Skip to content

[tenable_sc] Add tenable_sc package. - #2188

Merged
andrewkroh merged 10 commits into
elastic:masterfrom
vinit-chauhan:package_tenable_sc
Dec 13, 2021
Merged

[tenable_sc] Add tenable_sc package.#2188
andrewkroh merged 10 commits into
elastic:masterfrom
vinit-chauhan:package_tenable_sc

Conversation

@vinit-chauhan

@vinit-chauhan vinit-chauhan commented Nov 18, 2021

Copy link
Copy Markdown
Contributor

What does this PR do?

  • Generated the skeleton of Tenable.sc integration package.
  • Added 3 data streams ( Asset, Plugin, and Vulnerability )
  • Added data collection logic for all 3 data streams.
  • Added the ingest pipeline for all the data streams.
  • Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files
  • Added dashboards and visualizations.
  • Added test for pipeline for all the data streams.
  • Added system test cases for all the data streams.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

How to test this PR locally

  • Clone integrations repo.
  • Install elastic-package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/tenable_sc directory.
  • Run the following command to run tests.

elastic-package test

Screenshots

image
image
image
image
@elasticmachine

elasticmachine commented Nov 18, 2021 •
edited
Loading

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2021-12-12T19:49:42.956+0000

  • Duration: 16 min 51 sec

  • Commit: 3998b7d

Test stats 🧪

Test Results
Failed 0
Passed 35
Skipped 0
Total 35

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.
andrewkroh
andrewkroh reviewed Nov 18, 2021
View reviewed changes
Comment thread packages/tenable_sc/_dev/build/build.yml Outdated
Comment thread packages/tenable_sc/_dev/build/docs/README.md Outdated
Comment thread packages/tenable_sc/_dev/build/docs/README.md Outdated
Comment thread packages/tenable_sc/manifest.yml Outdated
Comment thread packages/tenable_sc/manifest.yml Outdated
Comment thread packages/tenable_sc/manifest.yml Outdated
@vinit-chauhan
- Bumpup the ecs version to 1.12
fe04bf1 
- Rename configuration parameter from 'hostname' to 'url'.
- minor changes in description and readme file.
@vinit-chauhan vinit-chauhan changed the title Initial Commit for the tenable_sc package Nov 23, 2021
@vinit-chauhan
vinit-chauhan marked this pull request as ready for review November 23, 2021 11:42
@marc-gr

marc-gr commented Nov 23, 2021

Copy link
Copy Markdown
Contributor

/test
legoguy1000
legoguy1000 reviewed Nov 24, 2021
View reviewed changes
Comment thread packages/tenable_sc/data_stream/asset/agent/stream/httpjson.yml.hbs
@marc-gr

marc-gr commented Dec 2, 2021

Copy link
Copy Markdown
Contributor

/test
@andrewkroh
andrewkroh requested a review from a team December 2, 2021 13:02
@elasticmachine

elasticmachine commented Dec 2, 2021

Copy link
Copy Markdown

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
@andrewkroh andrewkroh added New Integration Issue or pull request for creating a new integration package. Integration:tenable_sc Tenable Security Center labels Dec 2, 2021
@andrewkroh

andrewkroh commented Dec 2, 2021

Copy link
Copy Markdown
Contributor

/test
andrewkroh
andrewkroh reviewed Dec 2, 2021
View reviewed changes

@andrewkroh andrewkroh left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I got through the asset logs. Will come back for the rest.

Asset

  • Set host.hostname based on the dns.name.

  • Set host.name to be the short hostname (e.g. 'g2ounzt879fe2djt' for a dns.name of 'g2ounzt879fe2djt.example'). This is an attempt to match what our Agent would put into this field if it were running on the host.

  • Set host.domain to be the domain part of dns.name minus the host (e.g. 'example' for 'g2ounzt879fe2djt.example').

  • Set related.ip.

  • Set related.hosts and include the host.hostname, host.name, netbios.name (using append with allow_duplicates=false).
Comment thread packages/tenable_sc/data_stream/asset/elasticsearch/ingest_pipeline/default.yml Outdated
Comment thread packages/tenable_sc/data_stream/asset/fields/ecs.yml
andrewkroh
andrewkroh reviewed Dec 6, 2021
View reviewed changes
Comment thread packages/tenable_sc/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json Outdated
Comment thread packages/tenable_sc/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml Outdated
Comment thread packages/tenable_sc/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml
Comment thread packages/tenable_sc/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml
Comment thread packages/tenable_sc/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml Outdated
Comment thread ...tenable_sc/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json
@andrewkroh andrewkroh mentioned this pull request Dec 6, 2021
Merged
4 tasks
@vinit-chauhan
- Updated MAC address format.
b5f6a69 
- Merged convert and rename processors.
- Replaced painless script with ignore_missing flag.
andrewkroh
andrewkroh approved these changes Dec 8, 2021
View reviewed changes

@andrewkroh andrewkroh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Just one minor change requested to get host.ip into an array.

BTW I opened a ticket with an idea to validate the fields that should be arrays. elastic/elastic-package#615
Comment thread packages/tenable_sc/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json Outdated
@andrewkroh

andrewkroh commented Dec 8, 2021

Copy link
Copy Markdown
Contributor

/test
andrewkroh
andrewkroh approved these changes Dec 12, 2021
View reviewed changes
Comment thread packages/tenable_sc/changelog.yml Outdated
@andrewkroh
andrewkroh merged commit 2d96b24 into elastic:master Dec 13, 2021
@jamiehynds jamiehynds mentioned this pull request Dec 14, 2021
Closed
15 tasks
@vinit-chauhan
vinit-chauhan deleted the package_tenable_sc branch April 1, 2026 23:57
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@vinit-chauhan @andrewkroh
[tenable_sc] Add tenable_sc package. (elastic#2188)
41c5c78 
The Tenable.sc integration collects and parses data from the Tenable.sc APIs.

- Generated the skeleton of Tenable.sc integration package.
- Added 3 data streams ( Asset, Plugin, and Vulnerability )
- Added data collection logic for all 3 data streams.
- Added the ingest pipeline for all the data streams.
- Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files
- Added dashboards and visualizations.
- Added test for pipeline for all the data streams.
- Added system test cases for all the data streams.

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Integration:tenable_sc Tenable Security Center New Integration Issue or pull request for creating a new integration package.

5 participants

@vinit-chauhan @elasticmachine @marc-gr @andrewkroh @legoguy1000