Skip to content

[watchguard_firebox] Support email addresses in 2500-0000 and 2500-0001 events - #12909

Merged
taylor-swanson merged 3 commits into
elastic:mainfrom
taylor-swanson:enhance/watchguard_log-email
Feb 27, 2025
Merged

[watchguard_firebox] Support email addresses in 2500-0000 and 2500-0001 events#12909
taylor-swanson merged 3 commits into
elastic:mainfrom
taylor-swanson:enhance/watchguard_log-email

Conversation

@taylor-swanson

@taylor-swanson taylor-swanson commented Feb 26, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

  • Support email addresses in 2500-0000 and 2500-0001 events and append email address to related.user

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

cd packages/watchguard_firebox
elastic-package test

Related issues
@taylor-swanson
[watchguard_firebox] Support email addresses in 2500-0000 and 2500-00…
3f85f3d 
…01 events

- Support email addresses in 2500-0000 and 2500-0001 events and append
email address to related.user
@taylor-swanson taylor-swanson added enhancement New feature or request Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices] Integration:watchguard_firebox WatchGuard Firebox labels Feb 26, 2025
@taylor-swanson taylor-swanson self-assigned this Feb 26, 2025
@taylor-swanson
taylor-swanson marked this pull request as ready for review February 26, 2025 20:59
@taylor-swanson
taylor-swanson requested a review from a team as a code owner February 26, 2025 20:59
@elasticmachine

elasticmachine commented Feb 26, 2025

Copy link
Copy Markdown

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Feb 26, 2025

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
jrmolin
jrmolin approved these changes Feb 27, 2025
View reviewed changes

@jrmolin jrmolin left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why add the user_email field? couldn't you just rename that to user.email? i'm just curious
@taylor-swanson

taylor-swanson commented Feb 27, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

why add the user_email field? couldn't you just rename that to user.email? i'm just curious

Keeps it more or less consistent with the other fields (namely user_name)

Oh I see what I missed, one moment.. new change coming.
@taylor-swanson

taylor-swanson commented Feb 27, 2025

Copy link
Copy Markdown
Contributor Author

Okay, so I had forgotten to add user_email to the remove list, but that won't show up as removed in the test as preserve_duplicate_custom_fields is enabled.
@elastic-sonarqube

elastic-sonarqube Bot commented Feb 27, 2025

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
94.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@elasticmachine

elasticmachine commented Feb 27, 2025

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @taylor-swanson
@taylor-swanson
taylor-swanson merged commit 106d90a into elastic:main Feb 27, 2025
@taylor-swanson
taylor-swanson deleted the enhance/watchguard_log-email branch February 27, 2025 21:04
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Feb 27, 2025

Copy link
Copy Markdown
Contributor

Package watchguard_firebox - 1.2.0 containing this change is available at https://epr.elastic.co/package/watchguard_firebox/1.2.0/
flexitrev pushed a commit that referenced this pull request Mar 20, 2025
@taylor-swanson @flexitrev
[watchguard_firebox] Support email addresses in 2500-0000 and 2500-00…
4b55471 
…01 events (#12909)

- Support email addresses in 2500-0000 and 2500-0001 events and append
email address to related.user
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:watchguard_firebox WatchGuard Firebox Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices]

4 participants

@taylor-swanson @elasticmachine @jrmolin @mjwolf