ssi: add processor tags and preserve_original_event on failure (3/4) by kcreddy · Pull Request #20574 · elastic/integrations

kcreddy · 2026-08-06T14:07:42Z

Proposed commit message

ssi: add processor tags and preserve_original_event on failure (3/4)

Tag every ingest pipeline processor across 52 SSI-owned packages
(servicenow through zscaler_zpa), so that failure telemetry can
attribute an error to the step that produced it rather than collapsing
same-type processors into one bucket. All 20605 processors across the
265 pipeline files now carry a tag, 10045 of them newly, including
those nested inside `on_failure` handlers and `foreach` bodies, and
those in the pipeline-level `on_failure` block.

Existing tags keep their name. Where a name was not already unique in
its pipeline, or the processor had no tag at all, it gains an 8-hex
suffix hashed over the processor's content and everything enclosing it.
Tags that already carried a hash are left byte-identical -- 81 of them,
in ti_anomali and zscaler_zia, which shipped tags before this series; a
hash is only meaningful relative to the generator that produced it, so
re-hashing a published tag churns a value consumers may key off. Those
two packages therefore keep the earlier suffix format. Tags that would
have said nothing (`script_<hash>`, `fail_<hash>`) are seeded from the
processor's description, name, message or preceding comment, and tags
whose leading word named the wrong action (`set_...` on an append) are
corrected.

Add preserve_original_event to pipeline-level on_failure handlers that
were missing it, ensuring the raw payload is retained when a pipeline
error document is indexed. Twelve of the 52 packages needed it.

Ten processors across six packages were exact duplicates of an earlier
sibling and could never have any effect; they are removed rather than
given a disambiguating tag. Three further fixes ride along, each in the
affected package's changelog:

  - ti_socradar_taxii: event.original was removed before
    preserve_original_event was added to tags, so pipeline_error
    documents never retained the payload. The removal is dropped and
    the test expectations regenerated.
  - wiz, ti_eset: pipeline-level on_failure set error.message instead
    of appending, discarding what processor-level handlers recorded.
    error.message is now an array on failed documents.

These are enhancements, so the packages take a minor version bump.

Updates #20558

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

Relates SSI: Standardize processor tagging and event.original preservation across owned pipelines #20558

Tag every ingest pipeline processor across 52 SSI-owned packages (servicenow through zscaler_zpa) with a unique, descriptive identifier so that failure telemetry can attribute errors to the specific step that failed rather than collapsing same-type processors into one bucket. Add preserve_original_event to pipeline-level on_failure handlers that were missing it, ensuring the raw payload is retained when a pipeline error document is indexed. Updates elastic#20558

github-actions · 2026-08-06T14:09:10Z

Elastic Docs Style Checker (Vale)

