Skip to content

TI Util package fix incorrect index in dashboard - #6793

Merged
kgeller merged 3 commits into
elastic:mainfrom
kgeller:ti-rules-updates
Jul 5, 2023
Merged

TI Util package fix incorrect index in dashboard#6793
kgeller merged 3 commits into
elastic:mainfrom
kgeller:ti-rules-updates

Conversation

@kgeller

@kgeller kgeller commented Jul 3, 2023

Copy link
Copy Markdown
Member

What does this PR do?

This PR updates two panels in the ti_util dashboard per updates in 8.x described here.

  1. Switch index from .siem-signals-<space-id> to .alerts-security.alerts-<space-id>
  2. Switch filter field from signal.rule.name to kibana.alert.rule.name

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
@kgeller kgeller added the bugfix Pull request that fixes a bug issue label Jul 3, 2023
@kgeller kgeller self-assigned this Jul 3, 2023
@kgeller
kgeller marked this pull request as ready for review July 3, 2023 18:20
@kgeller
kgeller requested a review from a team as a code owner July 3, 2023 18:20
@elasticmachine

elasticmachine commented Jul 3, 2023

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-07-04T19:36:20.685+0000

  • Duration: 14 min 34 sec

Test stats 🧪

Test Results
Failed 0
Passed 2
Skipped 0
Total 2

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

Comment thread packages/ti_util/changelog.yml Outdated
},
{
"id": ".siem-signals*",
"id": "security-solution-default",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can I confirm that this (and related) is the change for switching index? This is not clear from the linked document.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes this is the change for switching the index

security-solution-default points to a data view that contains alerts-security.alerts-<space-id>

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
@kgeller
kgeller merged commit a6c7809 into elastic:main Jul 5, 2023
@kgeller
kgeller deleted the ti-rules-updates branch July 5, 2023 13:24
@elasticmachine

Copy link
Copy Markdown

Package ti_util - 1.2.1 containing this change is available at https://epr.elastic.co/search?package=ti_util

@andrewkroh andrewkroh added the Integration:ti_util Threat Intelligence Utilities label Jul 22, 2024
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:ti_util Threat Intelligence Utilities

4 participants