Skip to content

Commit a51de2c

Browse files
moxarth-rathodmoxarth-rathod
committed
Resolve merge conflicts
2 parents b04de05 + 7189d7b commit a51de2c

File tree

148 files changed

+24843
-721
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

148 files changed

+24843
-721
lines changed

‎.github/CODEOWNERS‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @elastic/ecosystem
33

44
# Default owner of packages, which will triage new packages and assignment to other teams.
5-
/packages/ @elastic/ecosystem
5+
/packages/ @elastic/integrations-triaging
66

77
# CODEOWNERS file is checked by CI.
88
/.github/CODEOWNERS
@@ -58,6 +58,7 @@
5858
/packages/aws/data_stream/s3_storage_lens @elastic/obs-infraobs-integrations
5959
/packages/aws/data_stream/s3access @elastic/obs-ds-hosted-services
6060
/packages/aws/data_stream/securityhub_findings @elastic/security-service-integrations
61+
/packages/aws/data_stream/securityhub_findings_full_posture @elastic/security-service-integrations
6162
/packages/aws/data_stream/securityhub_insights @elastic/security-service-integrations
6263
/packages/aws/data_stream/sns @elastic/obs-infraobs-integrations
6364
/packages/aws/data_stream/sqs @elastic/obs-infraobs-integrations
@@ -126,6 +127,7 @@
126127
/packages/beaconing @elastic/ml-ui @elastic/sec-applied-ml
127128
/packages/beat @elastic/stack-monitoring
128129
/packages/beyondinsight_password_safe @elastic/security-service-integrations
130+
/packages/beyondtrust_pra @elastic/security-service-integrations
129131
/packages/bitdefender @elastic/security-service-integrations
130132
/packages/bitwarden @elastic/security-service-integrations
131133
/packages/blacklens @elastic/security-service-integrations
@@ -310,14 +312,15 @@
310312
/packages/nginx @elastic/obs-infraobs-integrations
311313
/packages/nginx_ingress_controller @elastic/obs-ds-hosted-services
312314
/packages/nginx_ingress_controller_otel @elastic/obs-infraobs-integrations
315+
/packages/nvidia_gpu @elastic/obs-infraobs-integrations
313316
/packages/o365 @elastic/security-service-integrations
314317
/packages/okta @elastic/security-service-integrations
315318
/packages/openai @elastic/obs-infraobs-integrations
316319
/packages/opencanary @elastic/security-service-integrations
317320
/packages/oracle @elastic/obs-infraobs-integrations
318321
/packages/oracle_weblogic @elastic/obs-infraobs-integrations
319322
/packages/osquery @elastic/sec-deployment-and-devices
320-
/packages/osquery_manager @elastic/security-asset-management
323+
/packages/osquery_manager @elastic/security-defend-workflows
321324
/packages/pad @elastic/ml-ui @elastic/sec-applied-ml
322325
/packages/panw @elastic/sec-deployment-and-devices
323326
/packages/panw_cortex_xdr @elastic/security-service-integrations

‎.github/ISSUE_TEMPLATE/integration_bug.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ body:
5656
- Network Beaconing Identification [beaconing]
5757
- Beat [beat]
5858
- BeyondInsight and Password Safe [beyondinsight_password_safe]
59+
- BeyondTrust PRA [beyondtrust_pra]
5960
- BitDefender [bitdefender]
6061
- Bitwarden [bitwarden]
6162
- blacklens.io [blacklens]
@@ -215,6 +216,7 @@ body:
215216
- Nginx [nginx]
216217
- Nginx Ingress Controller Logs [nginx_ingress_controller]
217218
- Nginx Ingress Controller OpenTelemetry Logs [nginx_ingress_controller_otel]
219+
- NVIDIA GPU Monitoring [nvidia_gpu]
218220
- Microsoft Office 365 [o365]
219221
- Microsoft Office 365 Metrics [o365_metrics]
220222
- Okta [okta]
@@ -266,6 +268,7 @@ body:
266268
- SonicWall Firewall [sonicwall_firewall]
267269
- Sophos [sophos]
268270
- Sophos Central [sophos_central]
271+
- Splunk [splunk]
269272
- Spring Boot [spring_boot]
270273
- SpyCloud Enterprise Protection [spycloud]
271274
- SQL Input [sql_input]

