Skip to content

[cloud_security_posture] Update index template mapping - #3248

Merged
uri-weisman merged 8 commits into
elastic:mainfrom
uri-weisman:update_integration_mapping
May 3, 2022
Merged

[cloud_security_posture] Update index template mapping#3248
uri-weisman merged 8 commits into
elastic:mainfrom
uri-weisman:update_integration_mapping

Conversation

@uri-weisman

@uri-weisman uri-weisman commented May 2, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Install the integration and verify ES is able to index the cloudbeat events according to the new mapping.

Related issues

Screenshots
@elasticmachine

elasticmachine commented May 2, 2022 •
edited
Loading

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-05-03T09:30:27.159+0000

  • Duration: 15 min 4 sec

Test stats 🧪

Test Results
Failed 0
Passed 1
Skipped 0
Total 1

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.
@elasticmachine

elasticmachine commented May 2, 2022 •
edited
Loading

Copy link
Copy Markdown

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (0/0) 💚
Files 100.0% (0/0) 💚 3.275
Classes 100.0% (0/0) 💚 3.275
Methods 33.333% (1/3) 👎 -55.78
Lines 100.0% (0/0) 💚 10.01
Conditionals 100.0% (0/0) 💚
@uri-weisman

uri-weisman commented May 2, 2022

Copy link
Copy Markdown
Contributor Author

/test
@uri-weisman
uri-weisman requested a review from CohenIdo May 2, 2022 10:01
@uri-weisman
uri-weisman marked this pull request as ready for review May 2, 2022 10:01
@uri-weisman
uri-weisman requested a review from a team as a code owner May 2, 2022 10:01
amitkanfer
amitkanfer reviewed May 2, 2022
View reviewed changes

@amitkanfer amitkanfer left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one comment
Comment thread packages/cloud_security_posture/data_stream/findings/fields/findings.yml
eyalkraft
eyalkraft reviewed May 2, 2022
View reviewed changes
Comment thread packages/cloud_security_posture/data_stream/findings/fields/findings.yml
- name: name
type: text
ignore_above: 1024
- name: sub_type

@eyalkraft eyalkraft May 2, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't subtype be keyword?

@uri-weisman uri-weisman May 2, 2022

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't subtype be keyword?

I thought the user might want to search for a partial sub_type and get results.
For example, search for Controller and get data about ReplicationController | DeploymentController

Anyway, I used multi-fields which should index the field as text & keyword - multi-fields

@andrewkroh andrewkroh May 4, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One of the conventions in ECS (and most integrations) is to use .text as the multi-field rather than .keyword. See https://www.elastic.co/guide/en/ecs/8.2/ecs-conventions.html#_ecs_convention_for_indexing_text_fields for an explanation. Just want to mention this in case there is still an opportunity to align with this convention.
Comment thread packages/cloud_security_posture/data_stream/findings/fields/findings.yml Outdated
- name: keyword
type: keyword
ignore_above: 1024
# deprecated - the new field is under the resource obj

@eyalkraft eyalkraft May 2, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's not clear which field are you referring here.
please add this comment to both type and resource_id
@uri-weisman
uri-weisman requested a review from eyalkraft May 2, 2022 12:24
eyalkraft
eyalkraft approved these changes May 2, 2022
View reviewed changes

@eyalkraft eyalkraft left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test and ship 👍
@uri-weisman
uri-weisman requested a review from eyalkraft May 3, 2022 10:22
@uri-weisman
uri-weisman merged commit 7a2674c into elastic:main May 3, 2022
@uri-weisman
uri-weisman deleted the update_integration_mapping branch May 3, 2022 11:07
@andrewkroh andrewkroh added the Integration:cloud_security_posture Security Posture Management label May 4, 2022
@andrewkroh andrewkroh changed the title Update index template mapping May 4, 2022
@kfirpeled kfirpeled added the Team:Cloud Security Cloud Security team [elastic/cloud-security-posture] label Jun 26, 2023
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@uri-weisman
Update index template mapping (elastic#3248)
5c5f4bc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Integration:cloud_security_posture Security Posture Management Team:Cloud Security Cloud Security team [elastic/cloud-security-posture]

6 participants

@uri-weisman @elasticmachine @amitkanfer @andrewkroh @eyalkraft @kfirpeled