Skip to content

sentinel_one: expose max_executions and persist worklist in cursor #18976

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We���ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
efd6 merged 1 commit into from
May 13, 2026
Merged

sentinel_one: expose max_executions and persist worklist in cursor #18976

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/sentinel_one/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.7.0"
changes:
- description: Expose max_executions for the application data stream and persist worklist in cursor across restarts.
type: enhancement
link: https://github.com/elastic/integrations/pull/18976
- version: "2.6.0"
changes:
- description: Add ILM Policy for unified alert data stream.
Expand Down
71 changes: 43 additions & 28 deletions packages/sentinel_one/data_stream/application/_dev/test/policy/test-all.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ inputs:
data_stream:
dataset: sentinel_one.application
interval: 30s
max_executions: 500
processors:
- add_fields:
fields:
Expand All @@ -23,7 +24,7 @@ inputs:
target: environment
program: |-
(
(has(state.?worklist.data) && size(state.worklist.data) > 0) ?
(has(state.?cursor.worklist.data) && size(state.cursor.worklist.data) > 0) ?
state
:
state.with(
Expand All @@ -33,7 +34,7 @@ inputs:
"skipCount": ["true"],
"limit": [string(state.batch_size)],
?"siteIds": state.?site_ids.optMap(v, [string(v)]),
?"cursor": state.?next_page.token.optMap(v, [v]),
?"cursor": state.?cursor.next_page.token.optMap(v, [v]),
}.format_query()
).with(
{
Expand All @@ -44,11 +45,13 @@ inputs:
).do_request().as(resp, (resp.StatusCode == 200) ?
resp.Body.decode_json().as(body,
{
"worklist": body,
"next_page": {
?"token": (body.?pagination.nextCursor.orValue(null) != null) ? optional.of(body.pagination.nextCursor) : optional.none(),
"cursor": {
"worklist": body,
"next_page": {
?"token": (body.?pagination.nextCursor.orValue(null) != null) ? optional.of(body.pagination.nextCursor) : optional.none(),
},
"fetch_more": body.?pagination.nextCursor.orValue(null) != null,
},
"fetch_more": body.?pagination.nextCursor.orValue(null) != null,
}
)
:
Expand All @@ -67,23 +70,24 @@ inputs:
},
"want_more": false,
"offset": 0,
"cursor": {},
}
)
)
).as(state,
state.with(
!has(state.worklist) ? // Exit early due to GET failure.
!has(state.?cursor.worklist) ? // Exit early due to GET failure.
state
: (has(state.worklist.data) && size(state.worklist.data) > 0) ?
: (has(state.cursor.worklist.data) && size(state.cursor.worklist.data) > 0) ?
request(
"GET",
state.url.trim_right("/") + "/web/api/v2.1/application-management/inventory/endpoints?" + {
"skipCount": ["true"],
"applicationName": [string(state.worklist.data[0].applicationName)],
"applicationVendor": [string(state.worklist.data[0].applicationVendor)],
"applicationName": [string(state.cursor.worklist.data[0].applicationName)],
"applicationVendor": [string(state.cursor.worklist.data[0].applicationVendor)],
"limit": [string(state.batch_size)],
?"siteIds": state.?site_ids.optMap(v, [string(v)]),
?"cursor": state.?next_chain.token.optMap(v, [v]),
?"cursor": state.?cursor.next_chain.token.optMap(v, [v]),
}.format_query()
).with(
{
Expand All @@ -93,23 +97,33 @@ inputs:
}
).do_request().as(resp, (resp.StatusCode == 200) ?
resp.Body.decode_json().as(body,
{
"events": (has(body.data) && body.data.size() > 0) ?
body.data.map(e,
{
"message": e.encode_json(),
}
)
:
[{"message": "retry"}],
"next_chain": {
?"token": (body.?pagination.nextCursor.orValue(null) != null) ? optional.of(body.pagination.nextCursor) : optional.none(),
},
"worklist": {
"data": (body.?pagination.nextCursor.orValue(null) != null) ? state.worklist.data : tail(state.worklist.data),
},
"want_more": state.?fetch_more.orValue(false) ? state.fetch_more : (body.?pagination.nextCursor.orValue(null) != null),
}
(body.?pagination.nextCursor.orValue(null) != null).as(has_more_endpoints,
{
"data": has_more_endpoints ? state.cursor.worklist.data : tail(state.cursor.worklist.data),
}.as(new_worklist,
{
"events": (has(body.data) && body.data.size() > 0) ?
body.data.map(e,
{
"message": e.encode_json(),
}
)
:
[{"message": "retry"}],
"want_more": state.?cursor.fetch_more.orValue(false) ? state.cursor.fetch_more : has_more_endpoints,
"cursor": {
"worklist": new_worklist,
"next_page": {
?"token": state.?cursor.next_page.token,
},
"next_chain": {
?"token": has_more_endpoints ? optional.of(body.pagination.nextCursor) : optional.none(),
},
"fetch_more": state.?cursor.fetch_more.orValue(false),
},
}
)
)
)
:
