Skip to content

[Carbon Black Cloud] - Add max_executions config value to CEL data streams - #16690

Merged
ShourieG merged 2 commits into
elastic:mainfrom
ShourieG:enhancement/carbon_black_6762
Dec 24, 2025
Merged

[Carbon Black Cloud] - Add max_executions config value to CEL data streams#16690
ShourieG merged 2 commits into
elastic:mainfrom
ShourieG:enhancement/carbon_black_6762

Conversation

@ShourieG

@ShourieG ShourieG commented Dec 24, 2025

Copy link
Copy Markdown
Contributor

Type of change

  • Enhancement

Proposed commit message

carbon_black_cloud: add max_executions parameter to CEL data streams to prevent pagination limits

Some customers are experiencing issues where pagination was reaching limits during data collection, 
causing incomplete data ingestion or failures. 
This change adds the max_executions configuration parameter to all CEL-enabled data streams, 
allowing users to control the maximum number of pages that can be collected at each interval.

Data streams updated:
- alert_v7
- asset_vulnerability_summary
- audit

Changes:
 - Added max_executions field to manifest.yml for each CEL input stream (default: 1000)
 - Added corresponding max_executions attribute handling in cel.yml.hbs agent configuration

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@ShourieG ShourieG self-assigned this Dec 24, 2025
@ShourieG ShourieG added enhancement New feature or request Integration:carbon_black_cloud VMware Carbon Black Cloud Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Dec 24, 2025
@ShourieG
ShourieG marked this pull request as ready for review December 24, 2025 10:28
@ShourieG
ShourieG requested a review from a team as a code owner December 24, 2025 10:28
@elasticmachine

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@chemamartinez chemamartinez left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine

Copy link
Copy Markdown

💚 Build Succeeded

cc @ShourieG

@ShourieG
ShourieG merged commit 8e1bb91 into elastic:main Dec 24, 2025
8 checks passed
@ShourieG
ShourieG deleted the enhancement/carbon_black_6762 branch December 24, 2025 11:22
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package carbon_black_cloud - 4.1.0 containing this change is available at https://epr.elastic.co/package/carbon_black_cloud/4.1.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:carbon_black_cloud VMware Carbon Black Cloud Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants