Azure Firewall integration - #3578
Merged
Merged
Conversation
ebeahan
added
enhancement
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
🌐 Coverage report
|
efd6
reviewed
Jun 24, 2022
Comment on lines
41
to
44
Contributor
There was a problem hiding this comment.
network_traffic has this as a long for the icmp datastream, but kubernetes has it as a keyword for an HTTP request code. I can't see it defined, so is there a preference?
Member
Author
There was a problem hiding this comment.
Unless a numeric field needs to support range queries, ES recommends keyword for the better term query performance.
For ICMP messages, I think users are more likely query for a specific request code than across a range.
Member
Author
|
Last round of comments have been addressed - ready for another review round. |
efd6
reviewed
Jul 7, 2022
Member
Author
|
Thanks for the feedback, @efd6. I've incorporated your suggestions. |
ebeahan
force-pushed
the
package-azure-firewall
branch
from
July 8, 2022 14:16
a4721e7 to
7cdd3df
Compare
Member
Author
|
@elastic/obs-cloud-monitoring would you also please review as package owners? |
orestisfl
pushed a commit
to orestisfl/integrations
that referenced
this pull request
May 15, 2026
* adding foundation of firewall data stream * switch to grok processor for network pipeline * improve network pipeline for additional log cases * migrate to using grok for app rules * migrate dns proxy to also use grok processor * remove unneeded processors * improve dns test cases * consolidate into one firewall pipeline * unneeded removes * add docs and sample * include firewall in top-level readme * add firewall logo svg * rename firewall -> firewall_logs * set cloud.account.id * use correct constants * use unique name for storage account container * handle additional app rule case * add dashboards * add additional app log case * clean up field defs * update firewall doc * correct case * correct observer.name * add firewall screenshots * follow new conventions * formatting * bump version and update changelog * s/filebeat azure module/Azure Logs package/ * sort sample and expected events * index not needed * simplify grok with case insensitivity * regenerate firewall_logs with updated sample event * bump ECS version * clean up formatting * doc improvements based on review feedback * use v8.2.0 * use 8.3.0 in pipeline not field defs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR adds a new integration for Azure Firewall.
Checklist
changelog.ymlfile.How to test this PR locally
Related issues
Relates to #1205
Screenshots