{
Expand All @@ -132,6 +146,7 @@ inputs:
{
"events": [],
"want_more": false,
"cursor": {},
}
)
)
Expand Down
1 change: 1 addition & 0 deletions packages/sentinel_one/data_stream/application/_dev/test/policy/test-all.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ data_stream:
vars:
interval: 30s
batch_size: 100
max_executions: 500
site_ids: 123
tags:
- forwarded
Expand Down
71 changes: 43 additions & 28 deletions packages/sentinel_one/data_stream/application/_dev/test/policy/test-default.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,10 @@ inputs:
data_stream:
dataset: sentinel_one.application
interval: 24h
max_executions: 1000
program: |-
(
(has(state.?worklist.data) && size(state.worklist.data) > 0) ?
(has(state.?cursor.worklist.data) && size(state.cursor.worklist.data) > 0) ?
state
:
state.with(
Expand All @@ -22,7 +23,7 @@ inputs:
"skipCount": ["true"],
"limit": [string(state.batch_size)],
?"siteIds": state.?site_ids.optMap(v, [string(v)]),
?"cursor": state.?next_page.token.optMap(v, [v]),
?"cursor": state.?cursor.next_page.token.optMap(v, [v]),
}.format_query()
).with(
{
Expand All @@ -33,11 +34,13 @@ inputs:
).do_request().as(resp, (resp.StatusCode == 200) ?
resp.Body.decode_json().as(body,
{
"worklist": body,
"next_page": {
?"token": (body.?pagination.nextCursor.orValue(null) != null) ? optional.of(body.pagination.nextCursor) : optional.none(),
"cursor": {
"worklist": body,
"next_page": {
?"token": (body.?pagination.nextCursor.orValue(null) != null) ? optional.of(body.pagination.nextCursor) : optional.none(),
},
"fetch_more": body.?pagination.nextCursor.orValue(null) != null,
},
"fetch_more": body.?pagination.nextCursor.orValue(null) != null,
}
)
:
Expand All @@ -56,23 +59,24 @@ inputs:
},
"want_more": false,
"offset": 0,
"cursor": {},
}
)
)
).as(state,
state.with(
!has(state.worklist) ? // Exit early due to GET failure.
!has(state.?cursor.worklist) ? // Exit early due to GET failure.
state
: (has(state.worklist.data) && size(state.worklist.data) > 0) ?
: (has(state.cursor.worklist.data) && size(state.cursor.worklist.data) > 0) ?
request(
"GET",
state.url.trim_right("/") + "/web/api/v2.1/application-management/inventory/endpoints?" + {
"skipCount": ["true"],
"applicationName": [string(state.worklist.data[0].applicationName)],
"applicationVendor": [string(state.worklist.data[0].applicationVendor)],
"applicationName": [string(state.cursor.worklist.data[0].applicationName)],
"applicationVendor": [string(state.cursor.worklist.data[0].applicationVendor)],
"limit": [string(state.batch_size)],
?"siteIds": state.?site_ids.optMap(v, [string(v)]),
?"cursor": state.?next_chain.token.optMap(v, [v]),
?"cursor": state.?cursor.next_chain.token.optMap(v, [v]),
}.format_query()
).with(
{
Expand All @@ -82,23 +86,33 @@ inputs:
}
).do_request().as(resp, (resp.StatusCode == 200) ?
resp.Body.decode_json().as(body,
{
"events": (has(body.data) && body.data.size() > 0) ?
body.data.map(e,
{
"message": e.encode_json(),
}
)
:
[{"message": "retry"}],
"next_chain": {
?"token": (body.?pagination.nextCursor.orValue(null) != null) ? optional.of(body.pagination.nextCursor) : optional.none(),
},
"worklist": {
"data": (body.?pagination.nextCursor.orValue(null) != null) ? state.worklist.data : tail(state.worklist.data),
},
"want_more": state.?fetch_more.orValue(false) ? state.fetch_more : (body.?pagination.nextCursor.orValue(null) != null),
}
(body.?pagination.nextCursor.orValue(null) != null).as(has_more_endpoints,
{
"data": has_more_endpoints ? state.cursor.worklist.data : tail(state.cursor.worklist.data),
}.as(new_worklist,
{
"events": (has(body.data) && body.data.size() > 0) ?
body.data.map(e,
{
"message": e.encode_json(),
}
)
:
[{"message": "retry"}],
"want_more": state.?cursor.fetch_more.orValue(false) ? state.cursor.fetch_more : has_more_endpoints,
"cursor": {
"worklist": new_worklist,
"next_page": {
?"token": state.?cursor.next_page.token,
},
"next_chain": {
?"token": has_more_endpoints ? optional.of(body.pagination.nextCursor) : optional.none(),
},
"fetch_more": state.?cursor.fetch_more.orValue(false),
},
}
)
)
)
:
{
Expand All @@ -121,6 +135,7 @@ inputs:
{
"events": [],
"want_more": false,
"cursor": {},
}
)
)
Expand Down
1 change: 1 addition & 0 deletions packages/sentinel_one/data_stream/application/_dev/test/policy/test-default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ data_stream:
vars:
interval: 24h
batch_size: 1000
max_executions: 1000
enable_request_tracer: false
preserve_original_event: false
http_client_timeout: 30s
Expand Down
Loading
Loading