[axonius] Add initial integration with Adapter data stream#16171
[axonius] Add initial integration with Adapter data stream#16171kcreddy merged 7 commits intoelastic:feature/axonius-0.1.0from
Conversation
andrewkroh
added
documentation
efd6
left a comment
efd6
left a comment
There was a problem hiding this comment.
I think you are using and older version of dispear. Please update the version the go.mod to the latest version.
Rémy suggests the following commit message:
axonius: add initial integration with adapter data stream
This introduces a new Axonius integration for cybersecurity asset
management, enabling collection of adapter health and performance data
through the Axonius API. The integration provides visibility into
adapter status, connection health, and configuration details to help
teams maintain reliable data ingestion and identify problematic
integrations.
Test samples were derived from live data samples, which were subsequently
sanitized.
packages/axonius/data_stream/adapter/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
packages/axonius/data_stream/adapter/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
packages/axonius/data_stream/adapter/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
| - set: | ||
| tag: set_event_id | ||
| field: event.id | ||
| copy_from: axonius.adapter.id | ||
| ignore_empty_value: true | ||
| - set: | ||
| tag: set_event_outcome_1 | ||
| if: ctx.axonius?.adapter?.status != null && ctx.axonius.adapter.status.toLowerCase() == 'success' | ||
| field: event.outcome | ||
| value: success | ||
| - set: | ||
| tag: set_event_outcome_2 | ||
| if: ctx.axonius?.adapter?.status != null && ctx.axonius.adapter.status.toLowerCase() == 'error' | ||
| field: event.outcome | ||
| value: failure |
There was a problem hiding this comment.
The tags that dispear.SET autocreates are not as informative as they really should be (this is a limitation that arises from the nature of the set processor. So suggest making an explicit tag, e.g. .TAG(fmt.Sprintf("set %s to %s", field, value) for the event.outcome cases (this can be a for loop if you want). Similarly for the one before that, .TAG(fmt.Sprintf("set %s from %s", mapping.ecsField, mapping.customField).
There was a problem hiding this comment.
Can you update the generator in the description to match the new pipeline? Note also the " to " and " from " in the format strings in my suggestion.
Also, can you tell me what the github.com/efd6/dispear line in the go.mod is? This still does not look like the behaviour I would expect from the latest version.
There was a problem hiding this comment.
Yes, the current dispear version is outdated (v0.0.0-20250915050336-00bed7647aca).
We’ll update the script and switch to the latest official version.
There was a problem hiding this comment.
I don't think this has happened yet.
There was a problem hiding this comment.
@muskan-agarwal26, this appears to be still pending. Also the commit message update that @efd6 mentioned here.
There was a problem hiding this comment.
Sorry, missed it, will update it
There was a problem hiding this comment.
@muskan-agarwal26, can you update the Go code above in the PR description as well?
There was a problem hiding this comment.
Yes, I have updated that too.
1. Remove transform from readme and final new line. 2. Updated tags and indentation in scriptprocessor.
narph
added
the
Team:Security-Service Integrations
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
kcreddy
left a comment
kcreddy
left a comment
There was a problem hiding this comment.
I reviewed the pending comments from Dan's review. LGTM!
7 participants
Proposed commit message
This introduces a new Axonius integration for cybersecurity asset management, enabling collection of adapter health and performance data through the Axonius API. The integration provides visibility into adapter status, connection health, and configuration details to help teams maintain reliable data ingestion and identify problematic integrations.
Test samples were derived from live data samples, which were subsequently sanitized.
Checklist
changelog.ymlfile.How to test this PR locally
To test the axonius package:
Related issues
Screenshots
Go Code for Ingest Pipeline Generation
The adapter data stream pipeline is generated using Go code built on top of the Dispear library.
Below is the code used for generating the pipeline logic: