Set sensitive values as secret - Part 1 - #8725
Merged
taylor-swanson merged 3 commits intoFeb 14, 2024
Merged
Conversation
taylor-swanson
added
enhancement
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
audit |
3861 | 2976.19 | -884.81 (-22.92%) | 💔 |
Package auth0 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
logs |
4065.04 | 2320.19 | -1744.85 (-42.92%) | 💔 |
Package bitdefender 👍(1) 💚(0) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
push_configuration |
33333.33 | 26315.79 | -7017.54 (-21.05%) | 💔 |
push_statistics |
66666.67 | 45454.55 | -21212.12 (-31.82%) | 💔 |
Package bitwarden 👍(2) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
collection |
31250 | 17241.38 | -14008.62 (-44.83%) | 💔 |
member |
10869.57 | 8547.01 | -2322.56 (-21.37%) | 💔 |
Package box_events 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
events |
3267.97 | 2439.02 | -828.95 (-25.37%) | 💔 |
Package carbon_black_cloud 👍(3) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
endpoint_event |
2277.9 | 1733.1 | -544.8 (-23.92%) | 💔 |
Package cisco_duo 👍(2) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
admin |
4694.84 | 2958.58 | -1736.26 (-36.98%) | 💔 |
telephony |
52631.58 | 32258.06 | -20373.52 (-38.71%) | 💔 |
Package cisco_meraki 👍(0) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
events |
6711.41 | 4975.12 | -1736.29 (-25.87%) | 💔 |
Package cloudflare 👍(1) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
audit |
2994.01 | 2325.58 | -668.43 (-22.33%) | 💔 |
Package crowdstrike 👍(0) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
falcon |
9708.74 | 3322.26 | -6386.48 (-65.78%) | 💔 |
To see the full report comment with /test benchmark fullreport
💔 Tests Failed
Expand to view the summary
Build stats
Test stats 🧪
Test errors
Expand to view the tests failures> Show only the first 10 test failures
|
🌐 Coverage report
|
Collaborator
|
Hi @taylor-swanson, please update your branch with the latest contents from main branch. There was an important PR merged updating the CI pipelines. Thanks! |
narph
added
Team:Security-Scalability
Contributor
Author
|
/test |
taylor-swanson
marked this pull request as ready for review
February 2, 2024 19:20
|
Pinging @elastic/security-scalability (Team:Security-Scalability) |
Contributor
Author
|
I think I'm going to split this PR into smaller chunks. At the very least by codeowner and further by groups of 20 or so packages (like ECS updates). |
taylor-swanson
added
Team:Security-Service Integrations
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
efd6
reviewed
Feb 12, 2024
efd6
left a comment
efd6
left a comment
Contributor
There was a problem hiding this comment.
Should we also be considering ssl configurations since they may include keys. Also tenant IDs (leaning towards paranoia).
| fields: | ||
| - name: classification_ids | ||
| type: keyword | ||
| type: integer |
Contributor
There was a problem hiding this comment.
Why has this been changed? IDs are usually considered non-orderable.
Contributor
Author
There was a problem hiding this comment.
Yeah this was the wrong move. I didn't see that there was a processor that was supposed to convert the this field, but it's not getting triggered on the pipeline test case that is failing:
FAILURE DETAILS:
amazon_security_lake/event test-system-activity.log:
[0] parsing field value failed: [0] parsing field value failed: field "ocsf.malware.classification_ids" value "[17 2]" ([]interface {}): expected string or array of strings
╭──────────────────────┬─────────────┬───────────┬───────────────────────────────┬─────────────────────────────────────────────────────────────────────────────┬──────────────╮
│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │
├──────────────────────┼─────────────┼───────────┼───────────────────────────────┼─────────────────────────────────────────────────────────────────────────────┼──────────────┤
│ amazon_security_lake │ event │ pipeline │ test-application-activity.log │ PASS │ 44.295852ms │
│ amazon_security_lake │ event │ pipeline │ test-discovery.log │ PASS │ 7.062222ms │
│ amazon_security_lake │ event │ pipeline │ test-findings.log │ PASS │ 9.071077ms │
│ amazon_security_lake │ event │ pipeline │ test-iam.log │ PASS │ 16.257727ms │
│ amazon_security_lake │ event │ pipeline │ test-network-activity.log │ PASS │ 57.253258ms │
│ amazon_security_lake │ event │ pipeline │ test-system-activity.log │ FAIL: test case failed: one or more problems with fields found in documents │ 48.515694ms │
╰──────────────────────┴─────────────┴───────────┴───────────────────────────────┴─────────────────────────────────────────────────────────────────────────────┴──────────────╯
Looking at the event that is failing, it has (perhaps among other things) a class_id that doesn't match the required list in the default pipeline, so the malware sub-pipeline isn't being executed. I don't have enough context here to know how to fix this problem, so I've downgraded pkg-spec to 3.0.0 so the validation doesn't kick in. It'll have to be addressed in a separate issue.
Contributor
Author
|
/test |
💚 Build Succeeded
History
|
|
0.0% Duplication on New Code
efd6
approved these changes
Feb 14, 2024
efd6
left a comment
efd6
left a comment
Contributor
There was a problem hiding this comment.
Apparently SSL keys handling will be a target of future work.
|
Package cel - 1.9.0 containing this change is available at https://epr.elastic.co/search?package=cel |
|
Package cisco_duo - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=cisco_duo |
|
Package cisco_meraki - 1.21.0 containing this change is available at https://epr.elastic.co/search?package=cisco_meraki |
|
Package cisco_secure_endpoint - 2.25.0 containing this change is available at https://epr.elastic.co/search?package=cisco_secure_endpoint |
|
Package cisco_umbrella - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=cisco_umbrella |
|
Package cloudflare - 2.24.0 containing this change is available at https://epr.elastic.co/search?package=cloudflare |
|
Package cloudflare_logpush - 1.18.0 containing this change is available at https://epr.elastic.co/search?package=cloudflare_logpush |
|
Package crowdstrike - 1.30.0 containing this change is available at https://epr.elastic.co/search?package=crowdstrike |
4 tasks
andrewkroh
added
Integration:atlassian_jira
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Checklist
changelog.ymlfile.Related issues