Skip to content

[Crowdstrike] Overhaul of Crowdstrike Falcon pipelines and mappings #6668

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 11 commits into from
Jun 28, 2023
Merged

[Crowdstrike] Overhaul of Crowdstrike Falcon pipelines and mappings #6668

merged 11 commits into from
Jun 28, 2023

Conversation

@P1llus
Copy link
Member

@P1llus P1llus commented Jun 22, 2023 •
edited
Loading

What does this PR do?

This PR is created to update the older crowdstrike falcon datastream to todays standard, this PR includes a lot of updates, trying to list them all here. This PR is also a preparation to a follow-up PR which adds new event types.

  1. Adding what I believe is a complete set of test data in pipeline tests of the event types we currently support, new events will be in separate PR.
  2. Removing unecessary ignore_failures, which only hides possible issues and makes it hard to troubleshoot.
  3. Significant updates to ECS mappings, and removing unecessary custom fields, as they are mapped to ECS.
  4. Moves processors from default.yml to their respective pipelines, to make it more obvious what event types the processors are meant to cover, and causes less issues.
  5. Fixes wrong ECS mappings.
  6. Add on_failure and event.kind for pipeline errors + tags for all processors.
  7. Slight update to the docs.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Related issues
@P1llus P1llus requested a review from a team as a code owner June 22, 2023 10:03
@elasticmachine
Copy link

elasticmachine commented Jun 22, 2023

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
@elasticmachine
Copy link

elasticmachine commented Jun 22, 2023 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-06-27T09:07:56.335+0000

  • Duration: 16 min 40 sec

Test stats 🧪

Test Results
Failed 0
Passed 21
Skipped 0
Total 21

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.
@P1llus P1llus changed the title [Crowdstrike] Rewriting ingest pipelines for Crowdstrike Falcon [Crowdstrike] Overhaul of Crowdstrike Falcon pipelines and mappings Jun 22, 2023
@elasticmachine
Copy link

elasticmachine commented Jun 22, 2023 •
edited
Loading

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (2/2) 💚
Files 100.0% (9/9) 💚
Classes 100.0% (9/9) 💚
Methods 98.413% (62/63) 👍 5.079
Lines 94.735% (2861/3020) 👎 -2.306
Conditionals 100.0% (0/0) 💚
kcreddy
kcreddy approved these changes Jun 26, 2023
View reviewed changes
Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍🏼 Some minor clarifications
@P1llus P1llus merged commit fb21a5e into elastic:main Jun 28, 2023
@elasticmachine
Copy link

elasticmachine commented Jun 28, 2023

Package crowdstrike - 1.15.0 containing this change is available at https://epr.elastic.co/search?package=crowdstrike
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:crowdstrike CrowdStrike

3 participants

@P1llus @elasticmachine @kcreddy