[ti_threatq] Map threat.indicator.provider from name instead of provider by muskan-agarwal26 · Pull Request #13137 · elastic/integrations

muskan-agarwal26 · 2025-03-17T06:16:04Z

Type of change

Enhancement

Proposed commit message

Map threat.indicator.provider from sources.name instead of sources.provider to ensure the Total Indicators per Provider visualization is populated, as the sources.provider field is not available.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/ti_threatq directory.
Run the following command to run tests.

elastic-package test


--- Test results for package: ti_threatq - START ---
╭────────────┬─────────────┬───────────┬─────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE    │ DATA STREAM │ TEST TYPE │ TEST NAME                                                           │ RESULT │ TIME ELAPSED │
├────────────┼─────────────┼───────────┼─────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ ti_threatq │             │ asset     │ dashboard ti_threatq-a05fd810-78f1-11ec-a97c-7db1518ab848 is loaded │ PASS   │      2.382µs │
│ ti_threatq │             │ asset     │ dashboard ti_threatq-ab289de0-78f1-11ec-a97c-7db1518ab848 is loaded │ PASS   │        328ns │
│ ti_threatq │             │ asset     │ dashboard ti_threatq-b45b0c40-78f1-11ec-a97c-7db1518ab848 is loaded │ PASS   │        256ns │
│ ti_threatq │ threat      │ asset     │ index_template logs-ti_threatq.threat is loaded                     │ PASS   │        204ns │
│ ti_threatq │ threat      │ asset     │ ingest_pipeline logs-ti_threatq.threat-1.33.0 is loaded             │ PASS   │        226ns │
╰────────────┴─────────────┴───────────┴─────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: ti_threatq - END   ---
Done
Run pipeline tests for the package
--- Test results for package: ti_threatq - START ---
╭────────────┬─────────────┬───────────┬────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE    │ DATA STREAM │ TEST TYPE │ TEST NAME                                                      │ RESULT │ TIME ELAPSED │
├────────────┼─────────────┼───────────┼────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ ti_threatq │ threat      │ pipeline  │ (ingest pipeline warnings test-threatq-no-preserve-ndjson.log) │ PASS   │ 1.712796695s │
│ ti_threatq │ threat      │ pipeline  │ (ingest pipeline warnings test-threatq-sample-ndjson.log)      │ PASS   │ 491.219202ms │
│ ti_threatq │ threat      │ pipeline  │ test-threatq-no-preserve-ndjson.log                            │ PASS   │ 515.404461ms │
│ ti_threatq │ threat      │ pipeline  │ test-threatq-sample-ndjson.log                                 │ PASS   │ 401.003454ms │
╰────────────┴─────────────┴───────────┴────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: ti_threatq - END   ---
Done
Run policy tests for the package
--- Test results for package: ti_threatq - START ---
No test results
--- Test results for package: ti_threatq - END   ---
Done
Run static tests for the package
--- Test results for package: ti_threatq - START ---
╭────────────┬─────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE    │ DATA STREAM │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├────────────┼─────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ ti_threatq │ threat      │ static    │ Verify sample_event.json │ PASS   │ 177.412115ms │
╰────────────┴─────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: ti_threatq - END   ---
Done
Run system tests for the package
2025/03/17 11:36:53  INFO License text found in "/root/github/integrations/LICENSE.txt" will be included in package
2025/03/17 11:37:58  INFO Write container logs to file: /root/github/integrations/build/container-logs/threatq-1742191678886810568.log
2025/03/17 11:38:07  INFO Write container logs to file: /root/github/integrations/build/container-logs/elastic-agent-1742191687920333285.log
--- Test results for package: ti_threatq - START ---
╭────────────┬─────────────┬───────────┬───────────┬────────┬────────────────╮
│ PACKAGE    │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │   TIME ELAPSED │
├────────────┼─────────────┼───────────┼───────────┼────────┼────────────────┤
│ ti_threatq │ threat      │ system    │ default   │ PASS   │ 1m0.801604187s │
╰────────────┴─────────────┴───────────┴───────────┴────────┴────────────────╯
--- Test results for package: ti_threatq - END   ---
Done

…ider.

kcreddy · 2025-03-17T06:33:05Z

/test

elastic-vault-github-plugin-prod · 2025-03-17T06:49:33Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2025-03-17T07:02:10Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

kcreddy

Nit

kcreddy · 2025-03-17T07:11:08Z

 # newer versions go on top
+- version: "1.33.0"
+  changes:
+    - description: Map threat.indicator.provider from name instead of provider.


