Skip to content

[cisco_ise] Improve ECS mappings - #11280

Merged
aleksmaus merged 4 commits into
elastic:mainfrom
aleksmaus:enhance/cisco_ise_ecs_mapping
Nov 4, 2024
Merged

[cisco_ise] Improve ECS mappings#11280
aleksmaus merged 4 commits into
elastic:mainfrom
aleksmaus:enhance/cisco_ise_ecs_mapping

Conversation

@aleksmaus

@aleksmaus aleksmaus commented Sep 30, 2024 •
edited by andrewkroh
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

Improve ECS mappings

  • Add event.outcome: success under the same conditions as the existing event.category
if: ctx.cisco_ise?.log?.message?.code != null && ['5200','5231','5233','5239'].contains(ctx.cisco_ise.log.message.code)
  • Set event.outcome: failure for events where event.code is [5404, 5434,5413]
  • Fix typo in the pipeline with cisco_ise.log.ep.mac_address, thus fixing the mac address formatting to make it compatible with client.mac ECS field
  • Set cisco_ise.log.endpoint.mac.address to client.mac
  • Set cisco_ise.log.ep.mac.address to client.mac

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Related issues
@aleksmaus aleksmaus added enhancement New feature or request Integration:cisco_ise Cisco ISE Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices] labels Sep 30, 2024
@aleksmaus
aleksmaus requested a review from a team as a code owner September 30, 2024 20:48
@elasticmachine

elasticmachine commented Sep 30, 2024

Copy link
Copy Markdown

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 30, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
andrewkroh
andrewkroh reviewed Sep 30, 2024
View reviewed changes
Comment thread packages/cisco_ise/changelog.yml Outdated
@aleksmaus
aleksmaus requested review from a team and andrewkroh October 1, 2024 00:15
@elastic-sonarqube

elastic-sonarqube Bot commented Oct 1, 2024

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@botelastic

botelastic Bot commented Nov 1, 2024

Copy link
Copy Markdown

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!
@botelastic botelastic Bot added the Stalled label Nov 1, 2024
@botelastic botelastic Bot removed the Stalled label Nov 4, 2024
@elasticmachine

elasticmachine commented Nov 4, 2024

Copy link
Copy Markdown

💚 Build Succeeded

History
@elastic-sonarqube

elastic-sonarqube Bot commented Nov 4, 2024

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@aleksmaus
aleksmaus merged commit 95bea0b into elastic:main Nov 4, 2024
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 4, 2024

Copy link
Copy Markdown
Contributor

Package cisco_ise - 1.24.0 containing this change is available at https://epr.elastic.co/search?package=cisco_ise
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
@aleksmaus @andrewkroh
[cisco_ise] Improve ECS mappings (elastic#11280)
68f6488 
* [cisco_ise] Improve ECS mappings

* Update changelog with PR number

* add context to changelog message

---------

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
@aleksmaus @andrewkroh
[cisco_ise] Improve ECS mappings (elastic#11280)
8661fa4 
* [cisco_ise] Improve ECS mappings

* Update changelog with PR number

* add context to changelog message

---------

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:cisco_ise Cisco ISE Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices]

5 participants

@aleksmaus @elasticmachine @mjwolf @andrewkroh @gogochan