Skip to content

sentinel_one: fix unified alert parent process name mapping - #19513

Merged
efd6 merged 1 commit into
elastic:mainfrom
efd6:s7276-sentinel_one
Jun 17, 2026
Merged

sentinel_one: fix unified alert parent process name mapping#19513
efd6 merged 1 commit into
elastic:mainfrom
efd6:s7276-sentinel_one

Conversation

@efd6

@efd6 efd6 commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

Proposed commit message

sentinel_one: fix unified alert parent process name mapping

The unified alert pipeline incorrectly mapped the GraphQL parentName
field to process.parent.command_line instead of process.parent.name.
parentName contains the process name (e.g. "curl"), not a full
command line.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots
@efd6 efd6 self-assigned this Jun 13, 2026
@efd6 efd6 added Integration:sentinel_one SentinelOne bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Jun 13, 2026
@efd6
efd6 force-pushed the s7276-sentinel_one branch from 66f5d88 to f39d8e4 Compare June 13, 2026 07:59
@github-actions

github-actions Bot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@efd6
efd6 marked this pull request as ready for review June 13, 2026 09:54
@efd6
efd6 requested review from a team as code owners June 13, 2026 09:54
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jun 13, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
navnit-elastic
navnit-elastic reviewed Jun 15, 2026
View reviewed changes

@navnit-elastic navnit-elastic left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please update the latest_unified_alert transform destination to declare process.parent.name. Also bump fleet_transform_version.
navnit-elastic
navnit-elastic reviewed Jun 15, 2026
View reviewed changes
Comment thread packages/sentinel_one/data_stream/unified_alert/sample_event.json
"type_value": "STATIC",
"uid": "analytic-uid-001"
},
"assets": [

@navnit-elastic navnit-elastic Jun 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe the structural changes (from arrays to objects) are introduced due to stack version change. However, the pipeline test expected output still uses the array shapes. Recommend regenerating the sample event against a minimum stack version to preserves array shapes.
@andrewkroh andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jun 15, 2026
@efd6
efd6 force-pushed the s7276-sentinel_one branch from f39d8e4 to 4f915ed Compare June 16, 2026 23:54
@efd6
efd6 requested a review from navnit-elastic June 16, 2026 23:54
@efd6
sentinel_one: fix unified alert parent process name mapping
6694df8 
The unified alert pipeline incorrectly mapped the GraphQL parentName
field to process.parent.command_line instead of process.parent.name.
parentName contains the process name (e.g. "curl"), not a full
command line.
@efd6
efd6 force-pushed the s7276-sentinel_one branch from 4f915ed to 6694df8 Compare June 17, 2026 00:33
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.
@elasticmachine

elasticmachine commented Jun 17, 2026

Copy link
Copy Markdown

��� Build Succeeded

History

cc @efd6
navnit-elastic
navnit-elastic approved these changes Jun 17, 2026
View reviewed changes

@navnit-elastic navnit-elastic left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!
@efd6
efd6 merged commit 23526fc into elastic:main Jun 17, 2026
10 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Package sentinel_one - 2.8.1 containing this change is available at https://epr.elastic.co/package/sentinel_one/2.8.1/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:sentinel_one SentinelOne Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

4 participants

@efd6 @elasticmachine @navnit-elastic @andrewkroh