[corelight] initial release of Corelight #11288
Conversation
|
💚 CLA has been signed |
sharadcrest
changed the title
andrewkroh
added
needs CLA
packages/corelight/docs/README.md
Outdated
|
|
||
| ## Prerequisites: | ||
|
|
||
| **Add ECS Mappings**: Start by adding the ECS (Elastic Common Schema) mappings from the [Corelight GitHub repository](https://github.com/corelight). You can find the required templates here: [Corelight ECS Templates](https://github.com/corelight/ecs-templates). These mappings will ensure that Corelight data is correctly formatted and aligned with Elastic's schema. |
There was a problem hiding this comment.
Why are users been asked to manually download an input ECS mappings from Github. The ingest pipeline can be included with the integration to avoid this additional step. Any reason why we can't include the ingest pipeline as part of the integration (inline with all other integrations?)
There was a problem hiding this comment.
Corelight have mapped custom mapping differently in their GitHub repo, also they have Elastic as a configuration page where they have build pipeline along with ECS mapping for the fields, so the only ask from them is to build dashboards inline to dashboards for other vendors(Splunk, Looker etc..)
|
/test |
andrewkroh
removed
the
needs CLA
|
@jamiehynds Are we okay to start review for this PR, please? |
|
@kcreddy are you ok to review this PR for Corelight (developed by Crest). Would be great to understand if the work you had done previously with Corelight, could be leveraged here? The current workflow goes against the experience of most integrations, as you're required have to manually download the mappings from Github. |
kcreddy
added
Crest
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
There was a problem hiding this comment.
The integration is unconventional and requests users to install assets such as mappings, settings, templates, ingest pipelines, etc. using an installation script provided by Corelight.
Although the Corelight repositories (providing the script and assets) are well-maintained, it should be noted and documented that this integration only provides dashboards and nothing more. The users are responsible for the updates and have to frequently check and update assets from the script provided by the Corelight repository. This should also be documented in the README.
Also it should be documented that any issues with the installation during initial setup or updates must be followed up with Corelight as we don't own them. This applies to any non-dashboard issues.
In the future, if we were to add some or all of these assets to our integration, users will need to manually delete existing stale Corelight assets.
cc: @jamiehynds
|
@piyush-elastic, related to #11288 (comment), can you update Crest template for README with changes from #11210? This is to conform the README docs across integrations. |
|
/test |
|
/test |
|
/test |
|
💚 Build Succeeded
History
|
|
@jamiehynds, we have established a communication channel with Corelight for reporting any future bugs. If you have any other concerns, let me know or I can merge this PR. |
|
Package corelight - 0.1.0 containing this change is available at https://epr.elastic.co/search?package=corelight |
Create New integration package corelight and add below four dashboards: - Name Resolution Insights - Remote Activity Insights - Secure Channel Insights - Security Posture
Create New integration package corelight and add below four dashboards: - Name Resolution Insights - Remote Activity Insights - Secure Channel Insights - Security Posture
Proposed commit message
Create New integration package corelight and add below four dashboards:
Checklist
changelog.ymlfile.How to test this PR locally
Screenshots