Skip to content

wiz: fix state retention between iterations - #10278

Merged
efd6 merged 13 commits into
elastic:mainfrom
efd6:wiz_cleanup
Jun 30, 2024
Merged

wiz: fix state retention between iterations#10278
efd6 merged 13 commits into
elastic:mainfrom
efd6:wiz_cleanup

Conversation

@efd6

@efd6 efd6 commented Jun 27, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

Fix state retention between iterations and clean up CEL code structure.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • Best reviewed commit-wise. Notes for particularly subtle changes will be added, but may be hidden by GitHub UI if viewed as a full set of changes.
  • First commit best reviewed with ignore whitespace changes.

How to test this PR locally

Related issues

Screenshots
@efd6 efd6 added bugfix Pull request that fixes a bug issue Integration:wiz Wiz Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Jun 27, 2024
@efd6 efd6 self-assigned this Jun 27, 2024
@elasticmachine

elasticmachine commented Jun 27, 2024

Copy link
Copy Markdown

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@efd6
efd6 marked this pull request as ready for review June 27, 2024 01:20
@efd6
efd6 requested a review from a team as a code owner June 27, 2024 01:20
@elasticmachine

elasticmachine commented Jun 27, 2024

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
efd6
efd6 commented Jun 27, 2024
View reviewed changes
Comment thread packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs Outdated
Comment on lines 68 to 79
state.?want_more.orValue(true)
?
state.?cursor.first_timestamp.orValue(null)
:
(
has(state.cursor) && has(state.cursor.last_timestamp) && state.cursor.last_timestamp != null
state.?cursor.last_timestamp.orValue(null) != null
?
state.cursor.last_timestamp
:
string(now() - duration(state.initial_interval))
)
:
(
has(state.cursor) && has(state.cursor.first_timestamp) && state.cursor.first_timestamp != null
?
state.cursor.first_timestamp
:
null
)
)

@efd6 efd6 Jun 27, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This logic is subtle, so please take extra care here. Similar in the other two data streams.
Comment thread packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs
"filterBy": {
"timestamp": {
"after": state.?want_more.orValue(true) ?
"after": state.want_more ?

@efd6 efd6 Jun 27, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The logic here flows algebraically, but the condition is odd IMO. Please take extra care here.
@efd6 efd6 added the enhancement New feature or request label Jun 27, 2024
kcreddy
kcreddy reviewed Jun 27, 2024
View reviewed changes
Comment thread packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs
kcreddy
kcreddy approved these changes Jun 27, 2024
View reviewed changes

@kcreddy kcreddy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍🏼
@efd6

efd6 commented Jun 27, 2024

Copy link
Copy Markdown
Contributor Author

Waiting on internal testing against a real API.
@elasticmachine

elasticmachine commented Jun 27, 2024

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @efd6
@elastic-sonarqube

elastic-sonarqube Bot commented Jun 27, 2024

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@efd6

efd6 commented Jun 30, 2024

Copy link
Copy Markdown
Contributor Author

Tested successfully against a real endpoint, so merging.
@efd6
efd6 merged commit 3936e82 into elastic:main Jun 30, 2024
@elasticmachine

elasticmachine commented Jun 30, 2024

Copy link
Copy Markdown

Package wiz - 1.3.0 containing this change is available at https://epr.elastic.co/search?package=wiz
@efd6
efd6 deleted the wiz_cleanup branch February 5, 2025 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue enhancement New feature or request Integration:wiz Wiz Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@efd6 @elasticmachine @kcreddy