Skip to content

[O365] updating o365 ECS version and adding event.original options#1117

Merged
P1llus merged 3 commits intoelastic:masterfrom
P1llus:package_o365_ecs110
Jun 11, 2021
Merged

[O365] updating o365 ECS version and adding event.original options#1117
P1llus merged 3 commits intoelastic:masterfrom
P1llus:package_o365_ecs110

Conversation

@P1llus
Copy link
Copy Markdown
Member

@P1llus P1llus commented Jun 9, 2021

What does this PR do?

Updates package ECS version to 1.10.
Sync module changes to packages if any.
Adds Preserve Raw event functionality if not already exists.
Adds pipeline tests if missing.
Adds missing tags + moving tags to advanced settings.
Adds possibility to add custom processors.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

Related issues

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jun 9, 2021

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@P1llus P1llus mentioned this pull request Jun 9, 2021
Closed
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jun 9, 2021 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #1117 updated

  • Start Time: 2021-06-11T08:50:35.459+0000

  • Duration: 17 min 35 sec

  • Commit: 023d3e1

Test stats 🧪

Test Results
Failed 0
Passed 25
Skipped 0
Total 25

Trends 🧪

Image of Build Times

Image of Tests

@marc-gr marc-gr mentioned this pull request Jun 9, 2021
Closed
43 tasks
marc-gr
marc-gr reviewed Jun 9, 2021
View reviewed changes
packages/o365/data_stream/audit/agent/stream/o365audit.yml.hbs Outdated
target: '_conf.tenants'
fields:
mappings:
{{#if processors}}
Copy link
Copy Markdown
Contributor

@marc-gr marc-gr Jun 9, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this condition needs to be a bit different, because if I understand it correctly you want to have processors: if any of tenant_names or processors are set. As it is now it will always require to have tenant_names set or processors will be ignored.

Copy link
Copy Markdown
Member Author

@P1llus P1llus Jun 9, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, totally missed the encapsulated IF statement there

Copy link
Copy Markdown
Member Author

@P1llus P1llus Jun 11, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you check if this new commit fixes it @marc-gr ? I needed to check for processors twice, once to add it if there is no tenant names, and another to always add the actual processors at the bottom.

Copy link
Copy Markdown
Contributor

@marc-gr marc-gr Jun 11, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it loos fine 👍

@P1llus P1llus merged commit 2442a48 into elastic:master Jun 11, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marc-gr marc-gr marc-gr approved these changes

Assignees

No one assigned

Labels

7.14 candidate enhancement New feature or request Integration:o365 Microsoft Office 365

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@P1llus @elasticmachine @marc-gr