Summary: 106 warnings, 81 suggestions found

⚠️ Warnings (106): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/servicenow/changelog.yml	130	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/servicenow/changelog.yml	135	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/slack/changelog.yml	59	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/snyk/changelog.yml	111	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/sophos_central/changelog.yml	49	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/sophos_central/manifest.yml	79	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/sophos_central/manifest.yml	86	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/sophos_central/manifest.yml	98	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/spycloud/changelog.yml	54	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/spycloud/changelog.yml	59	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/spycloud/manifest.yml	71	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/sublime_security/changelog.yml	114	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/sublime_security/changelog.yml	119	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/sublime_security/manifest.yml	78	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/sublime_security/manifest.yml	202	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/symantec_endpoint_security/changelog.yml	107	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/symantec_endpoint_security/changelog.yml	117	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/symantec_endpoint_security/manifest.yml	103	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/sysdig/changelog.yml	88	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/sysdig/manifest.yml	83	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/tanium/changelog.yml	54	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/tanium/manifest.yml	172	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/teleport/changelog.yml	68	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/tenable_io/changelog.yml	177	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/tenable_io/changelog.yml	187	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/tenable_io/manifest.yml	81	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/tenable_ot_security/manifest.yml	51	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/tenable_ot_security/manifest.yml	87	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/tenable_sc/changelog.yml	94	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/tenable_sc/manifest.yml	58	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/thycotic_ss/changelog.yml	39	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_anomali/changelog.yml	14	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/ti_anomali/changelog.yml	140	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_anomali/manifest.yml	58	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/ti_anomali/manifest.yml	58	Elastic.DirectionalLanguage	Don't use directional language. Use 'earlier on this page' instead of 'described above'.
packages/ti_anyrun/manifest.yml	56	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/ti_cif3/changelog.yml	54	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_cif3/manifest.yml	42	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/ti_crowdstrike/changelog.yml	84	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_crowdstrike/changelog.yml	94	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_crowdstrike/manifest.yml	86	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/ti_custom/changelog.yml	145	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_cybersixgill/changelog.yml	59	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_eclecticiq/changelog.yml	59	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_eset/changelog.yml	54	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_eset/changelog.yml	64	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_google_threat_intelligence/changelog.yml	136	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_google_threat_intelligence/changelog.yml	136	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_google_threat_intelligence/manifest.yml	91	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/ti_google_threat_intelligence/manifest.yml	95	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/ti_google_threat_intelligence/manifest.yml	95	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/ti_maltiverse/changelog.yml	46	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_mandiant_advantage/changelog.yml	34	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_mandiant_advantage/changelog.yml	39	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_misp/changelog.yml	102	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_opencti/changelog.yml	113	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_opencti/manifest.yml	58	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'E.g'.
packages/ti_opencti/manifest.yml	73	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/ti_opencti/manifest.yml	117	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/ti_otx/changelog.yml	59	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_rapid7_threat_command/changelog.yml	69	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_rapid7_threat_command/changelog.yml	84	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_rapid7_threat_command/manifest.yml	96	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/ti_recordedfuture/changelog.yml	107	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_recordedfuture/changelog.yml	107	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/ti_recordedfuture/changelog.yml	130	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_recordedfuture/manifest.yml	82	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/ti_recordedfuture/manifest.yml	86	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/ti_recordedfuture/manifest.yml	86	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/ti_socradar_taxii/manifest.yml	80	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/ti_threatconnect/changelog.yml	112	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_threatconnect/changelog.yml	122	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/ti_threatconnect/manifest.yml	72	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/ti_threatq/changelog.yml	97	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/tines/changelog.yml	44	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/tines/manifest.yml	50	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/trellix_edr_cloud/changelog.yml	39	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/trellix_edr_cloud/changelog.yml	49	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/trellix_edr_cloud/manifest.yml	133	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/trellix_epo_cloud/changelog.yml	29	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/trellix_epo_cloud/changelog.yml	39	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/trellix_epo_cloud/changelog.yml	109	Elastic.BritishSpellings	Use American English spelling 'behavior' instead of British English 'behaviour'.
packages/trellix_epo_cloud/manifest.yml	100	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/trendmicro/changelog.yml	39	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/trendmicro/changelog.yml	49	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/vectra_detect/changelog.yml	24	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/vectra_detect/changelog.yml	34	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/wiz/changelog.yml	164	Elastic.MenuArrows	Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy.
packages/wiz/changelog.yml	209	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/wiz/changelog.yml	224	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/wiz/changelog.yml	275	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/wiz/manifest.yml	116	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/xm_cyber/manifest.yml	65	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/xm_cyber/manifest.yml	78	Elastic.DontUse	Don't use 'Please'. Choose a more precise or reader-focused term.
packages/xm_cyber/manifest.yml	84	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'that is' instead of 'i.e'.
packages/xm_cyber/manifest.yml	84	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/zerofox/changelog.yml	34	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/zerofox/changelog.yml	134	Elastic.DontUse	Don't use 'and/or'. Choose a more precise or reader-focused term.
packages/zeronetworks/changelog.yml	44	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/zoom/changelog.yml	50	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/zoom/changelog.yml	130	Elastic.DontUse	Don't use 'and/or'. Choose a more precise or reader-focused term.
packages/zscaler_zia/changelog.yml	167	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/zscaler_zia/changelog.yml	172	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/zscaler_zia/changelog.yml	364	Elastic.DontUse	Don't use 'and/or'. Choose a more precise or reader-focused term.
packages/zscaler_zpa/changelog.yml	70	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/zscaler_zpa/changelog.yml	155	Elastic.DontUse	Don't use 'and/or'. Choose a more precise or reader-focused term.

