Skip to content

ti_google_threat_intelligence: Set destination pipeline name automatically in transforms#16175

Merged
kcreddy merged 2 commits intoelastic:mainfrom
kcreddy:gti-dest-pipeline
Dec 2, 2025
Merged

ti_google_threat_intelligence: Set destination pipeline name automatically in transforms#16175
kcreddy merged 2 commits intoelastic:mainfrom
kcreddy:gti-dest-pipeline

Conversation

@kcreddy
Copy link
Contributor

@kcreddy kcreddy commented Dec 1, 2025

Proposed commit message

ti_google_threat_intelligence: Set destination pipeline name automatically in transforms

Due to an earlier limitation of elastic-package to unable to extract
integration version into the transform, the destination pipeline 
needed to be set/updated manually.

Currently the integration requires users to manually add destination 
pipelines into the transform during the package installation and 
upgrade. This presents significant inconvenience to users and is 
often error-prone.

elastic-package#2973 [1] removes the dest pipeline limitation 
which now allows the pipeline names to be templated. This PR
updates the transform definition to set the pipeline names using 
a template which renders integration version.
Change involves updating all transforms with:
dest:
  pipeline: '{{ ingestPipelineName "<pipeline-name>"}}'

Also:
- With this the transform's does not require any manual 
intervention, hence they are now auto-enabled.
- README is updated accordingly.

[1] https://github.com/elastic/elastic-package/pull/2973

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Integration successfully installed.
  • System tests pass.
  • Transforms definition in Kibana show the correct destination pipeline (see screenshots).

System tests (sample data stream)

--- Test results for package: ti_google_threat_intelligence - START ---
╭───────────────────────────────┬─────────────┬───────────┬───────────┬────────┬──────────────╮
│ PACKAGE                       │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │
├───────────────────────────────┼─────────────┼───────────┼───────────┼────────┼──────────────┤
│ ti_google_threat_intelligence │ cryptominer │ system    │ default   │ PASS   │  45.2311125s │
╰───────────────────────────────┴─────────────┴───────────┴───────────┴────────┴──────────────╯
--- Test results for package: ti_google_threat_intelligence - END   ---
Done

Related issues

Screenshots

Before

Screenshot 2025-12-01 at 5 53 14 PM

After

Screenshot 2025-12-01 at 5 57 38 PM Screenshot 2025-12-01 at 5 57 32 PM

@kcreddy kcreddy marked this pull request as ready for review December 1, 2025 13:21
@kcreddy kcreddy requested a review from a team as a code owner December 1, 2025 13:21
@kcreddy kcreddy self-assigned this Dec 1, 2025
@kcreddy kcreddy added Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:ti_google_threat_intelligence Google Threat Intelligence (Partner supported) labels Dec 1, 2025
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@kcreddy kcreddy added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request labels Dec 1, 2025
@elastic-vault-github-plugin-prod

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

💚 Build Succeeded

cc @kcreddy

Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would this templating show up in policy tests? If so, I think it would be helpful to include those.

@kcreddy
Copy link
Contributor Author

kcreddy commented Dec 2, 2025

Would this templating show up in policy tests? If so, I think it would be helpful to include those.

@efd6, this is not possible because transforms are not part of the agent policy which the policy tests target.

@kcreddy kcreddy requested a review from efd6 December 2, 2025 03:02
@kcreddy kcreddy merged commit 6bcdcde into elastic:main Dec 2, 2025
8 checks passed
@elastic-vault-github-plugin-prod

Package ti_google_threat_intelligence - 0.7.0 containing this change is available at https://epr.elastic.co/package/ti_google_threat_intelligence/0.7.0/

@kcreddy kcreddy deleted the gti-dest-pipeline branch December 2, 2025 04:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:ti_google_threat_intelligence Google Threat Intelligence (Partner supported) Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Google Threat Intelligence]: Mapping conflicts with latest Transform indices

3 participants