Skip to content

Cherry-pick #20220 to 7.x: [Filebeat] Updates to Suricata module#20484

Merged
andrewkroh merged 2 commits intoelastic:7.xfrom
andrewkroh:backport_20220_7.x
Aug 11, 2020
Merged

Cherry-pick #20220 to 7.x: [Filebeat] Updates to Suricata module#20484
andrewkroh merged 2 commits intoelastic:7.xfrom
andrewkroh:backport_20220_7.x

Conversation

@andrewkroh
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh commented Aug 6, 2020 •
edited by zube bot
Loading

Cherry-pick of PR #20220 to 7.x branch. Original message:

What does this PR do?

This makes a few miscellaneous changes to the Suricata module to cleanup dashboards and fix a few minor issues in the pipeline.

  • Fix convert processor fail_on_error parameter naming.
  • Add event.ingested to ingest node pipeline.
  • Remove ECS suffixing from dashboard/viz titles.
  • Prioritize using ECS fields in dashboards.
  • Add Suricata logo to dashboards.

Checklist

  • My code follows the style guidelines of this project
  • I have made corresponding changes to the documentation
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

Screenshots

filebeat-suricata-alerts
filebeat-suricata-events

@andrewkroh
[Filebeat] Updates to Suricata module (elastic#20220)
ff592c5 
* Updates to Suricata module

- Fix convert processor fail_on_error parameter naming.
- Add event.ingested to ingest node pipeline.
- Remove ECS suffixing from dashboard/viz titles.
- Prioritize using ECS fields in dashboards.
- Add Suricata logo to dashboards.

* Always remove event.ingested from test data

(cherry picked from commit 0659a12)
@andrewkroh
Update Suricata dashboards (elastic#20394)
a205641 
This is a followup to elastic#20220 to get the correct dashboard files into place.

(cherry picked from commit b671339)
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Aug 6, 2020

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Aug 6, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Aug 6, 2020

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20484 opened]

  • Start Time: 2020-08-06T19:19:04.621+0000

  • Duration: 56 min 27 sec

Test stats 🧪

Test Results
Failed 0
Passed 5504
Skipped 824
Total 6328

adriansr
adriansr approved these changes Aug 11, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@adriansr adriansr left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dashboards contain more changes on this cherry-pick than in the original PR, but I checked that the files end up being equal.

@andrewkroh andrewkroh merged commit 0aa391f into elastic:7.x Aug 11, 2020
@zube zube bot removed the [zube]: Done label Nov 9, 2020
@andrewkroh andrewkroh deleted the backport_20220_7.x branch January 14, 2022 14:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@adriansr adriansr adriansr approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

backport

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@andrewkroh @elasticmachine @adriansr