💡 Suggestions (81): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
packages/servicenow/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/servicenow/changelog.yml	24	Elastic.Wordiness	Consider using 'remove' instead of 'eliminate'.
packages/servicenow/changelog.yml	59	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/slack/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/snyk/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/sophos_central/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/splunk/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/splunk/changelog.yml	62	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/spycloud/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/spycloud/changelog.yml	34	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/sublime_security/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/sublime_security/changelog.yml	49	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/sublime_security/manifest.yml	60	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/symantec_endpoint_security/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/symantec_endpoint_security/changelog.yml	32	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/sysdig/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/sysdig/changelog.yml	35	Elastic.WordChoice	Consider using 'cancel, stop' instead of 'kill', unless the term is in the UI.
packages/sysdig/changelog.yml	53	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/tanium/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/tanium/manifest.yml	165	Elastic.Wordiness	Consider using 'before' instead of 'prior to'.
packages/teleport/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/teleport/changelog.yml	53	Elastic.Wordiness	Consider using 'consider' instead of 'take into account'.
packages/tenable_io/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/tenable_io/changelog.yml	29	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/tenable_io/changelog.yml	101	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/tenable_ot_security/changelog.yml	34	Elastic.Wordiness	Consider using 'impossible' instead of 'not possible'.
packages/tenable_ot_security/changelog.yml	83	Elastic.Wordiness	Consider using 'remove' instead of 'eliminate'.
packages/tenable_sc/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/tenable_sc/manifest.yml	4	Elastic.Wordiness	Consider using 'to' instead of 'in order to'.
packages/tencent_cloud/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/thycotic_ss/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_anomali/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_anomali/changelog.yml	95	Elastic.Wordiness	Consider using 'remove' instead of 'eliminate'.
packages/ti_anomali/changelog.yml	243	Elastic.WordChoice	Consider using 'efficiently' instead of 'easily', unless the term is in the UI.
packages/ti_anyrun/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_cif3/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_crowdstrike/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_custom/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_custom/changelog.yml	84	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/ti_cybersixgill/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_domaintools/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_eclecticiq/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_eclecticiq/changelog.yml	39	Elastic.Wordiness	Consider using 'per' instead of 'as per'.
packages/ti_eset/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_google_threat_intelligence/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_google_threat_intelligence/changelog.yml	131	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/ti_mandiant_advantage/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_misp/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_misp/changelog.yml	29	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
packages/ti_opencti/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_opencti/changelog.yml	88	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/ti_opencti/changelog.yml	93	Elastic.Wordiness	Consider using 'per' instead of 'as per'.
packages/ti_otx/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_rapid7_threat_command/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_recordedfuture/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_recordedfuture/changelog.yml	25	Elastic.WordChoice	Consider using 'misuse' instead of 'abuse', unless the term is in the UI.
packages/ti_recordedfuture/changelog.yml	25	Elastic.WordChoice	Consider using 'misuse' instead of 'abuse', unless the term is in the UI.
packages/ti_recordedfuture/changelog.yml	80	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/ti_recordedfuture/changelog.yml	258	Elastic.WordChoice	Consider using 'efficiently' instead of 'easily', unless the term is in the UI.
packages/ti_socradar_taxii/manifest.yml	92	Elastic.Ellipses	Use ellipses sparingly. Remove the ellipsis unless it appears in UI text.
packages/ti_strider/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_threatconnect/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/ti_threatconnect/changelog.yml	62	Elastic.Wordiness	Consider using 'per' instead of 'as per'.
packages/ti_threatq/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/tines/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/trellix_edr_cloud/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/trellix_epo_cloud/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/trendmicro/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/vectra_detect/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/wiz/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/wiz/changelog.yml	45	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/wiz/changelog.yml	129	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/wiz/changelog.yml	242	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/workday/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/xm_cyber/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/zerofox/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/zeronetworks/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/zoom/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/zscaler_zia/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.
packages/zscaler_zia/changelog.yml	92	Elastic.WordChoice	Consider using 'stop, exit' instead of 'terminate', unless the term is in the UI.
packages/zscaler_zpa/changelog.yml	1	Elastic.Versions	Use 'later versions' instead of 'newer versions' when referring to versions.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

Update the link field in each new changelog entry from the tracking issue to the merged pull request. Updates elastic#20558

elastic-vault-github-plugin-prod · 2026-08-06T15:10:56Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

Tag every ingest pipeline processor across 52 SSI-owned packages (servicenow through zscaler_zpa) with a unique, descriptive identifier so that failure telemetry can attribute an error to the step that produced it rather than collapsing same-type processors into one bucket. `_ingest.on_failure_processor_tag` is only useful when the tag is both present and unique, so all 20278 processors across the 263 pipeline files now carry one -- including those nested inside `on_failure` handlers and `foreach` bodies, and those in the pipeline-level `on_failure` block, which are the easiest to overlook. Tags that already existed are kept as they are. They are quoted in error.message strings, dashboards and runbooks, so renaming one is a breaking change for whatever reads it. Where a name was already used by more than one processor in the same pipeline, the first occurrence keeps it and the later ones take a short hash suffix; a handful of tags written as free text ("Add ECS categorization") become identifiers. Add preserve_original_event to pipeline-level on_failure handlers that were missing it, ensuring the raw payload is retained when a pipeline error document is indexed. Thirteen of the 52 packages needed it. Ten processors were exact duplicates of an earlier sibling and so could never have any effect. Remove them rather than give them a disambiguating tag; each affected package records the removal in its changelog. Updates elastic#20558

