Skip to content

[panw] Map name for more subtypes, fix CSV escaping - #11917

Merged
chrisberkhout merged 0 commit into
elastic:mainfrom
chrisberkhout:panw-fixes
Nov 29, 2024
Merged

[panw] Map name for more subtypes, fix CSV escaping#11917
chrisberkhout merged 0 commit into
elastic:mainfrom
chrisberkhout:panw-fixes

Conversation

@chrisberkhout

@chrisberkhout chrisberkhout commented Nov 28, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

[panw] Fix CSV escaping, map name for more subtypes (#)

The HTTP Headers field (`panw.panos.http_headers`) of the incoming data
is incorrectly escaped. This will be fixed if necessary before CSV
parsing.

Map the file name value in the URL/Filename (`panw.panos.misc`) field
for the `wildfire` and `wildfire-virus` sub-types.

Discussion

The documentation for the URL/Filename field says:

image

I've added the wildfire and wildfire-virus cases to the existing logic.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices
@chrisberkhout chrisberkhout added Integration:panw Palo Alto Next-Gen Firewall bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Nov 28, 2024
@chrisberkhout chrisberkhout self-assigned this Nov 28, 2024
@chrisberkhout
chrisberkhout requested a review from a team as a code owner November 28, 2024 15:34
@elasticmachine

elasticmachine commented Nov 28, 2024

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 28, 2024

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@andrewkroh andrewkroh added the Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices] label Nov 28, 2024
@elasticmachine

elasticmachine commented Nov 28, 2024

Copy link
Copy Markdown

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)
mjwolf
mjwolf approved these changes Nov 29, 2024
View reviewed changes

@mjwolf mjwolf left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!
qcorporation
qcorporation reviewed Nov 29, 2024
View reviewed changes
Comment thread packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/threat.yml Outdated
@elastic-sonarqube

elastic-sonarqube Bot commented Nov 29, 2024

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@elasticmachine

elasticmachine commented Nov 29, 2024

Copy link
Copy Markdown

💚 Build Succeeded

History

  • 💚 Build #18845 succeeded 78d8fb708134aeb8c0e6dae21b424f9e9609c127

cc @chrisberkhout
qcorporation
qcorporation approved these changes Nov 29, 2024
View reviewed changes

@qcorporation qcorporation left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the change, this looks good
@chrisberkhout
chrisberkhout merged commit dc9fe51 into elastic:main Nov 29, 2024
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 29, 2024

Copy link
Copy Markdown
Contributor

Package panw - 4.1.1 containing this change is available at https://epr.elastic.co/package/panw/4.1.1/
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
@chrisberkhout
[panw] Map name for more subtypes, fix CSV escaping (elastic#11917)
a58e4ae 
The HTTP Headers field (`panw.panos.http_headers`) of the incoming data
is incorrectly escaped. This will be fixed if necessary before CSV
parsing.

Map the file name value in the URL/Filename (`panw.panos.misc`) field
for the `wildfire` and `wildfire-virus` sub-types.
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
@chrisberkhout
[panw] Map name for more subtypes, fix CSV escaping (elastic#11917)
a292520 
The HTTP Headers field (`panw.panos.http_headers`) of the incoming data
is incorrectly escaped. This will be fixed if necessary before CSV
parsing.

Map the file name value in the URL/Filename (`panw.panos.misc`) field
for the `wildfire` and `wildfire-virus` sub-types.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:panw Palo Alto Next-Gen Firewall Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

5 participants

@chrisberkhout @elasticmachine @qcorporation @mjwolf @andrewkroh