Update SentinelOne Threat Pipline to Set event.id for ECS [Enhancement] by ChriZzn · Pull Request #4840 · elastic/integrations

ChriZzn · 2022-12-15T12:54:46Z

Adding ECS event.id Field from SentinelOne Threat ID

What does this PR do?

Addint the event.id Field this discribes the Unique Threat ID in SentinelOne

Checklist

[x ] I have reviewed tips for building integrations and this pull request is aligned with them.
[ x] I have verified that all data streams collect metrics or logs.
[x ] I have added an entry to my package's changelog.yml file.
[x ] I have verified that Kibana version constraints are current according to guidelines.

Adding ECS event.id Field from SentinelOne Threat ID

elasticmachine · 2022-12-15T12:58:02Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-02-09T09:38:32.101+0000
Duration: 16 min 36 sec

Test stats 🧪

Test	Results
Failed	0
Passed	31
Skipped	0
Total	31

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

elasticmachine · 2022-12-16T13:17:59Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

ChriZzn · 2022-12-19T12:58:44Z

Hi together,

any updates when this is going to be fixed?

kcreddy

Please add changelog.yml and manifest.yml entries to the PR

ChriZzn · 2022-12-28T08:02:47Z

Hi @kcreddy

All Required Files should be edited now!

Regards Christoph

kcreddy · 2022-12-29T12:07:25Z

All Required Files should be edited now!

@ChriZzn please also update manifest.yml to match with the latest changelog.yml version

This is the place you need to change it to 1.4.1
https://github.com/ChriZzn/integrations/blob/main/packages/sentinel_one/manifest.yml#L4

botelastic · 2023-01-28T13:05:10Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

jamiehynds · 2023-01-30T09:06:52Z

Not stale - waiting on manifest to be updated.

ChriZzn · 2023-02-01T09:13:15Z

Hi, should be done now!

Regards Christoph

kcreddy · 2023-02-01T10:50:27Z

@ChriZzn you will need to bump up the version to 1.5.1 now.

A version upgrade already happened on the package as you can see earlier it was 1.4.0 but now it is 1.5.0. So, you will need to bump up the version to 1.5.1 in this PR.

Also, could you answer this as well? #4840 (comment)

ChriZzn · 2023-02-08T10:15:54Z

Hi @kcreddy

should be done now.

Regards Christoph

kcreddy · 2023-02-08T12:27:53Z

/test

elasticmachine · 2023-02-08T12:42:22Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`5/5`)	💚
Files	100.0% (`5/5`)	💚 2.404
Classes	100.0% (`5/5`)	💚 2.404
Methods	100.0% (`71/71`)	💚 8.534
Lines	96.382% (`3170/3289`)	👍 4.798
Conditionals	100.0% (`0/0`)	💚

efd6 · 2023-02-09T02:01:23Z

/test

efd6 · 2023-02-09T02:04:16Z

@ChriZzn are you able to run elastic-package test pipeline -g?

ChriZzn · 2023-02-09T06:55:54Z

Hi, now we have no ability to run this

efd6 · 2023-02-09T07:56:44Z

OK. I'll add this.

kcreddy · 2023-02-09T09:37:17Z

/test

kcreddy · 2023-02-09T09:55:27Z

OK. I'll add this.

Hey @efd6 I have taken care of it.

kcreddy

LGTM

elasticmachine · 2023-02-09T10:20:26Z

Package sentinel_one - 1.5.1 containing this change is available at https://epr.elastic.co/search?package=sentinel_one

…t] (elastic#4840) * Update default.yml Adding ECS event.id Field from SentinelOne Threat ID * Update changelog.yml * Update manifest.yml * Update manifest.yml * Update changelog.yml * Update changelog.yml * Add tests; Update readme --------- Co-authored-by: kcreddy <krish.reddy91@gmail.com>

