SEI package style now requires that the global on_failure sets error.kind to "pipeline_error". New package generally have this behaviour, but existing packages need to be brought up to date.
Current packages (identified by CODEOWNERS) that do not do this are (package, data stream name and file):
1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 1password,[ab]*: ensure event.kind is correctly set for pipeline errors #6599 c*: ensure event.kind is correctly set for pipeline errors #6613 c*: ensure event.kind is correctly set for pipeline errors #6613 c*: ensure event.kind is correctly set for pipeline errors #6613 cisco*: ensure event.kind is correctly set for pipeline errors #6600 cisco*: ensure event.kind is correctly set for pipeline errors #6600 cisco*: ensure event.kind is correctly set for pipeline errors #6600 cisco*: ensure event.kind is correctly set for pipeline errors #6600 cisco*: ensure event.kind is correctly set for pipeline errors #6600 cisco*: ensure event.kind is correctly set for pipeline errors #6600 cisco*: ensure event.kind is correctly set for pipeline errors #6600 cisco*: ensure event.kind is correctly set for pipeline errors #6600 cisco*: ensure event.kind is correctly set for pipeline errors #6600 cisco*: ensure event.kind is correctly set for pipeline errors #6600 c*: ensure event.kind is correctly set for pipeline errors #6613 c*: ensure event.kind is correctly set for pipeline errors #6613 c*: ensure event.kind is correctly set for pipeline errors #6613 c*: ensure event.kind is correctly set for pipeline errors #6613 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [dfg]*: ensure event.kind is correctly set for pipeline errors #6614 [hi]*: ensure event.kind is correctly set for pipeline errors #6616 [hi]*: ensure event.kind is correctly set for pipeline errors #6616 [hi]*: ensure event.kind is correctly set for pipeline errors #6616 [hi]*: ensure event.kind is correctly set for pipeline errors #6616 [hi]*: ensure event.kind is correctly set for pipeline errors #6616 iptables: ensure event.kind is correctly set for pipeline errors #6642 [hi]*: ensure event.kind is correctly set for pipeline errors #6616 jamf_compliance_reporter: ensure event.kind is correctly set for pipeline errors #6615 [jkl]*: ensure event.kind is correctly set for pipeline errors #6617 [jkl]*: ensure event.kind is correctly set for pipeline errors #6617 [jkl]*: ensure event.kind is correctly set for pipeline errors #6617 [jkl]*: ensure event.kind is correctly set for pipeline errors #6617 [jkl]*: ensure event.kind is correctly set for pipeline errors #6617 [jkl]*: ensure event.kind is correctly set for pipeline errors #6617 m*: ensure event.kind is correctly set for pipeline errors #6661 m*: ensure event.kind is correctly set for pipeline errors #6661 m*: ensure event.kind is correctly set for pipeline errors #6661 m*: ensure event.kind is correctly set for pipeline errors #6661 m*: ensure event.kind is correctly set for pipeline errors #6661 [mimecast] Ensure event.kind is correctly set for pipeline errors #6627 [modsecurity] Ensure event.kind is correctly set for pipeline errors #6672 m*: ensure event.kind is correctly set for pipeline errors #6661 [netflow] Ensure event.kind is correctly set for pipeline errors #6628 [np]*: ensure event.kind is correctly set for pipeline errors #6662 [np]*: ensure event.kind is correctly set for pipeline errors #6662 [network_traffic] Ensure event.kind is correctly set for pipeline errors #6641 [o365] Ensure event.kind is correctly set for pipeline errors #6626 [osquery] Ensure event.kind is correctly set for pipeline errors #6640 [np]*: ensure event.kind is correctly set for pipeline errors #6662 [np]*: ensure event.kind is correctly set for pipeline errors #6662 [np]*: ensure event.kind is correctly set for pipeline errors #6662 [np]*: ensure event.kind is correctly set for pipeline errors #6662 [np]*: ensure event.kind is correctly set for pipeline errors #6662 [np]*: ensure event.kind is correctly set for pipeline errors #6662 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [Suricata] Ensure event.kind is correctly set for pipeline errors #6625 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [qrs]*: ensure event.kind is correctly set for pipeline errors #6663 [system_audit] Ensure event.kind is correctly set for pipeline errors #6639 [tanium] Ensure event.kind is correctly set for pipeline errors #6660 [tenable_sc] Ensure event.kind is correctly set for pipeline errors #6659 [thycotic_ss] Ensure event.kind is correctly set for pipeline errors #6658 [ti_abusech] Ensure event.kind is correctly set for pipeline errors #6629 [ti_anomali] Ensure event.kind is correctly set for pipeline errors #6630 [ti_cif3] Ensure event.kind is correctly set for pipeline errors #6631 [ti_cybersixgill] Ensure event.kind is correctly set for pipeline errors #6632 [ti_misp] Ensure event.kind is correctly set for pipeline errors #6633 [ti_otx] Ensure event.kind is correctly set for pipeline errors #6634 [ti_rapid7_threat_command] Ensure event.kind is correctly set for pipeline errors #6635 [ti_recordedfuture] Ensure event.kind is correctly set for pipeline errors #6636 [ti_threatq] Ensure event.kind is correctly set for pipeline errors #6637 [tines] Ensure event.kind is correctly set for pipeline errors #6655 [trendmicro] Ensure event.kind is correctly set for pipeline errors #6656 [trend_micro_vision_one] Ensure event.kind is correctly set for pipeline errors #6657 [Windows] Ensure event.kind is correctly set for pipeline errors #6612 [zeek] Ensure event.kind is correctly set for pipeline errors #6638 [zerofox] Ensure event.kind is correctly set for pipeline errors #6654 [zoom] Ensure event.kind is correctly set for pipeline errors #6653 [zscaler_zia] Ensure event.kind is correctly set for pipeline errors #6652 [zscaler_zpa] Ensure event.kind is correctly set for pipeline errors #6651 [zeronetworks] Ensure event.kind is correctly set for pipeline errors #6650
SEI package style now requires that the global
on_failuresetserror.kindto "pipeline_error". New package generally have this behaviour, but existing packages need to be brought up to date.Current packages (identified by CODEOWNERS) that do not do this are (package, data stream name and file):