Suggested change

- description: Map threat.indicator.provider from name instead of provider.

- description: Map threat.indicator.provider from `sources.name` instead of `sources.provider`.

Also `threat.indicator.provider` since the other fields are being rendered in <pre>.

efd6

Please expand the proposed commit message to explain why this is being done.

efd6 · 2025-03-17T21:40:07Z

 # newer versions go on top
+- version: "1.33.0"
+  changes:
+    - description: Map threat.indicator.provider from name instead of provider.


Also `threat.indicator.provider` since the other fields are being rendered in <pre>.

efd6 · 2025-03-24T22:24:14Z

/test

elastic-sonarqube · 2025-03-24T22:42:48Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
94.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elasticmachine · 2025-03-24T22:42:53Z

💚 Build Succeeded

Buildkite Build
Commit: 0a7a5a0

History

💚 Build #23446 succeeded 07a714f

elastic-vault-github-plugin-prod · 2025-03-24T23:03:19Z

Package ti_threatq - 1.33.0 containing this change is available at https://epr.elastic.co/package/ti_threatq/1.33.0/

…der (#13137) Map threat.indicator.provider from sources.name instead of sources.provider to ensure the Total Indicators per Provider visualization is populated, as the sources.provider field is not available.

Enhancement - Map threat.indicator.provider from name instead of prov…

de5f5d7

…ider.

muskan-agarwal26 requested a review from a team as a code owner March 17, 2025 06:16

Update changelog entry

07a714f

kcreddy added enhancement New feature or request Integration:ti_threatq ThreatQuotient (Partner supported) Crest Contributions from Crest developement team. Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Mar 17, 2025

kcreddy reviewed Mar 17, 2025

View reviewed changes

andrewkroh added the dashboard Relates to a Kibana dashboard bug, enhancement, or modification. label Mar 17, 2025

efd6 reviewed Mar 17, 2025

View reviewed changes

Resolved comments by @efd6

0a7a5a0

efd6 approved these changes Mar 24, 2025

View reviewed changes

efd6 merged commit a5a78e3 into elastic:main Mar 24, 2025

Navigation Menu

Uh oh!

[ti_threatq] Map threat.indicator.provider from name instead of provider - #13137

[ti_threatq] Map threat.indicator.provider from name instead of provider#13137
efd6 merged 3 commits into
elastic:mainfrom
muskan-agarwal26:ti_threatq-1.33.0

muskan-agarwal26 commented Mar 17, 2025 •

edited

Loading

kcreddy commented Mar 17, 2025

elastic-vault-github-plugin-prod Bot commented Mar 17, 2025

elasticmachine commented Mar 17, 2025

kcreddy left a comment

kcreddy Mar 17, 2025

efd6 Mar 17, 2025

efd6 left a comment

efd6 Mar 17, 2025

efd6 commented Mar 24, 2025

elastic-sonarqube Bot commented Mar 24, 2025

elasticmachine commented Mar 24, 2025

elastic-vault-github-plugin-prod Bot commented Mar 24, 2025

Labels

6 participants

	- description: Map threat.indicator.provider from name instead of provider.
	- description: Map threat.indicator.provider from `sources.name` instead of `sources.provider`.

Uh oh!

Conversation

muskan-agarwal26 commented Mar 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

kcreddy commented Mar 17, 2025

elastic-vault-github-plugin-prod Bot commented Mar 17, 2025

🚀 Benchmarks report

elasticmachine commented Mar 17, 2025

kcreddy left a comment

Choose a reason for hiding this comment

kcreddy Mar 17, 2025

Choose a reason for hiding this comment

efd6 Mar 17, 2025

Choose a reason for hiding this comment

efd6 left a comment

Choose a reason for hiding this comment

efd6 Mar 17, 2025

Choose a reason for hiding this comment

efd6 commented Mar 24, 2025

elastic-sonarqube Bot commented Mar 24, 2025

Quality Gate passed

elasticmachine commented Mar 24, 2025

💚 Build Succeeded

History

elastic-vault-github-plugin-prod Bot commented Mar 24, 2025

Labels

6 participants

muskan-agarwal26 commented Mar 17, 2025 •

edited

Loading