Skip to content

[sei] Add checks to avoid overriding event.original if present#8269

Merged
marc-gr merged 103 commits intoelastic:mainfrom
marc-gr:feat/event.original-check
Oct 24, 2023
Merged

[sei] Add checks to avoid overriding event.original if present#8269
marc-gr merged 103 commits intoelastic:mainfrom
marc-gr:feat/event.original-check

Conversation

@marc-gr
Copy link
Copy Markdown
Contributor

@marc-gr marc-gr commented Oct 23, 2023 •
edited
Loading

Proposed commit message

Add checks to avoid overriding event.original if present.
On some setups (ie Logstash sends data to ES) event.original might be already present in the event body. Currently most of our integrations do not have a null check for it before trying to set it, leading to errors on these circumstances. By adding the required checks we improve handling in this setups.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Related issues

@marc-gr marc-gr force-pushed the feat/event.original-check branch from b8528f5 to 5485e2c Compare October 23, 2023 10:55
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package sentinel_one_cloud_funnel - 0.7.0 containing this change is available at https://epr.elastic.co/search?package=sentinel_one_cloud_funnel

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package slack - 1.15.0 containing this change is available at https://epr.elastic.co/search?package=slack

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package snort - 1.13.0 containing this change is available at https://epr.elastic.co/search?package=snort

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package snyk - 1.17.0 containing this change is available at https://epr.elastic.co/search?package=snyk

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package sonicwall_firewall - 1.12.0 containing this change is available at https://epr.elastic.co/search?package=sonicwall_firewall

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package sophos - 3.5.0 containing this change is available at https://epr.elastic.co/search?package=sophos

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package sophos_central - 1.11.0 containing this change is available at https://epr.elastic.co/search?package=sophos_central

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package suricata - 2.19.0 containing this change is available at https://epr.elastic.co/search?package=suricata

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package tanium - 1.6.0 containing this change is available at https://epr.elastic.co/search?package=tanium

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package tenable_io - 2.5.0 containing this change is available at https://epr.elastic.co/search?package=tenable_io

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package tenable_sc - 1.18.0 containing this change is available at https://epr.elastic.co/search?package=tenable_sc

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package ti_abusech - 1.22.0 containing this change is available at https://epr.elastic.co/search?package=ti_abusech

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package ti_cybersixgill - 1.23.0 containing this change is available at https://epr.elastic.co/search?package=ti_cybersixgill

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package ti_maltiverse - 0.6.0 containing this change is available at https://epr.elastic.co/search?package=ti_maltiverse

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package ti_otx - 1.20.0 containing this change is available at https://epr.elastic.co/search?package=ti_otx

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package ti_rapid7_threat_command - 1.12.0 containing this change is available at https://epr.elastic.co/search?package=ti_rapid7_threat_command

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package ti_recordedfuture - 1.18.0 containing this change is available at https://epr.elastic.co/search?package=ti_recordedfuture

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package ti_threatq - 1.21.0 containing this change is available at https://epr.elastic.co/search?package=ti_threatq

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package tines - 1.7.0 containing this change is available at https://epr.elastic.co/search?package=tines

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package trellix_edr_cloud - 0.5.0 containing this change is available at https://epr.elastic.co/search?package=trellix_edr_cloud

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package trellix_epo_cloud - 1.7.0 containing this change is available at https://epr.elastic.co/search?package=trellix_epo_cloud

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package trend_micro_vision_one - 1.13.0 containing this change is available at https://epr.elastic.co/search?package=trend_micro_vision_one

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package vectra_detect - 1.5.0 containing this change is available at https://epr.elastic.co/search?package=vectra_detect

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package zeek - 2.20.0 containing this change is available at https://epr.elastic.co/search?package=zeek

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package zerofox - 1.20.0 containing this change is available at https://epr.elastic.co/search?package=zerofox

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package zeronetworks - 1.9.0 containing this change is available at https://epr.elastic.co/search?package=zeronetworks

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package zscaler_zia - 2.16.0 containing this change is available at https://epr.elastic.co/search?package=zscaler_zia

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Oct 24, 2023

Package zscaler_zpa - 1.15.0 containing this change is available at https://epr.elastic.co/search?package=zscaler_zpa

@janvi-elastic janvi-elastic mentioned this pull request Oct 25, 2023
Merged
15 tasks
@taylor-swanson taylor-swanson mentioned this pull request Mar 4, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kcreddy kcreddy kcreddy approved these changes

Assignees

No one assigned

Labels

enhancement New feature or request Integration:akamai Akamai (Community supported) Integration:amazon_security_lake Amazon Security Lake Integration:arista_ngfw Arista NG Firewall (Community supported) Integration:atlassian_bitbucket Atlassian Bitbucket (Community supported) Integration:atlassian_confluence Atlassian Confluence (Community supported) Integration:atlassian_jira Atlassian Jira (Community supported) Integration:auditd Auditd Logs Integration:barracuda_cloudgen_firewall Barracuda CloudGen Firewall Logs Integration:barracuda Barracuda Web Application Firewall Integration:bitdefender BitDefender (Community supported) Integration:bitwarden Bitwarden Integration:box_events Box Events Integration:carbon_black_cloud VMware Carbon Black Cloud Integration:checkpoint Check Point Integration:cisco_aironet Cisco Aironet (Community supported) Integration:cisco_asa Cisco ASA Integration:cisco_duo Cisco Duo Integration:cisco_ftd Cisco FTD Integration:cisco_ise Cisco ISE Integration:cisco_meraki Cisco Meraki Integration:cisco_nexus Cisco Nexus Integration:1password 1Password (Partner supported)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[SEI] Add check for event.original rename/set to avoid issues with Logstash events

5 participants

@marc-gr @elasticmachine @efd6 @kcreddy @andrewkroh