Set sensitive values as secret - Part 1 #8725
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
audit |
3861 | 2976.19 | -884.81 (-22.92%) | 💔 |
Package auth0 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
logs |
4065.04 | 2320.19 | -1744.85 (-42.92%) | 💔 |
Package bitdefender 👍(1) 💚(0) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
push_configuration |
33333.33 | 26315.79 | -7017.54 (-21.05%) | 💔 |
push_statistics |
66666.67 | 45454.55 | -21212.12 (-31.82%) | 💔 |
Package bitwarden 👍(2) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
collection |
31250 | 17241.38 | -14008.62 (-44.83%) | 💔 |
member |
10869.57 | 8547.01 | -2322.56 (-21.37%) | 💔 |
Package box_events 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
events |
3267.97 | 2439.02 | -828.95 (-25.37%) | 💔 |
Package carbon_black_cloud 👍(3) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
endpoint_event |
2277.9 | 1733.1 | -544.8 (-23.92%) | 💔 |
Package cisco_duo 👍(2) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
admin |
4694.84 | 2958.58 | -1736.26 (-36.98%) | 💔 |
telephony |
52631.58 | 32258.06 | -20373.52 (-38.71%) | 💔 |
Package cisco_meraki 👍(0) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
events |
6711.41 | 4975.12 | -1736.29 (-25.87%) | 💔 |
Package cloudflare 👍(1) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
audit |
2994.01 | 2325.58 | -668.43 (-22.33%) | 💔 |
Package crowdstrike 👍(0) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
falcon |
9708.74 | 3322.26 | -6386.48 (-65.78%) | 💔 |
To see the full report comment with /test benchmark fullreport
💔 Tests Failed
Expand to view the summary
Build stats
Test stats 🧪
Test errors
Expand to view the tests failures> Show only the first 10 test failures
|
🌐 Coverage report
|
|
Hi @taylor-swanson, please update your branch with the latest contents from main branch. There was an important PR merged updating the CI pipelines. Thanks! |
|
/test |
|
Pinging @elastic/security-scalability (Team:Security-Scalability) |
|
I think I'm going to split this PR into smaller chunks. At the very least by codeowner and further by groups of 20 or so packages (like ECS updates). |
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
efd6
reviewed
Feb 12, 2024
| @@ -4492,7 +4492,7 @@ | |||
| type: group | |||
| fields: | |||
| - name: classification_ids | |||
| type: keyword | |||
| type: integer | |||
There was a problem hiding this comment.
Why has this been changed? IDs are usually considered non-orderable.
There was a problem hiding this comment.
Yeah this was the wrong move. I didn't see that there was a processor that was supposed to convert the this field, but it's not getting triggered on the pipeline test case that is failing:
FAILURE DETAILS:
amazon_security_lake/event test-system-activity.log:
[0] parsing field value failed: [0] parsing field value failed: field "ocsf.malware.classification_ids" value "[17 2]" ([]interface {}): expected string or array of strings
╭──────────────────────┬─────────────┬───────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────────────────────┬──────────────╮
│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │
├──────────────────────┼─────────────┼───────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────────────────────┼──────────────┤
│ amazon_security_lake │ event │ pipeline │ test-application-activity.log │ PASS │ 44.295852ms │
│ amazon_security_lake │ event │ pipeline │ test-discovery.log │ PASS │ 7.062222ms │
│ amazon_security_lake │ event │ pipeline │ test-findings.log │ PASS │ 9.071077ms │
│ amazon_security_lake │ event │ pipeline │ test-iam.log │ PASS │ 16.257727ms │
│ amazon_security_lake │ event │ pipeline │ test-network-activity.log │ PASS │ 57.253258ms │
│ amazon_security_lake │ event │ pipeline │ test-system-activity.log │ FAIL: test case failed: one or more problems with fields found in documents │ 48.515694ms │
╰──────────────────────┴─────────────┴───────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────────────────────┴──────────────╯
Looking at the event that is failing, it has (perhaps among other things) a class_id that doesn't match the required list in the default pipeline, so the malware sub-pipeline isn't being executed. I don't have enough context here to know how to fix this problem, so I've downgraded pkg-spec to 3.0.0 so the validation doesn't kick in. It'll have to be addressed in a separate issue.
|
/test |
💚 Build Succeeded
History
|
|
0.0% Duplication on New Code
efd6
approved these changes
Feb 14, 2024
|
Package cel - 1.9.0 containing this change is available at https://epr.elastic.co/search?package=cel |
|
Package cisco_duo - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=cisco_duo |
|
Package cisco_meraki - 1.21.0 containing this change is available at https://epr.elastic.co/search?package=cisco_meraki |
|
Package cisco_secure_endpoint - 2.25.0 containing this change is available at https://epr.elastic.co/search?package=cisco_secure_endpoint |
|
Package cisco_umbrella - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=cisco_umbrella |
|
Package cloudflare - 2.24.0 containing this change is available at https://epr.elastic.co/search?package=cloudflare |
|
Package cloudflare_logpush - 1.18.0 containing this change is available at https://epr.elastic.co/search?package=cloudflare_logpush |
|
Package crowdstrike - 1.30.0 containing this change is available at https://epr.elastic.co/search?package=crowdstrike |
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Checklist
changelog.ymlfile.Related issues