[opencanary] Update Event ECS Fields to Remove Noise #13162
Conversation
mohitjha-elastic
added
bugfix
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
packages/opencanary/changelog.yml
Outdated
| @@ -1,4 +1,9 @@ | |||
| # newer versions go on top | |||
| - version: "0.4.1" | |||
| changes: | |||
| - description: Update event ecs fields to remove unwanted alert noise. | |||
There was a problem hiding this comment.
| - description: Update event ecs fields to remove unwanted alert noise. | |
| - description: Update event ECS fields to remove unwanted alert noise. |
| value: | ||
| - network | ||
| - intrusion_detection | ||
| if: ctx.opencanary?.logtype != null && ![1000, 1001, 1002, 1003, 1004, 1005, 1006].contains(ctx.opencanary.logtype) |
There was a problem hiding this comment.
Since opencanary.logtype is a long, can we
| if: ctx.opencanary?.logtype != null && ![1000, 1001, 1002, 1003, 1004, 1005, 1006].contains(ctx.opencanary.logtype) | |
| if: ctx.opencanary?.logtype != null && (ctx.opencanary.logtype < 1000 || 1006 < ctx.opencanary.logtype) |
instead? This saves an allocation, and reduces the number of comparisons. Similar below.
Updated condition to set event.kind to reduce complexity and save allocation.
💚 Build Succeeded
History
|
|
|
Before you merge, can you clarify what "Also, as requested in the issue, message ECS field is already present in the pipeline." means in this context? It doesn't look like anything involving message is being done here. |
|
Ah, OK. The test shows that that is already set. We don't need to mention that in the commit, and the "Anything else?" section in the issue is not a "Would you like fries with that?", it's a "Is there anything else we should know?" |
|
Package opencanary - 0.4.1 containing this change is available at https://epr.elastic.co/package/opencanary/0.4.1/ |
Log ID 1000-1006 is related to base message hence event.* fields should not be set in that case.
Log ID 1000-1006 is related to base message hence event.* fields should not be set in that case.
Log ID 1000-1006 is related to base message hence event.* fields should not be set in that case.
Log ID 1000-1006 is related to base message hence event.* fields should not be set in that case.
Proposed Commit Message
Update Event ECS Fields to Remove Unwanted Alert Noise.
Log ID 1000-1006 is related to base message hence event.* fields should not be set in that case. Also, as requested in the issue, message ECS field is already present in the pipeline.
Checklist
changelog.ymlfile.How to test this PR locally
Clone integrations repo.
Install the elastic package locally.
Start the elastic stack using the elastic package.
Move to integrations/packages/opencanary directory.
Run the following command to run tests.
elastic-package test -vRelated issues