…l-standards-3

Tag every ingest pipeline processor across 52 SSI-owned packages (servicenow through zscaler_zpa) with a `<name>_<content hash>` identifier, so that failure telemetry can attribute an error to the step that produced it rather than collapsing same-type processors into one bucket. All 20606 processors across the 265 pipeline files now carry a tag, including those nested inside `on_failure` handlers and `foreach` bodies, and those in the pipeline-level `on_failure` block. The hash is taken over the processor's content together with every processor enclosing it, with `tag` keys stripped. This makes uniqueness mechanical rather than positional, and gives identical constructs the same identity in every package, so a single query aggregates failures for one step across the whole estate; the hash carries that identity, the readable prefix is for humans. Add preserve_original_event to pipeline-level on_failure handlers that were missing it, ensuring the raw payload is retained when a pipeline error document is indexed. Two fixes ride along, each recorded in the affected package's changelog: - wiz: the pipeline-level `on_failure` handlers for the two cloud_configuration_finding data streams set `error.message` instead of appending to it, discarding what the processor-level handlers had already recorded. - ti_eset: the same `set` pattern in seven pipelines. Those record no processor-level errors, so this is a consistency fix with no change in behaviour. Ten processors that were exact duplicates of an earlier sibling, and so could never have any effect, are removed rather than given a disambiguating tag. These are enhancements, so the packages take a minor version bump. Updates elastic#20558

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

infra-vault-gh-plugin-prod · 2026-08-12T14:52:32Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

efd6

Relatively lightly reviewed. I checked all the obvious significant changes and changes called out by changelog entries.

LGTM after nits addressed.

efd6 · 2026-08-17T05:12:50Z

            field: error.message
            value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
  - dot_expander:
+      tag: dot_expander_*_b6f542ad


I don't think this is a good idea.

efd6 · 2026-08-17T06:19:12Z

+            category: failure - session
+            outcome:


Suggested change

category: failure - session

outcome:

category:

- session

outcome:

- failure

efd6 · 2026-08-17T06:19:49Z

Add bugfix for the damaged syntax above.

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

elastic-vault-github-plugin-prod · 2026-08-18T19:43:24Z

Package ti_eclecticiq - 1.8.0 containing this change is available at https://epr.elastic.co/package/ti_eclecticiq/1.8.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:25Z

Package ti_eset - 1.12.0 containing this change is available at https://epr.elastic.co/package/ti_eset/1.12.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:25Z

Package ti_google_threat_intelligence - 1.3.0 containing this change is available at https://epr.elastic.co/package/ti_google_threat_intelligence/1.3.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:26Z

Package ti_maltiverse - 1.9.0 containing this change is available at https://epr.elastic.co/package/ti_maltiverse/1.9.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:27Z

Package ti_mandiant_advantage - 1.12.0 containing this change is available at https://epr.elastic.co/package/ti_mandiant_advantage/1.12.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:28Z

Package ti_misp - 1.45.0 containing this change is available at https://epr.elastic.co/package/ti_misp/1.45.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:29Z

Package ti_opencti - 2.16.0 containing this change is available at https://epr.elastic.co/package/ti_opencti/2.16.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:29Z

Package ti_otx - 1.33.0 containing this change is available at https://epr.elastic.co/package/ti_otx/1.33.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:30Z

Package ti_rapid7_threat_command - 2.11.0 containing this change is available at https://epr.elastic.co/package/ti_rapid7_threat_command/2.11.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:31Z

Package ti_recordedfuture - 2.8.0 containing this change is available at https://epr.elastic.co/package/ti_recordedfuture/2.8.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:32Z

Package ti_socradar_taxii - 0.3.0 containing this change is available at https://epr.elastic.co/package/ti_socradar_taxii/0.3.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:33Z

Package ti_strider - 0.2.0 containing this change is available at https://epr.elastic.co/package/ti_strider/0.2.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:33Z

Package ti_threatconnect - 2.4.0 containing this change is available at https://epr.elastic.co/package/ti_threatconnect/2.4.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:34Z

Package ti_threatq - 1.40.0 containing this change is available at https://epr.elastic.co/package/ti_threatq/1.40.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:35Z

Package ti_ticura - 0.2.0 containing this change is available at https://epr.elastic.co/package/ti_ticura/0.2.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:36Z

Package tines - 1.18.0 containing this change is available at https://epr.elastic.co/package/tines/1.18.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:37Z

