[integrations][trend_micro_vision_one] - Fixed inconsistent time interval issue leading to data loss in the detections data stream - #12425
Conversation
ShourieG
added
Integration:trend_micro_vision_one
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
💚 Build Succeeded
cc @ShourieG |
|
|
@chrisberkhout, could you take a look at this updated logic. I think with the recent info provided, this small change should be enough for the interval gap issue. |
chrisberkhout
left a comment
chrisberkhout
left a comment
There was a problem hiding this comment.
Good. Very nice commit message!
Maybe as a separate change, but it would be good the same thing for the alert and audit as well. They're less affected because they only a last_update_at cursor value for the beginning of a new pagination sequence, but the fix should be as easy there (although with different field names).
|
Package trend_micro_vision_one - 1.24.1 containing this change is available at https://epr.elastic.co/package/trend_micro_vision_one/1.24.1/ |
…rval issue leading to data loss in the detections data stream (elastic#12425) Fixed inconsistent time interval issue leading to data loss in the detections data stream. The cursor time has been updated to the "eventTimeDT" field of the 1st event for every response cycle leading to a smoother time interval without gaps. Events returned are always sorted in decreasing order of time, thus the 1st event of every response will always contain the latest event for that response.
…rval issue leading to data loss in the detections data stream (elastic#12425) Fixed inconsistent time interval issue leading to data loss in the detections data stream. The cursor time has been updated to the "eventTimeDT" field of the 1st event for every response cycle leading to a smoother time interval without gaps. Events returned are always sorted in decreasing order of time, thus the 1st event of every response will always contain the latest event for that response.
3 participants
Type of change
Proposed commit message
Fixed inconsistent time interval issue leading to data loss in the detections data stream. The cursor time has been updated to the "eventTimeDT" field of the 1st event for every response cycle leading to a smoother time interval without gaps. Events returned are always sorted in decreasing order of time, thus the 1st event of every response will always contain the latest event for that response.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots