You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-application-activity.log-expected.json
Copy file name to clipboardExpand all lines: packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-network-activity.log-expected.json
Copy file name to clipboardExpand all lines: packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/default.yml
+21-3Lines changed: 21 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -20,6 +20,25 @@ processors:
20
20
- append:
21
21
field: error.message
22
22
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
23
+
- script:
24
+
lang: painless
25
+
description: Drops null/empty values recursively.
26
+
tag: painless_remove_null_from_ocsf
27
+
if: ctx.ocsf instanceof Map
28
+
source: |-
29
+
boolean drop(Object object) {
30
+
if (object == null || object == '') {
31
+
return true;
32
+
} else if (object instanceof Map) {
33
+
((Map) object).values().removeIf(v -> drop(v));
34
+
return (((Map) object).size() == 0);
35
+
} else if (object instanceof List) {
36
+
((List) object).removeIf(v -> drop(v));
37
+
return (((List) object).length == 0);
38
+
}
39
+
return false;
40
+
}
41
+
drop(ctx.ocsf);
23
42
- script:
24
43
description: Recursively traverses the ocsf object to convert suspected timestamps to milliseconds.
Copy file name to clipboardExpand all lines: packages/armis/_dev/build/docs/README.md
+14-33Lines changed: 14 additions & 33 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,65 +22,46 @@ The Armis integration collects three types of logs.
22
22
23
23
## Requirements
24
24
25
-
### Agentless Enabled Integration
25
+
### Agentless-enabled integration
26
+
26
27
Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
27
28
28
29
Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
29
30
30
-
### Agent Based Installation
31
-
- Elastic Agent must be installed
32
-
- You can install only one Elastic Agent per host.
33
-
- Elastic Agent is required to stream data from the GCP Pub/Sub or REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.
34
-
35
-
#### Installing and managing an Elastic Agent:
36
-
37
-
You have a few options for installing and managing an Elastic Agent:
38
-
39
-
#### Install a Fleet-managed Elastic Agent (recommended):
40
-
41
-
With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.
42
-
43
-
#### Install Elastic Agent in standalone mode (advanced users):
44
-
45
-
With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.
46
-
47
-
#### Install Elastic Agent in a containerized environment:
48
-
49
-
You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry and we provide deployment manifests for running on Kubernetes.
31
+
### Agent-based installation
50
32
51
-
There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html).
33
+
Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md).
52
34
53
35
## Setup
54
36
55
-
### To collect logs through REST API, follow the below steps:
37
+
### Collect logs through REST API
56
38
57
39
1. Log in to your Armis portal.
58
40
2. Navigate to the **Settings** tab.
59
41
3. Select **Asset Management & Security**.
60
42
4. Go to **API Management** and generate a **Secret Key**.
61
43
62
-
### Enabling the integration in Elastic:
44
+
### Enable the integration in Elastic
63
45
64
-
1. In Kibana navigate to Management > Integrations.
65
-
2. In "Search for integrations" top bar, search for `Armis`.
66
-
3. Select the "Armis" integration from the search results.
67
-
4. Select "Add Armis" to add the integration.
68
-
5. Add all the required integration configuration parameters, including the URL, Secret Key to enable data collection.
69
-
6. Select "Save and continue" to save the integration.
46
+
1. In Kibana navigate to **Management** > **Integrations**.
47
+
2. In the search bar, type **Armis**.
48
+
3. Select the **Armis** integration and add it.
49
+
4. Add all the required integration configuration parameters, including the URL, Secret Key to enable data collection.
50
+
5. Save the integration.
70
51
71
52
## Limitations
72
53
73
-
1.In the **vulnerability data stream**, our filtering mechanism for the **vulnerability search API** relies specifically on the `lastDetected` field. This means that when a user takes action on a vulnerability and `lastDetected` updates, only then will the event for that vulnerability be retrieved. Initially, we assumed this field would always have a value and could be used as a cursor timestamp for fetching data between intervals. However, due to inconsistencies in the API response, we observed cases where `lastDetected` is `null`.
54
+
In the **vulnerability data stream**, our filtering mechanism for the **vulnerability search API** relies specifically on the `lastDetected` field. This means that when a user takes action on a vulnerability and `lastDetected` updates, only then will the event for that vulnerability be retrieved. Initially, we assumed this field would always have a value and could be used as a cursor timestamp for fetching data between intervals. However, due to inconsistencies in the API response, we observed cases where `lastDetected` is `null`.
74
55
75
56
## Troubleshooting
76
57
77
-
- If you are seeing below mentioned errors in the **vulnerability data stream**, try reducing the page size in your request.
58
+
- If you get the following errors in the **vulnerability data stream**, reduce the page size in your request.
78
59
79
60
**Common errors:**
80
61
-`502 Bad Gateway`
81
62
-`414 Request-URI Too Large`
82
63
83
-
- If you are encountering issues in the **alert data stream**, particularly during the initial data fetch, try reducing the initial interval.
64
+
- If you encounter issues in the **alert data stream**, particularly during the initial data fetch, reduce the initial interval.
84
65
85
66
**Example error:**
86
67
-`The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.`
0 commit comments