Skip to content

Add "Security Solution" tags to security-related CDR integrations #11716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 0 commits into from
Nov 18, 2024
Merged

Add "Security Solution" tags to security-related CDR integrations #11716

merged 0 commits into from
Nov 18, 2024

Conversation

albertoblaz
Copy link
Contributor

@albertoblaz albertoblaz commented Nov 12, 2024

Description

Adds tags.yml to all security integrations so that dashboards and saved searches are tagged with "Security Solution", and will be shown in the Security Solution UI.

Related integrations with "Security solution" tag:

  • Added
    • Wiz
    • Prisma Cloud
  • Pre-existent
    • Google Security Command Center
    • Microsoft Defender
    • Qualys VMDR
    • Tenable IO and SC
    • Rapid7
    • Snyk
    • Amazon Security Lake
    • VMware Carbon Black Cloud
    • AWS Inspector & AWS Security Hub belong to packages/aws and they use asset_ids

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Testing

Follow these guidelines to install elastic-package, build the new packages and integrates them with your local ES & Kibana

Related issues

Screenshots

I've got no Wiz-related data locally, but I do have it for Prisma Cloud and their tags config is the same:

Prisma Cloud Screenshot 2024-11-14 at 13 45 34 Screenshot 2024-11-14 at 13 46 01

Warnings

Running elastic-package lint returned these pre-existent warnings for the modified packages. Is this something we should worry about? The packages were eventually build successfully though:

wiz

2024/11/14 13:19:39 INFO Skipped errors: found 2 validation errors:

  1. file "/Users/alberto/git/integrations/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json" is invalid: expected filter in dashboard: no filter found and at least one panel does not have a filter (SVR00002)
  2. file "/Users/alberto/git/integrations/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json" is invalid: expected filter in dashboard: no filter found and at least one panel does not have a filter (SVR00002)

prisma_cloud

2024/11/14 13:20:04 INFO Skipped errors: found 1 validation error:

  1. references found in dashboard kibana/dashboard/prisma_cloud-19913580-7495-11ee-9d52-2d0fa627877e.json: prisma_cloud-d140b5e0-771d-11ee-b6b7-396983b7218f (search) (SVR00004)

@albertoblaz albertoblaz added the enhancement New feature or request label Nov 12, 2024
@albertoblaz albertoblaz self-assigned this Nov 12, 2024
@elastic-vault-github-plugin-prod

🚀 Benchmarks report

Package wiz 👍(1) 💚(2) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
cloud_configuration_finding 5952.38 3533.57 -2418.81 (-40.64%) 💔

To see the full report comment with /test benchmark fullreport

Copy link

@elasticmachine
Copy link

💚 Build Succeeded

cc @albertoblaz

@albertoblaz albertoblaz marked this pull request as ready for review November 14, 2024 12:55
@albertoblaz albertoblaz requested a review from a team as a code owner November 14, 2024 12:55
@albertoblaz albertoblaz requested a review from a team November 14, 2024 12:56
@albertoblaz albertoblaz enabled auto-merge (squash) November 14, 2024 12:58
Copy link
Contributor

@maxcold maxcold left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me!

Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍🏼

@albertoblaz albertoblaz merged commit 850be92 into elastic:main Nov 18, 2024
5 checks passed
@albertoblaz albertoblaz deleted the tag-cdr-integrations branch November 18, 2024 15:18
@kcreddy kcreddy added the Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] label Nov 18, 2024
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod

Package prisma_cloud - 1.4.0 containing this change is available at https://epr.elastic.co/package/prisma_cloud/1.4.0/

@elastic-vault-github-plugin-prod

Package wiz - 2.3.0 containing this change is available at https://epr.elastic.co/package/wiz/2.3.0/

@albertoblaz albertoblaz added the Team:Cloud Security Cloud Security team [elastic/cloud-security-posture] label Nov 18, 2024
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
…astic#11716)

* Add tags.yaml for prisma_cloud

* Add tags.yaml for wiz
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
…astic#11716)

* Add tags.yaml for prisma_cloud

* Add tags.yaml for wiz
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request Integration:prisma_cloud Palo Alto Prisma Cloud Integration:wiz Wiz Team:Cloud Security Cloud Security team [elastic/cloud-security-posture] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Tag CDR related integration dashboards with security solution tags
5 participants