Update default.yml

d257e30

Adding ECS event.id Field from SentinelOne Threat ID

ChriZzn requested a review from a team as a code owner December 15, 2022 12:54

ChriZzn changed the title ~~Update SentinelOne Threat Pipline to Set event.id for ECS~~ Dec 15, 2022

jamiehynds added the Team:Security-External Integrations label Dec 16, 2022

jamiehynds added the Integration:sentinel_one SentinelOne label Dec 16, 2022

kcreddy reviewed Dec 26, 2022

View reviewed changes

Comment thread packages/sentinel_one/data_stream/threat/elasticsearch/ingest_pipeline/default.yml

kcreddy reviewed Dec 26, 2022

View reviewed changes

ChriZzn added 2 commits December 28, 2022 08:52

Merge branch 'elastic:main' into main

35231e5

Update changelog.yml

86d024d

botelastic Bot added the Stalled label Jan 28, 2023

botelastic Bot removed the Stalled label Jan 30, 2023

ChriZzn added 2 commits February 1, 2023 10:10

Update manifest.yml

14fd399

Merge branch 'main' into main

0248f02

ChriZzn added 2 commits February 8, 2023 11:14

Update manifest.yml

97de2f2

Update changelog.yml

08b2e1c

kcreddy requested changes Feb 8, 2023

View reviewed changes

Comment thread packages/sentinel_one/changelog.yml

Update changelog.yml

a03c0d7

Add tests; Update readme

9a09887

kcreddy added the enhancement New feature or request label Feb 9, 2023

kcreddy approved these changes Feb 9, 2023

View reviewed changes

kcreddy merged commit d4011c0 into elastic:main Feb 9, 2023

kcreddy self-assigned this Feb 9, 2023

Navigation Menu

Uh oh!

Update SentinelOne Threat Pipline to Set event.id for ECS [Enhancement] - #4840

Update SentinelOne Threat Pipline to Set event.id for ECS [Enhancement]#4840
kcreddy merged 9 commits into
elastic:mainfrom
ChriZzn:main

ChriZzn commented Dec 15, 2022

elasticmachine commented Dec 15, 2022 •

edited

Loading

Build stats

Test stats 🧪

elasticmachine commented Dec 16, 2022

ChriZzn commented Dec 19, 2022

Uh oh!

kcreddy left a comment

ChriZzn commented Dec 28, 2022

kcreddy commented Dec 29, 2022 •

edited

Loading

botelastic Bot commented Jan 28, 2023

jamiehynds commented Jan 30, 2023 •

edited

Loading

ChriZzn commented Feb 1, 2023

kcreddy commented Feb 1, 2023

ChriZzn commented Feb 8, 2023

Uh oh!

kcreddy commented Feb 8, 2023

elasticmachine commented Feb 8, 2023 •

edited

Loading

efd6 commented Feb 9, 2023

efd6 commented Feb 9, 2023

ChriZzn commented Feb 9, 2023

efd6 commented Feb 9, 2023

kcreddy commented Feb 9, 2023

kcreddy commented Feb 9, 2023

kcreddy left a comment

elasticmachine commented Feb 9, 2023

Labels

5 participants

Uh oh!

Conversation

ChriZzn commented Dec 15, 2022

What does this PR do?

Checklist

elasticmachine commented Dec 15, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

elasticmachine commented Dec 16, 2022

ChriZzn commented Dec 19, 2022

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

ChriZzn commented Dec 28, 2022

kcreddy commented Dec 29, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

botelastic Bot commented Jan 28, 2023

jamiehynds commented Jan 30, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ChriZzn commented Feb 1, 2023

kcreddy commented Feb 1, 2023

ChriZzn commented Feb 8, 2023

Uh oh!

kcreddy commented Feb 8, 2023

elasticmachine commented Feb 8, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌐 Coverage report

efd6 commented Feb 9, 2023

efd6 commented Feb 9, 2023

ChriZzn commented Feb 9, 2023

efd6 commented Feb 9, 2023

kcreddy commented Feb 9, 2023

kcreddy commented Feb 9, 2023

kcreddy left a comment

Choose a reason for hiding this comment

elasticmachine commented Feb 9, 2023

Labels

5 participants

elasticmachine commented Dec 15, 2022 •

edited

Loading

kcreddy commented Dec 29, 2022 •

edited

Loading

jamiehynds commented Jan 30, 2023 •

edited

Loading

elasticmachine commented Feb 8, 2023 •

edited

Loading