Skip to content

[tanium] Fix handling of differently formatted data #11797

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 0 commits into from
Nov 21, 2024
Merged

[tanium] Fix handling of differently formatted data #11797

merged 0 commits into from
Nov 21, 2024

Conversation

chrisberkhout
Copy link
Contributor

@chrisberkhout chrisberkhout commented Nov 20, 2024 •
edited
Loading

Proposed commit message

[tanium] Fix handling of differently formatted data (#)

For the `threat_response` data stream:
- Handle `state` when it's parsed JSON (as well as when it's stringified
  JSON).
- Set `user.id` and `user.related` after processing 'User Id', so its
  value is used.
- Handle `Match Details` data in its own field (the same as when it's in
  an encoded payload).

For all data streams:
- Add processor tags and improve `on_failure` handling.

Discussion

This can be reviewed commit-by-commit.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

@chrisberkhout chrisberkhout added bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Nov 20, 2024
@chrisberkhout chrisberkhout self-assigned this Nov 20, 2024
@chrisberkhout chrisberkhout requested a review from a team as a code owner November 20, 2024 19:26
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

efd6
efd6 reviewed Nov 20, 2024
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a test case that I'm missing that exercises the json.state instanceof String case?

@chrisberkhout
Copy link
Contributor Author

Is there a test case that I'm missing that exercises the json.state instanceof String case?

@efd6 Yes, that's the existing case. There are 5 examples ("state":") in data_stream/threat_response/_dev/test/pipeline/test-threat-response.log.

@chrisberkhout chrisberkhout requested a review from efd6 November 21, 2024 06:55
efd6
efd6 approved these changes Nov 21, 2024
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@chrisberkhout chrisberkhout enabled auto-merge (squash) November 21, 2024 07:02
@elastic-sonarqube Elastic SonarQube
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
88.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

@chrisberkhout chrisberkhout merged commit fff365a into elastic:main Nov 21, 2024
4 checks passed
@elasticmachine
Copy link

💚 Build Succeeded

History

  • 💚 Build #18516 succeeded 3501276e56e1a07a277039d7c3e0686bcbed7610

cc @chrisberkhout

@elastic-vault-github-plugin-prod
Copy link

Package tanium - 1.10.2 containing this change is available at https://epr.elastic.co/package/tanium/1.10.2/

qcorporation pushed a commit that referenced this pull request Feb 3, 2025
@chrisberkhout @efd6 @flexitrev
[tanium] Fix handling of differently formatted data (#11797)
ebfcdc3 
For the `threat_response` data stream:
- Handle `state` when it's parsed JSON (as well as when it's stringified
  JSON).
- Set `user.id` and `user.related` after processing 'User Id', so its
  value is used.
- Handle `Match Details` data in its own field (the same as when it's in
  an encoded payload).

For all data streams:
- Add processor tags and improve `on_failure` handling.

---------

Co-authored-by: Dan Kortschak <[email protected]>
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
@chrisberkhout @efd6
[tanium] Fix handling of differently formatted data (elastic#11797)
edde030 
For the `threat_response` data stream:
- Handle `state` when it's parsed JSON (as well as when it's stringified
  JSON).
- Set `user.id` and `user.related` after processing 'User Id', so its
  value is used.
- Handle `Match Details` data in its own field (the same as when it's in
  an encoded payload).

For all data streams:
- Add processor tags and improve `on_failure` handling.

---------

Co-authored-by: Dan Kortschak <[email protected]>
qcorporation pushed a commit that referenced this pull request Feb 4, 2025
@chrisberkhout @efd6 @flexitrev
[tanium] Fix handling of differently formatted data (#11797)
efff59b 
For the `threat_response` data stream:
- Handle `state` when it's parsed JSON (as well as when it's stringified
  JSON).
- Set `user.id` and `user.related` after processing 'User Id', so its
  value is used.
- Handle `Match Details` data in its own field (the same as when it's in
  an encoded payload).

For all data streams:
- Add processor tags and improve `on_failure` handling.

---------

Co-authored-by: Dan Kortschak <[email protected]>
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
@chrisberkhout @efd6
[tanium] Fix handling of differently formatted data (elastic#11797)
4369763 
For the `threat_response` data stream:
- Handle `state` when it's parsed JSON (as well as when it's stringified
  JSON).
- Set `user.id` and `user.related` after processing 'User Id', so its
  value is used.
- Handle `Match Details` data in its own field (the same as when it's in
  an encoded payload).

For all data streams:
- Add processor tags and improve `on_failure` handling.

---------

Co-authored-by: Dan Kortschak <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@efd6 efd6 efd6 approved these changes

Assignees

@chrisberkhout chrisberkhout

Labels
bugfix Pull request that fixes a bug issue Integration:tanium Tanium Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@chrisberkhout @elasticmachine @efd6