Skip to content

[panw] Improve handling of urls and filenames when parsing anti-virus events #10140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Jun 13, 2024
Merged

[panw] Improve handling of urls and filenames when parsing anti-virus events #10140

merged 2 commits into from
Jun 13, 2024

Conversation

@taylor-swanson
Copy link
Contributor

@taylor-swanson taylor-swanson commented Jun 12, 2024 •
edited
Loading

Proposed commit message

  • The filename or URL contained within an anti-virus threat event is now extracted to the file.name or url fields, respectively.
  • Fixed url.extension extraction so only the last component of the extension is extracted.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

cd packages/panw elastic-package test

Related issues
@taylor-swanson
[panw] Improve handling of urls and filenames when parsing anti-virus…
5f389d1 
… events - The filename or URL contained within an anti-virus threat event is now extracted to the file.name or url fields, respectively. - Fixed url.extension extraction so only the last component of the extension is extracted.
@taylor-swanson taylor-swanson added enhancement New feature or request Integration:panw Palo Alto Next-Gen Firewall Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices] labels Jun 12, 2024
@taylor-swanson taylor-swanson self-assigned this Jun 12, 2024
@elasticmachine
Copy link

elasticmachine commented Jun 12, 2024

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@elasticmachine
Copy link

elasticmachine commented Jun 12, 2024

💚 Build Succeeded

cc @taylor-swanson
@elastic-sonarqube
Copy link

elastic-sonarqube bot commented Jun 12, 2024

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@taylor-swanson taylor-swanson marked this pull request as ready for review June 13, 2024 12:52
@taylor-swanson taylor-swanson requested a review from a team as a code owner June 13, 2024 12:52
@elasticmachine
Copy link

elasticmachine commented Jun 13, 2024

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)
pkoutsovasilis
pkoutsovasilis approved these changes Jun 13, 2024
View reviewed changes
Copy link
Contributor

@pkoutsovasilis pkoutsovasilis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm
@taylor-swanson taylor-swanson merged commit 9b03227 into elastic:main Jun 13, 2024
@taylor-swanson taylor-swanson deleted the enhance/panw-virus-parse branch June 13, 2024 15:13
@elasticmachine
Copy link

elasticmachine commented Jun 13, 2024

Package panw - 3.26.0 containing this change is available at https://epr.elastic.co/search?package=panw
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:panw Palo Alto Next-Gen Firewall Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices]

3 participants

@taylor-swanson @elasticmachine @pkoutsovasilis