Skip to content

Refactor cisco_ise integration - #4653

Merged
efd6 merged 5 commits into
elastic:mainfrom
Bernhard-Fluehmann:fix_cisco_ise
Nov 18, 2022
Merged

Refactor cisco_ise integration#4653
efd6 merged 5 commits into
elastic:mainfrom
Bernhard-Fluehmann:fix_cisco_ise

Conversation

@Bernhard-Fluehmann

@Bernhard-Fluehmann Bernhard-Fluehmann commented Nov 15, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor
  • No kv parsing to root level anymore (user log_details_object flattened field instead
  • More sophisticated parsing of av-pairs
  • Enhanced error handling
  • Bug-fixes

What does this PR do?

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots
@Bernhard-Fluehmann
Bernhard-Fluehmann requested a review from a team as a code owner November 15, 2022 17:27
@cla-checker-service

cla-checker-service Bot commented Nov 15, 2022 •
edited
Loading

Copy link
Copy Markdown

💚 CLA has been signed
@Bernhard-Fluehmann

Bernhard-Fluehmann commented Nov 15, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

@efd6 Next try. Now with changed author email address. CLA check still failing. What's the problem now?
@elasticmachine

elasticmachine commented Nov 15, 2022 •
edited
Loading

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-11-18T08:04:34.017+0000

  • Duration: 16 min 15 sec

Test stats 🧪

Test Results
Failed 0
Passed 90
Skipped 0
Total 90

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.
@efd6

efd6 commented Nov 15, 2022

Copy link
Copy Markdown
Contributor

@Bernhard-Fluehmann Are you able to jump onto the community slack to work through this? Alternatively, can you post the commit details for the change, output from git log fix_cisco_ise~1..fix_cisco_ise should be enough (GitHub unfortunately doesn't make this available through the UI and I can't look at your branch until the CLA checker is happy).
@Bernhard-Fluehmann
Bernhard-Fluehmann force-pushed the fix_cisco_ise branch 2 times, most recently from a255797 to ece4ab8 Compare November 16, 2022 08:34
@Bernhard-Fluehmann

Bernhard-Fluehmann commented Nov 16, 2022

Copy link
Copy Markdown
Contributor Author

@efd6 Now?
@efd6

efd6 commented Nov 16, 2022

Copy link
Copy Markdown
Contributor

Yay! That is working. Thanks for being patient and persistent.
@efd6

efd6 commented Nov 16, 2022

Copy link
Copy Markdown
Contributor

/test
@elasticmachine

elasticmachine commented Nov 16, 2022

Copy link
Copy Markdown

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@elasticmachine

elasticmachine commented Nov 16, 2022 •
edited
Loading

Copy link
Copy Markdown

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 100.0% (17/17) 💚 2.534
Classes 100.0% (17/17) 💚 2.534
Methods 100.0% (179/179) 💚 9.134
Lines 98.792% (3845/3892) 👍 7.086
Conditionals 100.0% (0/0) 💚
efd6
efd6 reviewed Nov 16, 2022
View reviewed changes

@efd6 efd6 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this, the processing is a lot cleaner. I have some suggestions for improvement.

Please re-run elastic-package test -g; some of the pipline test expectations are not correctly formatted.

Also, this will need to have a changelog entry in changelog.yml and a version bump in manifest.yml. Since this includes enhancements, it should be bumped to "1.3.0".
Comment thread packages/cisco_ise/data_stream/log/fields/fields.yml Outdated
Comment on lines 832 to 833

@efd6 efd6 Nov 16, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please delete this.
Comment thread packages/cisco_ise/data_stream/log/fields/fields.yml Outdated
Comment on lines 471 to 470

@efd6 efd6 Nov 16, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should not be needed since it is only being used temporarily.
Comment thread packages/cisco_ise/data_stream/log/fields/fields.yml Outdated
Comment on lines 469 to 470

@efd6 efd6 Nov 16, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If cisco_ise.log.log_details is being deleted as it now is, this does not need to be in the fields definitions.

I think though that it would be better to leave it here and change it to a flattened and rename the current cisco_ise.log.log_details_object to cisco_ise.log.log_details in the pipeline sources and this field to cisco_ise.log.log_details_raw as the temporary string to work from. Then if there are any fields that come up in new versions those fields will become clearly visible in this object since they won't have been deleted in the sub-pipelines.
@efd6 efd6 self-assigned this Nov 16, 2022
@efd6 efd6 added bug Something isn't working, use only for issues enhancement New feature or request Team:Security-External Integrations Integration:cisco_ise Cisco ISE labels Nov 17, 2022
@elasticmachine

elasticmachine commented Nov 17, 2022

Copy link
Copy Markdown

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
@Bernhard-Fluehmann
Refactor cisco_ise integration
410aca4 
- No kv parsing to root level anymore (user log_details_object flattened
  field instead
- More sophisticated parsing of av-pairs
- Enhanced error handling
- Bug-fixes
@Bernhard-Fluehmann
Changes recommended by @efd6
7da246c
@Bernhard-Fluehmann

Bernhard-Fluehmann commented Nov 17, 2022

Copy link
Copy Markdown
Contributor Author

@efd6 Recommended changes implemented. Please review
@efd6

efd6 commented Nov 17, 2022

Copy link
Copy Markdown
Contributor

/test
efd6
efd6 reviewed Nov 17, 2022
View reviewed changes

@efd6 efd6 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The README.md will need to be regenerated to incorporate the new sample_event.json. Please run elastic-package build.
@Bernhard-Fluehmann

Bernhard-Fluehmann commented Nov 18, 2022

Copy link
Copy Markdown
Contributor Author

@efd6 Done
@efd6

efd6 commented Nov 18, 2022

Copy link
Copy Markdown
Contributor

/test
efd6
efd6 approved these changes Nov 18, 2022
View reviewed changes

@efd6 efd6 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks
@efd6
efd6 merged commit 83c93d8 into elastic:main Nov 18, 2022
@Bernhard-Fluehmann

Bernhard-Fluehmann commented Nov 18, 2022

Copy link
Copy Markdown
Contributor Author

@efd6 Thanks for your fast response and assistance.
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@Bernhard-Fluehmann
Refactor cisco_ise integration (elastic#4653)
ef42768 
- No kv parsing to root level anymore (user log_details_object flattened
  field instead)
- More sophisticated parsing of av-pairs
- Enhanced error handling
- Bug-fixes
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working, use only for issues enhancement New feature or request Integration:cisco_ise Cisco ISE

3 participants

@Bernhard-Fluehmann @elasticmachine @efd6