‎.github/ISSUE_TEMPLATE/integration_feature_request.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ body:
5656
- Network Beaconing Identification [beaconing]
5757
- Beat [beat]
5858
- BeyondInsight and Password Safe [beyondinsight_password_safe]
59+
- BeyondTrust PRA [beyondtrust_pra]
5960
- BitDefender [bitdefender]
6061
- Bitwarden [bitwarden]
6162
- blacklens.io [blacklens]
@@ -215,6 +216,7 @@ body:
215216
- Nginx [nginx]
216217
- Nginx Ingress Controller Logs [nginx_ingress_controller]
217218
- Nginx Ingress Controller OpenTelemetry Logs [nginx_ingress_controller_otel]
219+
- NVIDIA GPU Monitoring [nvidia_gpu]
218220
- Microsoft Office 365 [o365]
219221
- Microsoft Office 365 Metrics [o365_metrics]
220222
- Okta [okta]
@@ -266,6 +268,7 @@ body:
266268
- SonicWall Firewall [sonicwall_firewall]
267269
- Sophos [sophos]
268270
- Sophos Central [sophos_central]
271+
- Splunk [splunk]
269272
- Spring Boot [spring_boot]
270273
- SpyCloud Enterprise Protection [spycloud]
271274
- SQL Input [sql_input]

‎docs/extend/dashboard-guidelines.md‎

Lines changed: 6 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -66,15 +66,11 @@ Keep the following guidelines in mind when positioning your elements on dashboar
6666

6767
* Keep related visualizations close to each other.
6868

69-
:::{image} images/grouping-in-visualizations.png
70-
:alt: Closely grouped visualizations
71-
:::
69+
![Closely grouped visualizations](images/grouping-in-visualizations.png)
7270

7371
* Use Markdown to create blocks of related content.
7472

75-
:::{image} images/markdown-grouping.png
76-
:alt: Markdown grouping in visualizations
77-
:::
73+
![Markdown grouping in visualizations](images/markdown-grouping.png)
7874

7975
* Reading Direction
8076

@@ -84,9 +80,7 @@ Keep the following guidelines in mind when positioning your elements on dashboar
8480

8581
Placing a big chart at the center of a dashboard, especially one with prominent visual shapes such as rectangles, helps to reinforce a natural visual focal point that lies in the center of the interface.
8682

87-
:::{image} images/rows-in-visualizations.png
88-
:alt: Central focal point in visualization
89-
:::
83+
![Central focal point in visualization](images/rows-in-visualizations.png)
9084

9185

9286

@@ -117,9 +111,7 @@ As much as possible, avoid using general filters, that is filters with `-*`. Co
117111

118112
Example:
119113

120-
:::{image} images/filter-in-visualization.png
121-
:alt: Filter in a visualization
122-
:::
114+
![Filter in a visualization](images/filter-in-visualization.png)
123115

124116

125117
### Do not use library visualizations [_do_not_use_library_visualizations]
@@ -142,9 +134,7 @@ Use color to distinguish categories, represent quantity/density, and highlight d
142134

143135
If your dashboard is made to identify specific behaviors, it might be interesting to consider a color setting that could help to point those out. Use a neutral color for generic elements and an accented color for the things that you want to highlight.
144136

145-
:::{image} images/colors-in-visualizations.png
146-
:alt: Colors in visualizations
147-
:::
137+
![Colors in visualizations](images/colors-in-visualizations.png)
148138

149139

150140
## Titles in Visualisations matter [_titles_in_visualisations_matter]
@@ -154,6 +144,4 @@ Titles can have a strong visual impact on dashboards, especially when there are
154144
* Remove unnecessary or repetitive titles when the information is already explained or written within the chart.
155145
* When a title is needed, make it self explanatory and exhaustive. This way, you will be able to remove axis titles and other specifications leaving more space for the chart itself.
156146

157-
:::{image} images/titles-in-visualizations.png
158-
:alt: Titles in visualizations
159-
:::
147+
![Titles in visualizations](images/titles-in-visualizations.png)

‎docs/extend/developer-workflow-support-old-package.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,7 @@ Follow these detailed steps to release a fix for a given package version:
5959
6060
**Please, pay attention!**, if you just run the pipeline it’ll wait for your inputs, nothing will happen without that.
6161
62-
:::{image} images/backport_input_step.png
63-
:alt: waiting input step
64-
:::
62+
![waiting input step](images/backport_input_step.png)
6563
6664
Pipeline’s inputs:
6765

‎docs/extend/quick-start.md‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -114,9 +114,7 @@ You’ll need to have a few requirements in place to run this tutorial:
114114

115115
3. After the command runs, check that your new package appears in Kibana under **Management > Integrations > Installed integrations**.
116116

117-
:::{image} images/package-installed.png
118-
:alt: Kibana installed integrations tab with a card for my sample package
119-
:::
117+
![Kibana installed integrations tab with a card for my sample package](images/package-installed.png)
120118

121119

122120

@@ -417,9 +415,7 @@ To run these steps using {{fleet}}-managed {{agent}}, you just need to update th
417415
2. In the search field, enter `log.file.path.text : *`. The search should return a couple of log entries.
418416
3. Hover over an entry and click `Enter` to view the cell contents.
419417

