Skip to content

[m365_defender] Fix log data stream cursor and query - #8492

Merged
marc-gr merged 4 commits into
elastic:mainfrom
marc-gr:fix-m365-defender
Jan 25, 2024
Merged

[m365_defender] Fix log data stream cursor and query#8492
marc-gr merged 4 commits into
elastic:mainfrom
marc-gr:fix-m365-defender

Conversation

@marc-gr

@marc-gr marc-gr commented Nov 14, 2023

Copy link
Copy Markdown
Contributor

Proposed commit message

Changes cursor value reference to last event to prevent referencing empty responses.
Fixes incorrect use of formatDate in query building.
Adds the required empty checks and improves system tests.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
@marc-gr marc-gr added Team:Security-External Integrations Integration:m365_defender Microsoft Defender XDR bugfix Pull request that fixes a bug issue labels Nov 14, 2023
@marc-gr
marc-gr marked this pull request as ready for review November 14, 2023 10:21
@marc-gr
marc-gr requested a review from a team as a code owner November 14, 2023 10:21
@elasticmachine

elasticmachine commented Nov 14, 2023

Copy link
Copy Markdown

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
@elasticmachine

elasticmachine commented Nov 14, 2023

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-11-14T10:21:30.125+0000

  • Duration: 17 min 42 sec

Test stats 🧪

Test Results
Failed 0
Passed 26
Skipped 0
Total 26

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.
@elasticmachine

elasticmachine commented Nov 14, 2023

Copy link
Copy Markdown

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (3/3) 💚
Files 100.0% (7/7) 💚 3.81
Classes 100.0% (7/7) 💚 3.81
Methods 85.556% (77/90) 👎 -6.901
Lines 92.621% (5611/6058) 👍 3.807
Conditionals 100.0% (0/0) 💚
efd6
efd6 reviewed Nov 15, 2023
View reviewed changes
Comment thread packages/m365_defender/data_stream/log/agent/stream/httpjson.yml.hbs
{{#if initial_interval}}
default: 'lastUpdateTime gt [[formatDate (now (parseDuration "-{{initial_interval}}")) "2006-01-02T15:04:05.99Z"]]'
{{else}}
default: 'lastUpdateTime gt 2020-08-06T12:07:55.32Z'

@efd6 efd6 Nov 15, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is this date?

@marc-gr marc-gr Jan 24, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that is to force a given date on the tests, by falsing the variable in the test config, this is not possible to reach outside tests since the manifest enforces the data type
Comment thread packages/m365_defender/data_stream/log/agent/stream/httpjson.yml.hbs Outdated
@botelastic

botelastic Bot commented Dec 15, 2023

Copy link
Copy Markdown

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!
@botelastic botelastic Bot added the Stalled label Dec 15, 2023
@mrodm

mrodm commented Dec 21, 2023

Copy link
Copy Markdown
Collaborator

Hi @marc-gr, please update your branch with the latest contents from main branch. There was an important PR merged updating the CI pipelines. Thanks!
@botelastic botelastic Bot removed the Stalled label Dec 21, 2023
@botelastic

botelastic Bot commented Jan 20, 2024

Copy link
Copy Markdown

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!
@botelastic botelastic Bot added the Stalled label Jan 20, 2024
@botelastic botelastic Bot removed the Stalled label Jan 24, 2024
@elasticmachine

elasticmachine commented Jan 24, 2024

Copy link
Copy Markdown

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@marc-gr
marc-gr requested a review from efd6 January 24, 2024 09:19
@marc-gr
marc-gr requested a review from a team as a code owner January 25, 2024 10:09
bhapas
bhapas approved these changes Jan 25, 2024
View reviewed changes

@bhapas bhapas left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@elasticmachine

elasticmachine commented Jan 25, 2024

Copy link
Copy Markdown

💚 Build Succeeded

History
chemamartinez
chemamartinez approved these changes Jan 25, 2024
View reviewed changes

@chemamartinez chemamartinez left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
@marc-gr
marc-gr merged commit eba1358 into elastic:main Jan 25, 2024
@marc-gr
marc-gr deleted the fix-m365-defender branch January 25, 2024 11:17
@elasticmachine

elasticmachine commented Jan 25, 2024

Copy link
Copy Markdown

Package m365_defender - 2.6.2 containing this change is available at https://epr.elastic.co/search?package=m365_defender
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:m365_defender Microsoft Defender XDR

6 participants

@marc-gr @elasticmachine @mrodm @chemamartinez @efd6 @bhapas