[google_workspace] Add support of Chrome Audit Events #12171
Conversation
mohitjha-elastic changed the title 
andrewkroh added Crest 
| Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
| /test |
There was a problem hiding this comment.
We should rename the parameter to batch_size to be consistent with other integrations.
packages/google_workspace/data_stream/chrome/_dev/test/pipeline/test-chrome.log-expected.json Outdated Show resolved Hide resolved
There was a problem hiding this comment.
Why is this exception made?
There was a problem hiding this comment.
The mapping of Chrome events differs, which is why it is highlighted here. Specifically, our approach to breaking down the events is different; we are splitting them based on the events array and have identified alternative mappings that are more appropriate.
For example, we mapped the TIMESTAMP field to the ECS field @timestamp rather than using id.timestamp.
There was a problem hiding this comment.
The httpjson split logic seems to be the same as this CEL program for all datastreams.
I think it makes sense to follow this standard mappings even for the Chrome events unless we know there is a bug.
If there is an additional field called TIMESTAMP, maybe we should create a custom field inside google_workspace.chrome. From the sample event, id.timestamp value is same as TIMESTAMP.
There was a problem hiding this comment.
@mohitjha-elastic Also the system tests are failing, please check. Possibly reference to page_size
| /test |
kcreddy left a comment
kcreddy left a comment There was a problem hiding this comment.
We should match the ECS fields inside Chrome events just like the existing data-streams. #12171 (comment)
| /test |
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
History
|
|
| Package google_workspace - 2.29.0 containing this change is available at https://epr.elastic.co/package/google_workspace/2.29.0/ |
Add the support of Chrome Audit Events through Chrome Data Stream. Update ECS version to 8.16 in all the pipeline.
Add the support of Chrome Audit Events through Chrome Data Stream. Update ECS version to 8.16 in all the pipeline.
4 participants
Proposed Commit Message
Add the support of Chrome Audit Events through Chrome Data Stream.
Update ECS version to 8.16 in all the pipeline.
Checklist
changelog.ymlfile.How to test this PR locally
Clone integrations repo.
Install the elastic package locally.
Start the elastic stack using the elastic package.
Move to integrations/packages/google_workspace directory.
Run the following command to run tests.
elastic-package test -vRelated issues
Automated Test