-
Notifications
You must be signed in to change notification settings - Fork 561
[aws, blacklens, github, microsoft_sentinel] Conflicting event.kind values in constant_keyword fields #17561
Copy link
Copy link
Closed
Labels
Integration:awsAWSAWSIntegration:blacklensblacklens.io (Community supported)blacklens.io (Community supported)Integration:githubGitHubGitHubIntegration:microsoft_sentinelMicrosoft SentinelMicrosoft SentinelTeam:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]bugSomething isn't working, use only for issuesSomething isn't working, use only for issues
Metadata
Metadata
Assignees
Labels
Integration:awsAWSAWSIntegration:blacklensblacklens.io (Community supported)blacklens.io (Community supported)Integration:githubGitHubGitHubIntegration:microsoft_sentinelMicrosoft SentinelMicrosoft SentinelTeam:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]bugSomething isn't working, use only for issuesSomething isn't working, use only for issues
Type
Fields
Give feedbackNo fields configured for issues without a type.
The following data streams define
event.kindas aconstant_keywordfield but attempt to set it to conflicting values within their ingest pipelines. This configuration will cause indexing errors becauseconstant_keywordfields must have a single, immutable value for all documents in the index.Summary of Issues
alert), but the ingest pipeline sets it to a different value (e.g.,pipeline_error) during error handling or other conditional logic.constant_keywordbut does not specify a value (meaning the first indexed document sets the constant for the index). However, the pipeline sets the field to multiple different values (e.g.,statenormally, butpipeline_erroron failure), ensuring that one of those cases will fail to index.Affected Data Streams
securityhub_findings_full_posturestate)default.yml:2668 (sets
pipeline_error)alertsalert)pipeline_error)code_scanningalert)pipeline_error)dependabotalert)pipeline_error)issuesevent)pipeline_error)secret_scanningalert)pipeline_error)alertalert)pipeline_error)eventalert)pipeline_error)incidentalert)pipeline_error)NOTE: websphere_application_server also uses contstant_keyword for
event.kind, but does not set it to multiple values (onlymetric).Detection
Details
Execute this sqlite query against the pre-build database from
go-package-spec.NOTE: azure.platformlogs has this problem with the
event.datasetfield, but it is resettingevent.datasetbefore rerouting so it is a benign issue.