Package trellix_edr_cloud - 1.10.0 containing this change is available at https://epr.elastic.co/package/trellix_edr_cloud/1.10.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:38Z

Package trellix_epo_cloud - 1.17.0 containing this change is available at https://epr.elastic.co/package/trellix_epo_cloud/1.17.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:39Z

Package trendmicro - 2.10.0 containing this change is available at https://epr.elastic.co/package/trendmicro/2.10.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:40Z

Package varonis - 1.1.0 containing this change is available at https://epr.elastic.co/package/varonis/1.1.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:40Z

Package vectra_detect - 1.15.0 containing this change is available at https://epr.elastic.co/package/vectra_detect/1.15.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:41Z

Package wiz - 4.7.0 containing this change is available at https://epr.elastic.co/package/wiz/4.7.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:42Z

Package workday - 0.4.0 containing this change is available at https://epr.elastic.co/package/workday/0.4.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:43Z

Package xm_cyber - 0.4.0 containing this change is available at https://epr.elastic.co/package/xm_cyber/0.4.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:44Z

Package zerofox - 1.31.0 containing this change is available at https://epr.elastic.co/package/zerofox/1.31.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:45Z

Package zeronetworks - 1.21.0 containing this change is available at https://epr.elastic.co/package/zeronetworks/1.21.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:45Z

Package zoom - 1.28.0 containing this change is available at https://epr.elastic.co/package/zoom/1.28.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:46Z

Package zscaler_zia - 4.3.0 containing this change is available at https://epr.elastic.co/package/zscaler_zia/4.3.0/

elastic-vault-github-plugin-prod · 2026-08-18T19:43:47Z

Package zscaler_zpa - 1.24.0 containing this change is available at https://epr.elastic.co/package/zscaler_zpa/1.24.0/

ssi: update changelog links to PR elastic#20574

ccd385c

Update the link field in each new changelog entry from the tracking issue to the merged pull request. Updates elastic#20558

kcreddy added 6 commits August 11, 2026 12:25

Merge remote-tracking branch 'upstream/main' into tagging-evt-origina…

4faac5d

…l-standards-3

Merge remote-tracking branch 'upstream/main' into tagging-evt-origina…

59660e0

…l-standards-3

Address comments from -4

239f005

Address event.original removal and fix pipeline tests

8dfd3e7

kcreddy marked this pull request as ready for review August 12, 2026 14:52

Copilot AI lite review requested due to automatic review settings August 12, 2026 14:52

kcreddy requested review from a team as code owners August 12, 2026 14:52

kcreddy self-assigned this Aug 12, 2026

Copilot AI reviewed Aug 12, 2026

kcreddy added enhancement New feature or request Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Aug 12, 2026

vera-review-bot Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/phone.yml Outdated

Comment thread packages/ti_anomali/data_stream/threatstream/elasticsearch/ingest_pipeline/default.yml Outdated

Comment thread packages/ti_eset/data_stream/apt/elasticsearch/ingest_pipeline/default.yml

Address review comments

eb4f36b

Copilot AI review requested due to automatic review settings August 13, 2026 09:03

Copilot AI reviewed Aug 13, 2026

resolve comments

74b4080

Copilot AI review requested due to automatic review settings August 13, 2026 11:51

Copilot AI reviewed Aug 13, 2026

efd6 reviewed Aug 17, 2026

View reviewed changes

Address review comments

15fe22f

Copilot AI review requested due to automatic review settings August 17, 2026 17:31

Copilot AI reviewed Aug 17, 2026

kcreddy mentioned this pull request Aug 19, 2026

SSI: Standardize processor tagging and event.original preservation across owned pipelines #20558

Open

Uh oh!

Conversation

kcreddy commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Related issues

github-actions Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Elastic Docs Style Checker (Vale)

elastic-vault-github-plugin-prod Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Copilot AI left a comment

Choose a reason for hiding this comment

infra-vault-gh-plugin-prod Bot commented Aug 12, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot AI left a comment

Choose a reason for hiding this comment

efd6 left a comment

Choose a reason for hiding this comment

efd6 Aug 17, 2026

Choose a reason for hiding this comment

efd6 Aug 17, 2026

Choose a reason for hiding this comment

efd6 Aug 17, 2026

Choose a reason for hiding this comment

Copilot AI left a comment

Choose a reason for hiding this comment

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

elastic-vault-github-plugin-prod Bot commented Aug 18, 2026

Labels

3 participants

kcreddy commented Aug 6, 2026 •

edited

Loading

github-actions Bot commented Aug 6, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Aug 6, 2026 •

edited

Loading