ti_misp: harmonise object fields between datastreams #5917
Conversation
efd6 added bug efd6 force-pushed the 5834-ti_misp-threat_attributes branch from 6840890 to be7a37c Compare 
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
🌐 Coverage report
|
| Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
kcreddy left a comment
kcreddy left a comment There was a problem hiding this comment.
Need clarification about sample log
There was a problem hiding this comment.
This response doesn't seem to belong to threat attributes API
Was this supposed to be added to threat datastream instead?
There was a problem hiding this comment.
Yes, good catch. Thanks
There was a problem hiding this comment.
We are already renaming event.original to misp.attribute earlier in the pipeline.
There was a problem hiding this comment.
Sorry, what I actually meant to say was that all these renaming with misp.event.* fields never exists in the Attributes API. It has fields named misp.attribute.* i.e., misp.attribute.Object, misp.attribute.Event, misp.attribute.Tag which were already renamed in the pipeline earlier.
There was a problem hiding this comment.
Indeed, you're correct, fixed fixed.
efd6 force-pushed the 5834-ti_misp-threat_attributes branch from be7a37c to 2b762c1 Compare efd6 force-pushed the 5834-ti_misp-threat_attributes branch from 2b762c1 to 6446f1e Compare efd6 force-pushed the 5834-ti_misp-threat_attributes branch from ab82a1c to 473dfb6 Compare kcreddy left a comment
kcreddy left a comment There was a problem hiding this comment.
LGTM 👍🏼 Minor suggestion
packages/ti_misp/changelog.yml Outdated
| # newer versions go on top | ||
| - version: "1.13.1" | ||
| changes: | ||
| - description: Harmonise object and org fields. |
There was a problem hiding this comment.
org is probably not relevant anymore in this PR
efd6 changed the title | Package ti_misp - 1.13.1 containing this change is available at https://epr.elastic.co/search?package=ti_misp |
3 participants
What does this PR do?
Brings field definitions into agreement. This is the second part of addressing #5834,
Note that if the event added in tests here is add to the threat datastream test, it fails due to a failure of the uri_parts processor to handle
\in the host part of a URL.Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots