Skip to content

[Amazon Security Lake] Improve the handling of ocsf.resource for serverless environment - #16304

Merged
moxarth-rathod merged 2 commits into
elastic:mainfrom
moxarth-rathod:amazon-security-lake-fix-flaky-tests
Dec 10, 2025
Merged

[Amazon Security Lake] Improve the handling of ocsf.resource for serverless environment#16304
moxarth-rathod merged 2 commits into
elastic:mainfrom
moxarth-rathod:amazon-security-lake-fix-flaky-tests

Conversation

@moxarth-rathod

@moxarth-rathod moxarth-rathod commented Dec 4, 2025

Copy link
Copy Markdown
Contributor

Proposed commit message

amazon_security_lake: improve ocsf.resource handling in the event data stream for serverless

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Related issues

@moxarth-rathod moxarth-rathod self-assigned this Dec 4, 2025
@moxarth-rathod
moxarth-rathod requested a review from a team as a code owner December 4, 2025 09:37
@moxarth-rathod moxarth-rathod added Integration:amazon_security_lake Amazon Security Lake Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Dec 4, 2025
@elasticmachine

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@moxarth-rathod

Copy link
Copy Markdown
Contributor Author

The previous method of adding the resource object inside the resources array showed different behavior in the serverless environment compared to the local environment. Even after appending [] to resources, it was still treated as a map, which caused the issue of the data field not being found. Since the issue is already covered by existing logs, no additional tests are required.

Serverless environment with the elastic-package is used to test this issue.

Comment thread packages/amazon_security_lake/changelog.yml Outdated
Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @moxarth-rathod

@moxarth-rathod
moxarth-rathod requested a review from efd6 December 8, 2025 06:02
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package amazon_security_lake - 2.8.1 containing this change is available at https://epr.elastic.co/package/amazon_security_lake/2.8.1/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Integration:amazon_security_lake Amazon Security Lake Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants