-
Notifications
You must be signed in to change notification settings - Fork 562
[Agentless Integrations] Agentless integrations 'organization' field pipeline failure #14142
Copy link
Copy link
Closed
Labels
Integration:armisArmisArmisIntegration:awsAWSAWSIntegration:beyondtrust_praBeyondTrust PRABeyondTrust PRAIntegration:claroty_xdomeClaroty xDomeClaroty xDomeIntegration:cloud_security_postureSecurity Posture ManagementSecurity Posture ManagementIntegration:crowdstrikeCrowdStrikeCrowdStrikeIntegration:ess_billingElasticsearch Service BillingElasticsearch Service BillingIntegration:google_sccGoogle Security Command CenterGoogle Security Command CenterIntegration:google_secopsGoogle SecOpsGoogle SecOpsIntegration:google_workspaceGoogle WorkspaceGoogle WorkspaceIntegration:m365_defenderMicrosoft Defender XDRMicrosoft Defender XDRIntegration:microsoft_defender_endpointMicrosoft Defender for EndpointMicrosoft Defender for EndpointIntegration:microsoft_sentinelMicrosoft SentinelMicrosoft SentinelIntegration:o365Microsoft Office 365Microsoft Office 365Integration:oktaOktaOktaIntegration:panw_cortex_xdrPalo Alto Cortex XDRPalo Alto Cortex XDRIntegration:prisma_cloudPalo Alto Prisma CloudPalo Alto Prisma CloudIntegration:proofpoint_itmProofpoint ITMProofpoint ITMIntegration:qualys_vmdrQualys VMDRQualys VMDRIntegration:sentinel_oneSentinelOneSentinelOneIntegration:splunkSplunkSplunkIntegration:sublime_securitySublime SecuritySublime SecurityIntegration:tenable_ioTenable Vulnerability ManagementTenable Vulnerability ManagementIntegration:ti_abusechabuse.chabuse.chIntegration:ti_recordedfutureRecorded FutureRecorded FutureIntegration:ti_threatqThreatQuotient (Partner supported)ThreatQuotient (Partner supported)Integration:vectra_ruxVectra RUXVectra RUXIntegration:wizWizWizIntegration:zscaler_ziaZscaler Internet AccessZscaler Internet AccessTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]agentlessAgentless related issuesAgentless related issues
Metadata
Metadata
Assignees
Labels
Integration:armisArmisArmisIntegration:awsAWSAWSIntegration:beyondtrust_praBeyondTrust PRABeyondTrust PRAIntegration:claroty_xdomeClaroty xDomeClaroty xDomeIntegration:cloud_security_postureSecurity Posture ManagementSecurity Posture ManagementIntegration:crowdstrikeCrowdStrikeCrowdStrikeIntegration:ess_billingElasticsearch Service BillingElasticsearch Service BillingIntegration:google_sccGoogle Security Command CenterGoogle Security Command CenterIntegration:google_secopsGoogle SecOpsGoogle SecOpsIntegration:google_workspaceGoogle WorkspaceGoogle WorkspaceIntegration:m365_defenderMicrosoft Defender XDRMicrosoft Defender XDRIntegration:microsoft_defender_endpointMicrosoft Defender for EndpointMicrosoft Defender for EndpointIntegration:microsoft_sentinelMicrosoft SentinelMicrosoft SentinelIntegration:o365Microsoft Office 365Microsoft Office 365Integration:oktaOktaOktaIntegration:panw_cortex_xdrPalo Alto Cortex XDRPalo Alto Cortex XDRIntegration:prisma_cloudPalo Alto Prisma CloudPalo Alto Prisma CloudIntegration:proofpoint_itmProofpoint ITMProofpoint ITMIntegration:qualys_vmdrQualys VMDRQualys VMDRIntegration:sentinel_oneSentinelOneSentinelOneIntegration:splunkSplunkSplunkIntegration:sublime_securitySublime SecuritySublime SecurityIntegration:tenable_ioTenable Vulnerability ManagementTenable Vulnerability ManagementIntegration:ti_abusechabuse.chabuse.chIntegration:ti_recordedfutureRecorded FutureRecorded FutureIntegration:ti_threatqThreatQuotient (Partner supported)ThreatQuotient (Partner supported)Integration:vectra_ruxVectra RUXVectra RUXIntegration:wizWizWizIntegration:zscaler_ziaZscaler Internet AccessZscaler Internet AccessTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]agentlessAgentless related issuesAgentless related issues
Type
Fields
Give feedbackNo fields configured for issues without a type.
Pipeline failure is:
Where the field causing the failure is
organizationbelow:Agentless policies add the division, organization, and team as global data tags:
https://github.com/elastic/kibana/blob/12b7429afe0fb470fa6c85168c9040a5957bbe8b/x-pack/platform/plugins/shared/fleet/public/applications/fleet/sections/agent_policy/create_package_policy_page/single_page_layout/hooks/setup_technology.ts#L195-L196
Global data tags get injected via add_fields processors when the policy is created:
https://github.com/elastic/kibana/blob/12b7429afe0fb470fa6c85168c9040a5957bbe8b/x-pack/platform/plugins/shared/fleet/server/services/agent_policies/package_policies_to_agent_inputs.ts#L181-L191
Until this will be fixed in elastic/kibana#221312, a workaround should be applied in the current agentless integrations simialr to #14056