Skip to content

[Cloud Security] add observer.vendor field mappings - #11030

Merged
maxcold merged 2 commits into
elastic:mainfrom
maxcold:csp-add-observer-vendor-to-field-mappings
Sep 9, 2024
Merged

[Cloud Security] add observer.vendor field mappings#11030
maxcold merged 2 commits into
elastic:mainfrom
maxcold:csp-add-observer-vendor-to-field-mappings

Conversation

@maxcold

@maxcold maxcold commented Sep 6, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

Add observer.vendor to csp field mappings

My expectation was that as ecs@mappings component template is attached to our latest index templates, the ecs field mappings would appear automatically, but that wasn't the case

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

  1. build with elastic-package build
  2. run stack with this package via elastic-package stack up -v -d
  3. ingest data into findings and vulnerability datastream, check that observer.vendor is provided and the mapping for this field exists on CSP data view and latest indexes. The observer.vendor should be searchable on the Findings page and available in the data grid field browser (possible to add as a column)

Related issues

Screenshots
@maxcold maxcold added enhancement New feature or request Team:Cloud Security Cloud Security team [elastic/cloud-security-posture] labels Sep 6, 2024
maxcold
maxcold commented Sep 6, 2024
View reviewed changes
Comment thread packages/cloud_security_posture/data_stream/findings/_dev/test/pipeline/test-findings-log.json
"id": "cis_azure",
"version": "v2.0.0",
"posture_type": "cspm"
"events": [

@maxcold maxcold Sep 6, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

result of elastic-package format && elastic-package lint
maxcold
maxcold commented Sep 6, 2024
View reviewed changes
Comment thread packages/cloud_security_posture/data_stream/findings/fields/cloud.yml
type: keyword
- name: Organization.name
type: keyword No newline at end of file
type: keyword

@maxcold maxcold Sep 6, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

result of elastic-package format && elastic-package lint
maxcold
maxcold commented Sep 6, 2024
View reviewed changes
Comment thread packages/cloud_security_posture/data_stream/findings/fields/related.yml
@@ -1,5 +1,5 @@
- name: related

@maxcold maxcold Sep 6, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

result of elastic-package format && elastic-package lint
maxcold
maxcold commented Sep 6, 2024
View reviewed changes
Comment thread ...cloud_security_posture/data_stream/vulnerabilities/_dev/test/pipeline/test-findings-log.json
@@ -1,15 +1,15 @@
{

@maxcold maxcold Sep 6, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

result of elastic-package format && elastic-package lint
@andrewkroh andrewkroh added the Integration:cloud_security_posture Security Posture Management label Sep 6, 2024
@elasticmachine

elasticmachine commented Sep 6, 2024

Copy link
Copy Markdown

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@elasticmachine

elasticmachine commented Sep 6, 2024

Copy link
Copy Markdown

💚 Build Succeeded
@elastic-sonarqube

elastic-sonarqube Bot commented Sep 6, 2024

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@maxcold
maxcold marked this pull request as ready for review September 6, 2024 15:55
@maxcold
maxcold requested a review from a team as a code owner September 6, 2024 15:55
@maxcold
maxcold merged commit 5223540 into elastic:main Sep 9, 2024
@maxcold
maxcold deleted the csp-add-observer-vendor-to-field-mappings branch September 9, 2024 13:57
@elasticmachine

elasticmachine commented Sep 9, 2024

Copy link
Copy Markdown

Package cloud_security_posture - 1.11.0-preview07 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 12, 2024

Copy link
Copy Markdown
Contributor

Package cloud_security_posture - 1.11.0 containing this change is available at https://epr.elastic.co/package/cloud_security_posture/1.11.0/
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
@maxcold
[Cloud Security] add observer.vendor field mappings (elastic#11030)
39d7c53 
* add observer.vendor field mappings

* add PR link to the changelog
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
@maxcold
[Cloud Security] add observer.vendor field mappings (elastic#11030)
da7660c 
* add observer.vendor field mappings

* add PR link to the changelog
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:cloud_security_posture Security Posture Management Team:Cloud Security Cloud Security team [elastic/cloud-security-posture]

4 participants

@maxcold @elasticmachine @eyalkraft @andrewkroh