trend_micro_vision_one: handle detection documents that have a requests array instead of a request field - #7951
Merged
Merged
Conversation
efd6
added
enhancement
efd6
force-pushed
the
7871-trend_micro_vision_one
branch
from
September 25, 2023 02:32
8f6b773 to
2804457
Compare
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
🌐 Coverage report
|
efd6
changed the title
efd6
force-pushed
the
7871-trend_micro_vision_one
branch
from
September 25, 2023 03:13
2804457 to
3651191
Compare
efd6
marked this pull request as ready for review
September 25, 2023 03:51
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
bhapas
reviewed
Sep 27, 2023
…ts array instead of a request field The Trend Micro detections API documentation[1] states that the request field is a scalar string holding a URL. Notwithstanding this, we have seen cases in the wild where there is no request field, but rather a requests field that is an array of strings, apparently holding URLs. This change splits documents that have a requests field, and promotes each of the elements of the requests array to be request unless there is a request field already present. https://automation.trendmicro.com/xdr/api-v3#tag/Search/paths/~1v3.0~1search~1detections/get
efd6
force-pushed
the
7871-trend_micro_vision_one
branch
from
September 27, 2023 08:42
3651191 to
dd318ae
Compare
Add a test that includes an event that would have come from a set of events that had an requests array instead of a request scalar.
|
Package trend_micro_vision_one - 1.11.0 containing this change is available at https://epr.elastic.co/search?package=trend_micro_vision_one |
orestisfl
pushed a commit
to orestisfl/integrations
that referenced
this pull request
May 15, 2026
…ts array instead of a request field (elastic#7951) The Trend Micro detections API documentation[1] states that the request field is a scalar string holding a URL. Notwithstanding this, we have seen cases in the wild where there is no request field, but rather a requests field that is an array of strings, apparently holding URLs. This change splits documents that have a requests field, and promotes each of the elements of the requests array to be request unless there is a request field already present. [1]https://automation.trendmicro.com/xdr/api-v3#tag/Search/paths/~1v3.0~1search~1detections/get
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
The Trend Micro detections API documentation[1] states that the
requestfieldis a scalar string holding a URL. Notwithstanding this, we have seen cases in
the wild where there is no
requestfield, but rather arequestsfield that isan array of strings, apparently holding URLs. This change splits documents that
have a
requestsfield, and promotes each of the elements of therequestsarrayto be
requestunless there is arequestfield already present.https://automation.trendmicro.com/xdr/api-v3#tag/Search/paths/~1v3.0~1search~1detections/get
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots