[zscaler_zia] Update Event Type and Add Event Outcome - #13894
Merged
Conversation
mohitjha-elastic
added
enhancement
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
Contributor
🚀 Benchmarks reportTo see the full report comment with |
efd6
reviewed
May 14, 2025
Contributor
There was a problem hiding this comment.
Suggested commit message
zscaler_zia: improve event.type and event.outcome mapping
Previously, the event.type ECS field was mapped to 'info'. It has now
been updated to 'access', as this more accurately reflects the nature
of the events. Additionally, the event.outcome ECS field is now being
set based on the existing event.action field in the pipeline, allowing
us to determine whether access was granted or denied.
(no need to mention tests because no new tests are added)
Comment on lines
+134
to
+138
| - set: | ||
| tag: set_event_outcome_failure | ||
| field: event.outcome | ||
| value: failure | ||
| if: ctx.event?.action == 'denied' || ctx.event?.action == 'blocked' |
Contributor
There was a problem hiding this comment.
Suggested change
| - set: | |
| tag: set_event_outcome_failure | |
| field: event.outcome | |
| value: failure | |
| if: ctx.event?.action == 'denied' || ctx.event?.action == 'blocked' | |
| - set: | |
| tag: set_event_outcome_failure | |
| field: event.outcome | |
| value: failure | |
| if: ctx.event?.action == 'denied' || ctx.event?.action == 'blocked' | |
| - set: | |
| tag: set_event_outcome_unknown | |
| field: event.outcome | |
| value: unknown | |
| if: ctx.event?.outcome == null |
Add event.outcome as unknown when this is not set as success or failure.
…grations into zscaler_zia-3.11.0
💚 Build Succeeded
History
|
|
efd6
approved these changes
May 14, 2025
Contributor
|
Package zscaler_zia - 3.11.0 containing this change is available at https://epr.elastic.co/package/zscaler_zia/3.11.0/ |
anupratharamachandran
pushed a commit
to anupratharamachandran/integrations
that referenced
this pull request
Jun 2, 2025
…3894) Previously, the event.type ECS field was mapped to 'info'. It has now been updated to 'access', as this more accurately reflects the nature of the events. Additionally, the event.outcome ECS field is now being set based on the existing event.action field in the pipeline, allowing us to determine whether access was granted or denied.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed Commit Message
Checklist
changelog.ymlfile.How to test this PR locally
Clone integrations repo.
Install the elastic package locally.
Start the elastic stack using the elastic package.
Move to integrations/packages/zscaler_zia directory.
Run the following command to run tests.
elastic-package test -vRelated issues