[Cisco Secure Email Gateway] Fix pipeline errors for AMP and Consolidated Event logs #8932
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
chemamartinez added Team:Security-External Integrations Integration:cisco_secure_email_gateway 
| Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
efd6 reviewed Jan 21, 2024
...es/cisco_secure_email_gateway/data_stream/log/elasticsearch/ingest_pipeline/pipeline_amp.yml Show resolved Hide resolved
🚀 Benchmarks reportTo see the full report comment with |
bhapas reviewed Jan 22, 2024
bhapas approved these changes Jan 23, 2024
💚 Build Succeeded
History
|
| Package cisco_secure_email_gateway - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=cisco_secure_email_gateway |
2 similar comments
| Package cisco_secure_email_gateway - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=cisco_secure_email_gateway |
| Package cisco_secure_email_gateway - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=cisco_secure_email_gateway |
narph added the Team:Security-Service Integrations | Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Fixed two pipeline errors in the Cisco Secure Email Gateway integration:
AMP logs
The
kvprocessor splits key-value pairs by commas. However some fields could contain commas, such as a file name, making the processor to fail with:This has been fixed by modifying the pattern of
field_split. Now it looks for any comma which is not surrounded by quotes.Also, a new field
verdict_sourcehas been added.Consolidated Events
The
grokprocessor in charge of parsing the CEF events fails ifendTimeorstartTimeare missing. These fields are also optional so the pattern has been modified to make them optional too.More info at Cisco docs.
Checklist
changelog.ymlfile.