Skip to content

[ESET PROTECT] Make IoC ECS fields compatible with TI integrations - #9459

Closed
kat-does-code wants to merge 14 commits into
elastic:mainfrom
kat-does-code:eset-ti-compatible
Closed

[ESET PROTECT] Make IoC ECS fields compatible with TI integrations#9459
kat-does-code wants to merge 14 commits into
elastic:mainfrom
kat-does-code:eset-ti-compatible

Conversation

@kat-does-code

@kat-does-code kat-does-code commented Mar 27, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

(Enhancement)

Adjusted ECS fields file.hash.sha1, threat.indicator.file.hash.sha1 and related.hash to be lower case, which is more in line with comparable security integrations (including the ESET Threat Intelligence integration). This enhancement should enable compatibility with indicator match rules.

Also fixed a grok parsing issue where event data would be incorrectly parsed when eset_protect.event.object_uri has value script.

Proposed commit message

Lowercase related hash and indicator hash to support indicator rule matching. Fixed grok parse error when object_uri equals 'script'.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
@kat-does-code
kat-does-code requested a review from a team as a code owner March 27, 2024 16:40
@cla-checker-service

cla-checker-service Bot commented Mar 27, 2024 •
edited
Loading

Copy link
Copy Markdown

💚 CLA has been signed
@kat-does-code kat-does-code changed the title [ESET PROTECT] Detection & Event improvements Mar 27, 2024
@kat-does-code kat-does-code changed the title Enhancement: [ESET PROTECT] Detection & Event improvements Mar 27, 2024
@kat-does-code
kat-does-code marked this pull request as draft March 28, 2024 09:04
@kat-does-code
kat-does-code marked this pull request as ready for review March 28, 2024 09:04
@kat-does-code kat-does-code reopened this Mar 28, 2024
@kat-does-code kat-does-code changed the title [ESET PROTECT] Detection & Event improvements Mar 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant

@kat-does-code