Skip to content

Jamf Protect 3.0.0#12871

Merged
kcreddy merged 9 commits intoelastic:mainfrom
txhaflaire:jamfprotect_3.0.0
Mar 5, 2025
Merged

Jamf Protect 3.0.0#12871
kcreddy merged 9 commits intoelastic:mainfrom
txhaflaire:jamfprotect_3.0.0

Conversation

@txhaflaire
Copy link
Copy Markdown
Contributor

@txhaflaire txhaflaire commented Feb 24, 2025

Type of change:

  • Enhancement

Proposed commit message

  • Adding new event gatkeeper_user_override
  • Mapping existing fields from Jamf Protect to newly added ECS fields from PR

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

elastic-package test system

2025/02/24 08:36:03  INFO New version is available - v0.109.1. Download from: https://github.com/elastic/elastic-package/releases/tag/v0.109.1
Run system tests for the package
2025/02/24 08:36:04  INFO License text found in "/Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/LICENSE.txt" will be included in package
2025/02/24 08:37:02  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/jamf-protect-alerts-http-endpoint-1740382622787625000.log
2025/02/24 08:37:14  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/elastic-agent-1740382634369614000.log
2025/02/24 08:38:30  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/jamf-protect-telemetry-http-endpoint-1740382710792397000.log
2025/02/24 08:38:40  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/elastic-agent-1740382720664742000.log
2025/02/24 08:39:57  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/jamf-protect-telemetry-legacy-http-endpoint-1740382797925113000.log
2025/02/24 08:40:07  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/elastic-agent-1740382807818148000.log
2025/02/24 08:41:22  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/jamf-protect-webthreats-http-endpoint-1740382882594229000.log
2025/02/24 08:41:33  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/elastic-agent-1740382893991909000.log
2025/02/24 08:42:40  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/jamf-protect-webtraffic-http-endpoint-1740382960636946000.log
2025/02/24 08:42:49  INFO Write container logs to file: /Users/thijs.xhaflaire/Documents/GitHub/Elastic/_integrations/build/container-logs/elastic-agent-1740382969904975000.log
--- Test results for package: jamf_protect - START ---
╭──────────────┬────────────────────┬───────────┬───────────────┬────────┬───────────────╮
│ PACKAGE      │ DATA STREAM        │ TEST TYPE │ TEST NAME     │ RESULT │  TIME ELAPSED │
├──────────────┼────────────────────┼───────────┼───────────────┼────────┼───────────────┤
│ jamf_protect │ alerts             │ system    │ http-endpoint │ PASS   │ 51.972795625s │
│ jamf_protect │ telemetry          │ system    │ http-endpoint │ PASS   │    50.326152s │
│ jamf_protect │ telemetry_legacy   │ system    │ http-endpoint │ PASS   │   51.4097865s │
│ jamf_protect │ web_threat_events  │ system    │ http-endpoint │ PASS   │ 49.647127166s │
│ jamf_protect │ web_traffic_events │ system    │ http-endpoint │ PASS   │ 43.261170042s │
╰──────────────┴────────────────────┴───────────┴───────────────┴────────┴───────────────╯
--- Test results for package: jamf_protect - END   ---
Done```

@txhaflaire txhaflaire requested a review from a team as a code owner February 24, 2025 08:03
@kcreddy
Copy link
Copy Markdown
Contributor

kcreddy commented Feb 24, 2025

/test

@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod bot commented Feb 24, 2025

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@kcreddy kcreddy added enhancement New feature or request Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:jamf_protect Jamf Protect (Partner supported) labels Feb 25, 2025
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Feb 25, 2025

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

kcreddy
kcreddy reviewed Feb 25, 2025
View reviewed changes
@txhaflaire txhaflaire requested a review from kcreddy February 27, 2025 17:27
@txhaflaire
Copy link
Copy Markdown
Contributor Author

txhaflaire commented Feb 27, 2025

@kcreddy can you review?

efd6
efd6 reviewed Feb 27, 2025
View reviewed changes
packages/jamf_protect/data_stream/telemetry_legacy/elasticsearch/ingest_pipeline/default.yml Outdated
- set:
field: ecs.version
value: '8.11.0'
value: '8.16.0''
Copy link
Copy Markdown
Contributor

@efd6 efd6 Feb 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

8.17.0?

