1b8e49bfb5f8940d317eb4ac96672d956" | ||
| }, | ||
| "id": "123", | ||
| "type": "endpoint", | ||
| "version": "8.6.0" | ||
| }, | ||
| "@timestamp": "2024-01-29T16:38:37.863555622Z", | ||
| "Endpoint": { | ||
| "capabilities": [ | ||
| "kill_process", | ||
| "suspend_process", | ||
| "running_processes", | ||
| "isolation", | ||
| "ebpf(auto)" | ||
| ], | ||
| "configuration": { | ||
| "isolation": false | ||
| }, | ||
| "state": { | ||
| "isolation": false | ||
| }, | ||
| "policy": { | ||
| "applied": { | ||
| "name": "123", | ||
| "id": "123", | ||
| "endpoint_policy_version": "1", | ||
| "version": "26", | ||
| "status": "success" | ||
| } | ||
| }, | ||
| "status": "enrolled" | ||
| }, | ||
| "ecs": { | ||
| "version": "1.11.0" | ||
| }, | ||
| "data_stream": { | ||
| "namespace": "default", | ||
| "type": "metrics", | ||
| "dataset": "endpoint.metadata" | ||
| }, | ||
| "elastic": { | ||
| "agent": { | ||
| "id": "123" | ||
| } | ||
| }, | ||
| "host": { | ||
| "hostname": "123", | ||
| "os": { | ||
| "Ext": { | ||
| "variant": "Amazon Linux" | ||
| }, | ||
| "kernel": "5.10.102-99.473.amzn2.x86_64 #1 SMP Wed Mar 2 19:14:12 UTC 2022", | ||
| "name": "Linux", | ||
| "family": "amazon linux", | ||
| "type": "linux", | ||
| "version": "2", | ||
| "platform": "amazon linux", | ||
| "full": "Amazon Linux 2" | ||
| }, | ||
| "ip": ["127.0.0.1", "::1"], | ||
| "name": "123", | ||
| "id": "123", | ||
| "mac": ["aa:aa:aa:aa:aa:aa"], | ||
| "architecture": "x86_64" | ||
| }, | ||
| "event": { | ||
| "agent_id_status": "verified", | ||
| "sequence": 33347679, | ||
| "ingested": "2024-01-29T16:38:39Z", | ||
| "created": "2024-01-29T16:38:37.863555622Z", | ||
| "kind": "metric", | ||
| "module": "endpoint", | ||
| "action": "endpoint_metadata", | ||
| "id": "123", | ||
| "category": ["host"], | ||
| "type": ["info"], | ||
| "dataset": "endpoint.metadata" | ||
| }, | ||
| "message": "Endpoint metadata" | ||
| }, | ||
| { | ||
| "agent": { | ||
| "build": { | ||
| "original": "version: 8.6.0, compiled: Mon Jan 2 23:00:00 2023, branch: 8.6, commit: e2d09ff1b8e49bfb5f8940d317eb4ac96672d956" | ||
| }, | ||
| "id": "123", | ||
| "type": "endpoint", | ||
| "version": "8.6.0" | ||
| }, | ||
| "@timestamp": "2024-01-29T16:35:51.210383141Z", | ||
| "Endpoint": { | ||
| "capabilities": [ | ||
| "kill_process", | ||
| "suspend_process", | ||
| "running_processes", | ||
| "isolation", | ||
| "ebpf(auto)" | ||
| ], | ||
| "configuration": { | ||
| "isolation": false | ||
| }, | ||
| "state": { | ||
| "isolation": false | ||
| }, | ||
| "policy": { | ||
| "applied": { | ||
| "name": "123", | ||
| "id": "123", | ||
| "endpoint_policy_version": "1", | ||
| "version": "55", | ||
| "status": "success" | ||
| } | ||
| }, | ||
| "status": "enrolled" | ||
| }, | ||
| "ecs": { | ||
| "version": "1.11.0" | ||
| }, | ||
| "data_stream": { | ||
| "namespace": "default", | ||
| "type": "metrics", | ||
| "dataset": "endpoint.metadata" | ||
| }, | ||
| "elastic": { | ||
| "agent": { | ||
| "id": "123" | ||
| } | ||
| }, | ||
| "host": { | ||
| "hostname": "123", | ||
| "os": { | ||
| "Ext": { | ||
| "variant": "Amazon Linux" | ||
| }, | ||
| "kernel": "5.10.102-99.473.amzn2.x86_64 #1 SMP Wed Mar 2 19:14:12 UTC 2022", | ||
| "name": "Linux", | ||
| "family": "amazon linux", | ||
| "type": "linux", | ||
| "version": "2", | ||
| "platform": "amazon linux", | ||
| "full": "Amazon Linux 2" | ||
| }, | ||
| "ip": ["127.0.0.1", "::1"], | ||
| "name": "123", | ||
| "id": "123", | ||
| "mac": ["aa:aa:aa:aa:aa:aa"], | ||
| "architecture": "x86_64" | ||
| }, | ||
| "event": { | ||
| "agent_id_status": "verified", | ||
| "sequence": 34885625, | ||
| "ingested": "2024-01-29T16:35:53Z", | ||
| "created": "2024-01-29T16:35:51.210383141Z", | ||
| "kind": "metric", | ||
| "module": "endpoint", | ||
| "action": "endpoint_metadata", | ||
| "id": "123", | ||
| "category": ["host"], | ||
| "type": ["info"], | ||
| "dataset": "endpoint.metadata" | ||
| }, | ||
| "message": "Endpoint metadata" | ||
| } | ||
| ] | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.