Skip to content

m365_defender,microsoft_defender_endpoint: drop empty event sets #5164

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Feb 2, 2023
Merged

m365_defender,microsoft_defender_endpoint: drop empty event sets #5164

merged 1 commit into from
Feb 2, 2023

Conversation

@efd6
Copy link
Contributor

@efd6 efd6 commented Feb 1, 2023

What does this PR do?

The adds checks for empty event sets returned by the MS API and drops documents that have not event.

The change is also added to the deprecated M365 Defender log data stream after off-line discussion with @jamiehynds as there have been a number of reports of this in that package and the change is trivial.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots
@efd6 efd6 added bug Something isn't working, use only for issues Team:Security-External Integrations Integration:microsoft_defender_endpoint Microsoft Defender for Endpoint Integration:m365_defender Microsoft Defender XDR labels Feb 1, 2023
@efd6 efd6 self-assigned this Feb 1, 2023
@elasticmachine
Copy link

elasticmachine commented Feb 1, 2023 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-02-01T21:06:41.430+0000

  • Duration: 16 min 27 sec

Test stats 🧪

Test Results
Failed 0
Passed 22
Skipped 0
Total 22

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.
@elasticmachine
Copy link

elasticmachine commented Feb 1, 2023

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (3/3) 💚
Files 100.0% (3/3) 💚
Classes 100.0% (3/3) 💚
Methods 95.349% (41/43) 👍 9.635
Lines 93.785% (2535/2703) 👍 0.402
Conditionals 100.0% (0/0) 💚
@efd6 efd6 marked this pull request as ready for review February 1, 2023 21:23
@efd6 efd6 requested a review from a team as a code owner February 1, 2023 21:23
@elasticmachine
Copy link

elasticmachine commented Feb 1, 2023

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
kcreddy
kcreddy approved these changes Feb 2, 2023
View reviewed changes
Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍🏼
@efd6 efd6 merged commit 44a5c37 into elastic:main Feb 2, 2023
@elasticmachine
Copy link

elasticmachine commented Feb 2, 2023

Package m365_defender - 1.5.1 containing this change is available at https://epr.elastic.co/search?package=m365_defender
@elasticmachine
Copy link

elasticmachine commented Feb 2, 2023

Package microsoft_defender_endpoint - 2.8.1 containing this change is available at https://epr.elastic.co/search?package=microsoft_defender_endpoint
@asiridiaz asiridiaz mentioned this pull request Feb 6, 2023
Closed
@efd6 efd6 mentioned this pull request Mar 22, 2023
Merged
6 tasks
efd6 added a commit to efd6/beats that referenced this pull request Mar 22, 2023
@efd6
x-pack/filebeat/module/microsoft: drop empty api responses
140d22c 
This is a port of elastic/integrations#5164.
efd6 added a commit to elastic/beats that referenced this pull request Mar 28, 2023
@efd6
x-pack/filebeat/module/microsoft: drop empty api responses (#34893)
429bdeb 
This is a port of elastic/integrations#5164.
mergify bot pushed a commit to elastic/beats that referenced this pull request Mar 28, 2023
@efd6 @mergify
x-pack/filebeat/module/microsoft: drop empty api responses (#34893)
6e9543e 
This is a port of elastic/integrations#5164. (cherry picked from commit 429bdeb)
efd6 added a commit to elastic/beats that referenced this pull request Mar 28, 2023
@mergify @efd6
x-pack/filebeat/module/microsoft: drop empty api responses (#34893) (#…
a9d6766 
…34947) This is a port of elastic/integrations#5164. (cherry picked from commit 429bdeb) Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com> Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
chrisberkhout pushed a commit to elastic/beats that referenced this pull request Jun 1, 2023
@efd6 @chrisberkhout
x-pack/filebeat/module/microsoft: drop empty api responses (#34893)
8d86d3d 
This is a port of elastic/integrations#5164.
@efd6 efd6 deleted the 5147-defender branch February 5, 2025 22:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working, use only for issues Integration:m365_defender Microsoft Defender XDR Integration:microsoft_defender_endpoint Microsoft Defender for Endpoint

3 participants

@efd6 @elasticmachine @kcreddy