Closed
Conversation
ecezalp
added
v7.13.0
release_note:feature
ecezalp
commented
Apr 19, 2021
Contributor
Author
There was a problem hiding this comment.
wasn't sure about this specific change, please confirm
ecezalp
commented
Apr 19, 2021
Contributor
Author
There was a problem hiding this comment.
wasn't sure about this specific change, please confirm
rylnd
reviewed
Apr 19, 2021
Contributor
rylnd
left a comment
rylnd
left a comment
There was a problem hiding this comment.
Adding a snapshot test for getSignalsTemplate before making these changes, and then updating it after them will show us exactly what's changed with our mappings, and we'll also have an artifact to compare moving forward 👍
Contributor
There was a problem hiding this comment.
ottherMapping should only include threat.indicator fields, so I think we can simplify this merging of threat fields to:
threat: {
...ecsMapping.mappings.properties.threat,
indicator: {
...otherMapping.threat.properties.indicator.properties,
event: ecsMapping.mappings.properties.event,
}
}
Contributor
Author
There was a problem hiding this comment.
hey I believe indicator must exist under threat.properties, so I think the prev version was better, let me know
Contributor
There was a problem hiding this comment.
Right, I neglected to add an intermediate properties key between threat and indicator, but I think the point still stands, no?
Comment on lines
48
to
54
Contributor
There was a problem hiding this comment.
This could be simplified to
Suggested change
| as: otherMapping.as, | |
| code_signature: otherMapping.code_signature, | |
| geo: otherMapping.geo, | |
| hash: otherMapping.hash, | |
| interface: otherMapping.interface, | |
| os: otherMapping.os, | |
| pe: otherMapping.pe, | |
| ...otherMapping.mappings.properties |
unless I'm misunderstanding?
Contributor
Author
There was a problem hiding this comment.
sure, was trying to be explicit but I guess it's not exactly necessary. renamed otherMapping to otherMappedProperties for additional clarification
ecezalp
force-pushed
the
security-team-995
branch
from
64ee743 to
532f64d
Compare
Contributor
Author
|
@elasticmachine merge upstream |
Contributor
💔 Build Failed
Failed CI Steps
Test FailuresKibana Pipeline / general / Chrome X-Pack UI Functional Tests.x-pack/test/functional/apps/dashboard/sync_colors·ts.dashboard sync colors should sync colors on dashboard by defaultStandard OutStack TraceKibana Pipeline / general / X-Pack Detection Engine API Integration Tests.x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_actions·ts.detection engine api security and spaces enabled add_actions adding actions should be able to create a new webhook action and attach it to a ruleStandard OutStack TraceKibana Pipeline / general / X-Pack Detection Engine API Integration Tests.x-pack/test/detection_engine_api_integration/security_and_spaces/tests/add_actions·ts.detection engine api security and spaces enabled add_actions adding actions should be able to create a new webhook action and attach it to a ruleStandard OutStack Traceand 38 more failures, only showing the first 3. Metrics [docs]
History
To update your PR or re-run it, just comment with: cc @ecezalp |
Contributor
|
Closing in favor of #97573 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This change brings 1.9 ECS mappings to the detection engine.