Skip to content

[Filebeat][New Fileset] Cisco AMP#22768

Merged
P1llus merged 14 commits intoelastic:masterfrom
P1llus:filebeat_cisco_amp
Feb 15, 2021
Merged

[Filebeat][New Fileset] Cisco AMP#22768
P1llus merged 14 commits intoelastic:masterfrom
P1llus:filebeat_cisco_amp

Conversation

@P1llus
Copy link
Copy Markdown
Member

@P1llus P1llus commented Nov 26, 2020 •
edited
Loading

What does this PR do?

This PR is a WIP for adding Cisco AMP fileset to the cisco module.

Cisco AMP allows collection of endpoint events from their Events API documented here

Why is it important?

Adds support for another very commonly used Cisco product.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Nov 26, 2020
@P1llus
Copy link
Copy Markdown
Member Author

P1llus commented Nov 26, 2020

The initial PR is created as a draft for easy sharing, its current state is that it is waiting for #22320 and is still missing core components like documentation and a finished ingest pipeline. Should finalize this right after the above PR has been merged to master.

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Nov 26, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #22768 updated

  • Start Time: 2021-02-15T08:59:21.499+0000

  • Duration: 45 min 21 sec

  • Commit: ee44ea3

Test stats 🧪

Test Results
Failed 0
Passed 13011
Skipped 2033
Total 15044

Trends 🧪

Image of Build Times

Image of Tests

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test Results
Failed 0
Passed 13011
Skipped 2033
Total 15044

@P1llus
Copy link
Copy Markdown
Member Author

P1llus commented Jan 4, 2021

Cisco AMP returns the newest event first instead of last, this would require the possibility to get timestamp of first instead of last event added through the httpjson cursor functionality.

@P1llus
Copy link
Copy Markdown
Member Author

P1llus commented Jan 15, 2021

First MVP is finalized and is now ready for review

@P1llus P1llus marked this pull request as ready for review January 15, 2021 18:47
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 15, 2021

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@P1llus P1llus added review needs_reviewer PR needs to be assigned a reviewer and removed in progress Pull request is currently in progress. review labels Jan 15, 2021
andrewstucki
andrewstucki reviewed Jan 15, 2021
View reviewed changes
Copy link
Copy Markdown

@andrewstucki andrewstucki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

initial pass

andrewstucki
andrewstucki reviewed Jan 15, 2021
View reviewed changes
marc-gr
marc-gr reviewed Jan 18, 2021
View reviewed changes
@P1llus
Copy link
Copy Markdown
Member Author

P1llus commented Jan 29, 2021

The above commit 5a0e1e4 fixes most of the comments made to the PR. Anything not marked resolved are still being worked on.

@P1llus P1llus mentioned this pull request Jan 29, 2021
Merged
5 tasks
@P1llus
Copy link
Copy Markdown
Member Author

P1llus commented Feb 3, 2021

@andrewstucki I added in your feedback to the pipeline, a few small things to note:

  1. I can only detect windows based on filepath, its not possible to detect the difference between OSX and Linux, I don't know if you have any ideas or if setting platform to windows is enough to fit most usecases?
  2. I added in uri_parts processor, and added a fallback, so that we can continue the discussion around the backwards compatibility in the other issue.

andrewkroh
andrewkroh reviewed Feb 12, 2021
View reviewed changes
adriansr
adriansr approved these changes Feb 15, 2021
View reviewed changes
Copy link
Copy Markdown
Contributor

@adriansr adriansr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@P1llus P1llus merged commit 183fae5 into elastic:master Feb 15, 2021
@P1llus P1llus mentioned this pull request Feb 15, 2021
Merged
6 tasks
@P1llus P1llus added the v7.12.0 label Feb 15, 2021
P1llus added a commit to P1llus/beats that referenced this pull request Feb 15, 2021
@P1llus
[Filebeat][New Fileset] Cisco AMP (elastic#22768)
40fd1ef 
* initial stash for cisco amp

* stashing more cisco amp changes

* stashing httpjson v2 type config and merging with master

* stashing amp changes

* updating fields.go

* first finalized MVP for Cisco AMP

* added changelog

* This commit resolves most of the comments made to the PR

* updating pipeline based on PR feedback and comments

* updating field mapping and docs based on PR comments

(cherry picked from commit 183fae5)
@P1llus P1llus mentioned this pull request Feb 15, 2021
Merged
5 tasks
P1llus added a commit that referenced this pull request Feb 15, 2021
@P1llus
Cherry-pick #22768 to 7.x: [Filebeat][New Fileset] Cisco AMP (#24038)
4ccad85 
* [Filebeat][New Fileset] Cisco AMP (#22768)

* initial stash for cisco amp

* stashing more cisco amp changes

* stashing httpjson v2 type config and merging with master

* stashing amp changes

* updating fields.go

* first finalized MVP for Cisco AMP

* added changelog

* This commit resolves most of the comments made to the PR

* updating pipeline based on PR feedback and comments

* updating field mapping and docs based on PR comments

(cherry picked from commit 183fae5)

* Removing changelog entries from other PR's
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewkroh andrewkroh andrewkroh left review comments

@marc-gr marc-gr marc-gr left review comments

+2 more reviewers

@andrewstucki andrewstucki andrewstucki left review comments

@adriansr adriansr adriansr approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

7.12 candidate enhancement Filebeat Filebeat needs_reviewer PR needs to be assigned a reviewer Theme: just_ingest_it v7.12.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@P1llus @elasticmachine @andrewstucki @andrewkroh @adriansr @marc-gr @jamiehynds