crowdstrike,m365_defender,microsoft_defender_{cloud,endpoint},sentinel_one: normalise severity handling#13955
Conversation
6ddfee4 to
8b5d0ba
Compare
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
falcon |
7092.2 | 5780.35 | -1311.85 (-18.5%) | 💔 |
Package microsoft_defender_endpoint 👍(1) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
machine_action |
9174.31 | 5494.51 | -3679.8 (-40.11%) | 💔 |
Package sentinel_one 👍(2) 💚(2) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
agent |
2985.07 | 1972.39 | -1012.68 (-33.92%) | 💔 |
To see the full report comment with /test benchmark fullreport
8b5d0ba to
a4b8d62
Compare
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
chrisberkhout
left a comment
There was a problem hiding this comment.
What's the reason for not making info/informational lower than low severity?
I'm guessing that rules want to consider info level as more significant than severity: 0.
|
One more thing: several of the sample event files don't have significant changes and could be left out. Just updating everything seem okay though. |
The issue requirements:
I considered that, but I wanted to present a consistent documentation (there has been a lapse in sample event updates for the past few changes). |
…l_one: normalise severity handling This change normalises the interpretation of severity names for the Crowdstrike, Microsoft and Sentinel One EDR integrations modulo consistent semantics of the terms used by those vendors. Severity terms are also recovered from the vendor's severity scale if the term is missing and a scale to term mapping is known.
a4b8d62 to
e2b4487
Compare
💚 Build Succeeded
History
cc @efd6 |
|
|
Package crowdstrike - 1.70.0 containing this change is available at https://epr.elastic.co/package/crowdstrike/1.70.0/ |
|
Package m365_defender - 3.5.0 containing this change is available at https://epr.elastic.co/package/m365_defender/3.5.0/ |
|
Package microsoft_defender_cloud - 2.6.0 containing this change is available at https://epr.elastic.co/package/microsoft_defender_cloud/2.6.0/ |
|
Package microsoft_defender_endpoint - 2.35.0 containing this change is available at https://epr.elastic.co/package/microsoft_defender_endpoint/2.35.0/ |
|
Package sentinel_one - 1.35.0 containing this change is available at https://epr.elastic.co/package/sentinel_one/1.35.0/ |
|
FYI @raqueltabuyo |
* main: (42 commits) [jamf_pro] Fix `flattened` field types for non-object values (elastic#13985) [Netskope Alerts] Add text multi-field to netskope.alerts.breach.description field (elastic#13977) zscaler_zia: add strict field template mode for tcp and http_endpoint input data streams (elastic#13904) apm: Add config for tail-based sampling discard on write (elastic#13950) [CI] Add dev/coverage into backport script (elastic#13987) Update configuration updatecli for 8.x snapshot (elastic#13981) [Prometheus] Add username, password, and SSL related fields for query dataset (elastic#13969) o365: Ignore failures in rename processors for organization fields (elastic#13983) aws.firewall: Document ingested log types of AWS Network Firewall (elastic#13978) mimecast: resolve field data type conflicts between data streams (elastic#13825) [Infoblox NIOS] Handle the parsing of IPv6 address (elastic#13947) [Cribl] Fix handling of metric event type (elastic#13930) zscaler_zpa: fix handling of multiple remote IPs, and event categorisation (elastic#13755) Adding agentless deployment to the sublime security integration (elastic#13963) [integration/system] add use_performance_counters in system integration (elastic#13150) crowdstrike,m365_defender,microsoft_defender_{cloud,endpoint},sentinel_one: normalise severity handling (elastic#13955) [forgerock] Map `forgerock.response.elapsedTime` as a long not a date (elastic#13959) github: squelch errors from pagination ends (elastic#13965) cisco_secure_endpoint: squelch errors from pagination ends (elastic#13964) [Cloud Security] Cloud Asset Inventory: fixed cloud formation URL (elastic#13971) ...
* feature/use-google-secrets: (43 commits) use -ci account [jamf_pro] Fix `flattened` field types for non-object values (#13985) [Netskope Alerts] Add text multi-field to netskope.alerts.breach.description field (#13977) zscaler_zia: add strict field template mode for tcp and http_endpoint input data streams (#13904) apm: Add config for tail-based sampling discard on write (#13950) [CI] Add dev/coverage into backport script (#13987) Update configuration updatecli for 8.x snapshot (#13981) [Prometheus] Add username, password, and SSL related fields for query dataset (#13969) o365: Ignore failures in rename processors for organization fields (#13983) aws.firewall: Document ingested log types of AWS Network Firewall (#13978) mimecast: resolve field data type conflicts between data streams (#13825) [Infoblox NIOS] Handle the parsing of IPv6 address (#13947) [Cribl] Fix handling of metric event type (#13930) zscaler_zpa: fix handling of multiple remote IPs, and event categorisation (#13755) Adding agentless deployment to the sublime security integration (#13963) [integration/system] add use_performance_counters in system integration (#13150) crowdstrike,m365_defender,microsoft_defender_{cloud,endpoint},sentinel_one: normalise severity handling (#13955) [forgerock] Map `forgerock.response.elapsedTime` as a long not a date (#13959) github: squelch errors from pagination ends (#13965) cisco_secure_endpoint: squelch errors from pagination ends (#13964) ...
…l_one: normalise severity handling (elastic#13955) This change normalises the interpretation of severity names for the Crowdstrike, Microsoft and Sentinel One EDR integrations modulo consistent semantics of the terms used by those vendors. Severity terms are also recovered from the vendor's severity scale if the term is missing and a scale to term mapping is known.
Proposed commit message
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots