-
Notifications
You must be signed in to change notification settings - Fork 473
[FireEye] Add missing ECS fields #14550
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/renaming-raws.yml
Outdated
Show resolved
Hide resolved
packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/renaming-raws.yml
Outdated
Show resolved
Hide resolved
@@ -12,7 +12,20 @@ processors: | |||
- rename: | |||
field: rawmsg.app_proto | |||
target_field: network.protocol | |||
if: ctx.rawmsg.app_proto != null && !['failed','succeded'].contains(ctx.rawmsg.app_proto.toLowerCase()) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this can be written out as "if foo equals failed || if foo equals succeeded" to avoid allocating a new list in each expression eval.
Co-authored-by: Andrew Kroh <[email protected]>
packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/renaming-raws.yml
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For issue suggestion: tls.client.server_name > destination.hostname
, the correct mapping should be into destination.domain
packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/renaming-raws.yml
Show resolved
Hide resolved
packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/renaming-raws.yml
Outdated
Show resolved
Hide resolved
packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/renaming-raws.yml
Show resolved
Hide resolved
Yes, i've mapped integrations/packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/renaming-raws.yml Lines 485 to 489 in 595c3c9
|
💚 Build Succeeded
History
|
|
Proposed commit message
Checklist
changelog.yml
file.How to test this PR locally
Related issues