420-
:::{image} images/datastream-log-message.png
421-
:alt: Data stream showing log message: "this is a nice day"
422-
:::
418+
![Data stream showing log message: "this is a nice day"](images/datastream-log-message.png)
423419

424420

425421

‎packages/abnormal_security/_dev/build/docs/README.md‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,12 @@ The Abnormal Security integration collects data for AI Security Mailbox (formerl
66

77
## Data streams
88

9-
The Abnormal Security integration collects four types of logs:
9+
The Abnormal Security integration collects six types of logs:
1010

1111
- **[AI Security Mailbox](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/AI%20Security%20Mailbox%20(formerly%20known%20as%20Abuse%20Mailbox))** - Get details of AI Security Mailbox.
1212

13+
- **[AI Security Mailbox Not Analyzed](https://app.swaggerhub.com/apis/abnormal-security/abx/1.4.3#/AI%20Security%20Mailbox%20(formerly%20known%20as%20Abuse%20Mailbox)/v1_abuse_mailbox_not_analyzed_retrieve)** - Get details of messages submitted to AI Security Mailbox that were not analyzed.
14+
1315
- **[Audit](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Audit%20Logs)** - Get details of Audit logs for Portal.
1416

1517
- **[Case](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/Cases)** - Get details of Abnormal Cases.
@@ -76,6 +78,16 @@ This is the `ai_security_mailbox` dataset.
7678

7779
{{fields "ai_security_mailbox"}}
7880

81+
### AI Security Mailbox Not Analyzed
82+
83+
This is the `ai_security_mailbox_not_analyzed` dataset.
84+
85+
#### Example
86+
87+
{{event "ai_security_mailbox_not_analyzed"}}
88+
89+
{{fields "ai_security_mailbox_not_analyzed"}}
90+
7991
### Audit
8092

8193
This is the `audit` dataset.

‎packages/abnormal_security/_dev/deploy/docker/files/config.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,65 @@ rules:
101101
"attackType": "Attack Type: Spam"
102102
}
103103
`}}
104+
- path: /v1/abuse_mailbox/not_analyzed
105+
methods: ['GET']
106+
request_headers:
107+
Authorization:
108+
- "Bearer xxxx"
109+
responses:
110+
- status_code: 200
111+
headers:
112+
Content-Type:
113+
- 'application/json'
114+
body: |-
115+
{{ minify_json `
116+
{
117+
"results": [
118+
{
119+
"abx_message_id": -7361381340273523750,
120+
"recipient": {
121+
"email": "phishing@test.com",
122+
"name": "Phishing Test"
123+
},
124+
"reported_datetime": "2025-03-06T17:27:15Z",
125+
"reporter": {
126+
"email": "reporter@test.com",
127+
"name": "Reporter Test"
128+
},
129+
"subject": "Re: Subject",
130+
"not_analyzed_reason": "ROUTED_SUBMISSION"
131+
},
132+
{
133+
"abx_message_id": 240750237502375023,
134+
"recipient": {
135+
"email": "phishing@test.com",
136+
"name": "Phishing Test"
137+
},
138+
"reported_datetime": "2025-03-04T18:50:27Z",
139+
"reporter": {
140+
"email": "test@example.com",
141+
"name": "Test Example"
142+
},
143+
"subject": "Fwd: Forwarded email",
144+
"not_analyzed_reason": "INVALID_SUBMISSION"
145+
},
146+
{
147+
"abx_message_id": -1234567891234567891,
148+
"recipient": {
149+
"email": "phishing@test.com",
150+
"name": "Phishing Test"
151+
},
152+
"reported_datetime": "2025-03-04T17:03:55Z",
153+
"reporter": {
154+
"email": "info@test.com",
155+
"name": "Info Test"
156+
},
157+
"subject": "Fwd: Forwarded email",
158+
"not_analyzed_reason": "PHISHING_SIMULATION"
159+
}
160+
]
161+
}
162+
`}}
104163
- path: /v1/auditlogs
105164
methods: ['GET']
106165
query_params:

‎packages/abnormal_security/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.6.0"
3+
changes:
4+
- description: New data stream for not analyzed messages in AI Security Mailbox.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13483
27
- version: "1.5.0"
38
changes:
49
- description: Added support for vendor case data stream.

‎packages/abnormal_security/data_stream/ai_security_mailbox/agent/stream/cel.yml.hbs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
config_version: 2
22
interval: {{interval}}
3-
{{#if enable_request_tracer}}
4-
resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson"
5-
resource.tracer.maxbackups: 5
6-
{{/if}}
3+
resource.tracer:
4+
enabled: {{enable_request_tracer}}
5+
filename: "../../logs/cel/http-request-trace-*.ndjson"
6+
maxbackups: 5
77
{{#if proxy_url}}
88
resource.proxy_url: {{proxy_url}}
99
{{/if}}

0 commit comments

Comments
 (0)