Skip to content

sentinel_one: fix handling of events with empty string values - #13478

Merged
efd6 merged 1 commit into
elastic:mainfrom
efd6:13456-sentinel_one
Apr 9, 2025
Merged

sentinel_one: fix handling of events with empty string values#13478
efd6 merged 1 commit into
elastic:mainfrom
efd6:13456-sentinel_one

Conversation

@efd6

@efd6 efd6 commented Apr 8, 2025

Copy link
Copy Markdown
Contributor

Proposed commit message

sentinel_one: fix handling of events with empty string values

The particular case in #13456 is that the IP conversion of agentIpV6 in
convert_agentIpV6_to_ip fails because the field contains "". The field is a list
so a simple check for the empty string will not guard against this. Instead of
special-casing this field, just remove all empty fields from the parsed JSON at
the outset.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots
@efd6 efd6 added Integration:sentinel_one SentinelOne bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Apr 8, 2025
@efd6 efd6 self-assigned this Apr 8, 2025
@efd6
efd6 force-pushed the 13456-sentinel_one branch from 49874b1 to a7cd4ac Compare April 8, 2025 23:33
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Apr 8, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

Package sentinel_one 👍(0) 💚(1) 💔(4)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
activity 2415.46 1776.2 -639.26 (-26.47%) 💔
agent 2932.55 1831.5 -1101.05 (-37.55%) 💔
alert 2824.86 1666.67 -1158.19 (-41%) 💔
threat 1642.04 1102.54 -539.5 (-32.86%) 💔

To see the full report comment with /test benchmark fullreport
@efd6
efd6 marked this pull request as ready for review April 8, 2025 23:55
@efd6
efd6 requested a review from a team as a code owner April 8, 2025 23:55
@elasticmachine

elasticmachine commented Apr 8, 2025

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@efd6
sentinel_one: fix handling of events with empty string values
abac8e7 
The particular case in elastic#13456 is that the IP conversion of agentIpV6 in
convert_agentIpV6_to_ip fails because the field contains "". The field is a list
so a simple check for the empty string will not guard against this. Instead of
special-casing this field, just remove all empty fields from the parsed JSON at
the outset.
@efd6
efd6 force-pushed the 13456-sentinel_one branch from a7cd4ac to abac8e7 Compare April 8, 2025 23:58
@elasticmachine

elasticmachine commented Apr 9, 2025

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @efd6
@elastic-sonarqube

elastic-sonarqube Bot commented Apr 9, 2025

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@efd6
efd6 merged commit 761f544 into elastic:main Apr 9, 2025
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Apr 9, 2025

Copy link
Copy Markdown
Contributor

Package sentinel_one - 1.31.1 containing this change is available at https://epr.elastic.co/package/sentinel_one/1.31.1/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:sentinel_one SentinelOne Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@efd6 @elasticmachine @kcreddy