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Feb 27, 2025

/test

@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Feb 27, 2025

Test failures:

Error: checking package failed: linting package failed: found 3 validation errors:
   1. file "/opt/buildkite-agent/builds/bk-agent-prod-gcp-1740695740402832303/elastic/integrations/packages/jamf_protect/data_stream/telemetry_legacy/elasticsearch/ingest_pipeline/default.yml" is invalid: unmarshalling YAML file failed: yaml: line 4: did not find expected key
   2. file "/opt/buildkite-agent/builds/bk-agent-prod-gcp-1740695740402832303/elastic/integrations/packages/jamf_protect/data_stream/web_threat_events/elasticsearch/ingest_pipeline/default.yml" is invalid: unmarshalling YAML file failed: yaml: line 4: did not find expected key
   3. file "/opt/buildkite-agent/builds/bk-agent-prod-gcp-1740695740402832303/elastic/integrations/packages/jamf_protect/data_stream/web_traffic_events/elasticsearch/ingest_pipeline/default.yml" is invalid: unmarshalling YAML file failed: yaml: line 4: did not find expected key

kcreddy
kcreddy approved these changes Feb 28, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@kcreddy kcreddy left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM for my comments.
Can be merged after @efd6 comments are addressed.

@txhaflaire
Copy link
Copy Markdown
Contributor Author

txhaflaire commented Feb 28, 2025

@efd6 @kcreddy thanks for all the reviews - sorry that's its been messy.
I've pushed commits with the feedback implemented - can we rerun a test here? the errors should not exist anymore.

@kcreddy
Copy link
Copy Markdown
Contributor

kcreddy commented Feb 28, 2025

/test

@txhaflaire
Copy link
Copy Markdown
Contributor Author

txhaflaire commented Feb 28, 2025

@kcreddy It seems kite is failing due the fact we added the yaml file.

Error: checking package failed: linting package failed: found 1 validation error:
--
  | 1. item [test-common-config.yaml] is not allowed in folder [/opt/buildkite-agent/builds/bk-agent-prod-gcp-1740733516311924255/elastic/integrations/packages/jamf_protect/data_stream/telemetry/_dev/test/pipeline]

@kcreddy
Copy link
Copy Markdown
Contributor

kcreddy commented Feb 28, 2025

@kcreddy It seems kite is failing due the fact we added the yaml file.

@txhaflaire, the file extension should be yml instead of yaml.

@txhaflaire
Copy link
Copy Markdown
Contributor Author

txhaflaire commented Feb 28, 2025

@kcreddy good catch - pushed it.

@kcreddy
Copy link
Copy Markdown
Contributor

kcreddy commented Feb 28, 2025

/test

@txhaflaire
Copy link
Copy Markdown
Contributor Author

txhaflaire commented Mar 3, 2025

@kcreddy any tweaks from my side pending?

efd6
efd6 reviewed Mar 3, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also #12871 (comment) and related comments are unaddressed.

kcreddy
kcreddy approved these changes Mar 4, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kcreddy any tweaks from my side pending?

LGTM for my comments.

@txhaflaire txhaflaire requested a review from efd6 March 5, 2025 08:15
@efd6
Copy link
Copy Markdown
Contributor

efd6 commented Mar 5, 2025

/test

efd6
efd6 approved these changes Mar 5, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Mar 5, 2025

💚 Build Succeeded

History

@elastic-sonarqube
Copy link
Copy Markdown

elastic-sonarqube bot commented Mar 5, 2025

Quality Gate failed Quality Gate failed

Failed conditions
79.6% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

@txhaflaire
Copy link
Copy Markdown
Contributor Author

txhaflaire commented Mar 5, 2025

@efd6 @kcreddy Thanks again for the team work and help here - please merge once thumbs are up!

@kcreddy kcreddy merged commit 1277269 into elastic:main Mar 5, 2025
6 of 7 checks passed
@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod bot commented Mar 5, 2025

Package jamf_protect - 3.0.0 containing this change is available at https://epr.elastic.co/package/jamf_protect/3.0.0/

flexitrev pushed a commit that referenced this pull request Mar 20, 2025
@txhaflaire @flexitrev
Jamf Protect 3.0.0 (#12871)
0b27d2e 
- Adding new event `gatkeeper_user_override`
- Mapping existing fields from Jamf Protect to newly added ECS fields from [PR](elastic/ecs#2370)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kcreddy kcreddy kcreddy approved these changes

@efd6 efd6 efd6 approved these changes

Assignees

No one assigned

Labels

enhancement New feature or request Integration:jamf_protect Jamf Protect (Partner supported) Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@txhaflaire @kcreddy @elasticmachine @efd6