You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is a list of integrations that should be manually tested to some extent, what should be tested is listed below each integration, this extends the amount of testing already listed in the communicated list of tests.
network_traffic: Includes custom data-view/index pattern. Once installed, ingest some data to ensure that the data-view in the dashboards are still assigned correctly. Also ensure that the data-view is in the list of available data-views in for example the data-view list.
ti_maltiverse: Has its own ILM (that should be converted) and transforms, need to ensure the transforms are installed and running after the integration is configured. Try to add in at least one sample document as well, either manually or through the agent system tests.
ti_anomali: Has its own ILM (that should be converted) and transforms, need to ensure the transforms are installed and running after the integration is configured. Try to add in at least one sample document as well, either manually or through the agent system tests.
ti_recorded_future Has its own ILM (that should be converted) and transforms, need to ensure the transforms are installed and running after the integration is configured. Try to add in at least one sample document as well, either manually or through the agent system tests.
ti_rapid7: Has its own security detection rules, while these should be removed at some point as they are somewhat duplicates of the built-in SIEM rules for indicator match, currently we need to ensure they are installed and available in the SIEM UI.
cel: Input type package, try to change common options there like dataset name or ingest pipeline, ensure that they are applied to the relevant index templates and data still comes in.
1-2 integrations that uses dynamic ECS templates (import_mappings: true in build.yml). For simplicity we could pick any that has log/file input for example, to simplify the process. We should ensure the dynamic template is added correctly to its relevant index templates, and that the results are as we expect them to be
This is a list of integrations that should be manually tested to some extent, what should be tested is listed below each integration, this extends the amount of testing already listed in the communicated list of tests.
network_traffic: Includes custom data-view/index pattern. Once installed, ingest some data to ensure that the data-view in the dashboards are still assigned correctly. Also ensure that the data-view is in the list of available data-views in for example the data-view list.
ti_maltiverse: Has its own ILM (that should be converted) and transforms, need to ensure the transforms are installed and running after the integration is configured. Try to add in at least one sample document as well, either manually or through the agent system tests.
ti_anomali: Has its own ILM (that should be converted) and transforms, need to ensure the transforms are installed and running after the integration is configured. Try to add in at least one sample document as well, either manually or through the agent system tests.
ti_recorded_future Has its own ILM (that should be converted) and transforms, need to ensure the transforms are installed and running after the integration is configured. Try to add in at least one sample document as well, either manually or through the agent system tests.
ti_rapid7: Has its own security detection rules, while these should be removed at some point as they are somewhat duplicates of the built-in SIEM rules for indicator match, currently we need to ensure they are installed and available in the SIEM UI.
cel: Input type package, try to change common options there like dataset name or ingest pipeline, ensure that they are applied to the relevant index templates and data still comes in.
1-2 integrations that uses dynamic ECS templates (import_mappings: true in build.yml). For simplicity we could pick any that has log/file input for example, to simplify the process. We should ensure the dynamic template is added correctly to its relevant index templates, and that the results are as we expect them to be