Skip to content

ti_abusech: improve ECS compatibility and tests - #14586

Merged
navnit-elastic merged 1 commit into
elastic:mainfrom
navnit-elastic:ti_abusech-3.1.0
Jul 22, 2025
Merged

ti_abusech: improve ECS compatibility and tests#14586
navnit-elastic merged 1 commit into
elastic:mainfrom
navnit-elastic:ti_abusech-3.1.0

Conversation

@navnit-elastic

@navnit-elastic navnit-elastic commented Jul 18, 2025

Copy link
Copy Markdown

Proposed commit message

ti_abusech: improve ECS compatibility and tests

Add terminate processor in ingest pipelines to filter out events
containing CEL errors. Add the threat.indicator.marking.tlp ECS
field mapping in Threatfox and MalwareBazaar data streams.
Add threat.indicator.confidence ECS field mapping in
Malware data stream. Combine two configuration file
into a single file for system tests.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots
@navnit-elastic navnit-elastic self-assigned this Jul 18, 2025
@navnit-elastic navnit-elastic added enhancement New feature or request Integration:ti_abusech abuse.ch Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Jul 18, 2025
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 18, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@navnit-elastic
navnit-elastic marked this pull request as ready for review July 18, 2025 08:24
@navnit-elastic
navnit-elastic requested a review from a team as a code owner July 18, 2025 08:24
@elasticmachine

elasticmachine commented Jul 18, 2025

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
chemamartinez
chemamartinez reviewed Jul 18, 2025
View reviewed changes
Comment thread packages/ti_abusech/data_stream/malware/elasticsearch/ingest_pipeline/default.yml Outdated
Comment thread packages/ti_abusech/data_stream/threatfox/elasticsearch/ingest_pipeline/default.yml
@elastic-sonarqube

elastic-sonarqube Bot commented Jul 18, 2025

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
84.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@elasticmachine

elasticmachine commented Jul 18, 2025

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @navnit-elastic
@navnit-elastic
navnit-elastic merged commit 3a16c02 into elastic:main Jul 22, 2025
9 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 22, 2025

Copy link
Copy Markdown
Contributor

Package ti_abusech - 3.1.0 containing this change is available at https://epr.elastic.co/package/ti_abusech/3.1.0/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:ti_abusech abuse.ch Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@navnit-elastic @elasticmachine @chemamartinez