windows: make pipeline routing robust to channel letter case#8242
windows: make pipeline routing robust to channel letter case#8242efd6 merged 1 commit intoelastic:mainfrom
Conversation
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
🌐 Coverage report
|
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
|
Pinging @elastic/elastic-agent (Team:Elastic-Agent) |
Apparently some events from Windows servers and workstations in Security channel have a lowercase channel name. This has not been observed in other channels, but defensively apply the same care there.
andrewkroh
left a comment
There was a problem hiding this comment.
This looks good to me.
But this has me thinking that we should be routing based exclusively on the provider name instead of the channel. The channel names may be customized in the case of forwarded events. Sometimes users will setup their WEC with custom channels so you might have something named "WEC-Security" that holds the data produced by Microsoft-Windows-Security-Auditing. WDYT?
|
That seem reasonable. Here or later? |
|
Later. That will give me time to write up an issue tomorrow and think through some use cases relating to WEC. The goal is to make sure that WEC users can get the same behavior as if they had directly collected the logs from a host using Agent. So checking that we consistently apply |
|
Package windows - 1.40.0 containing this change is available at https://epr.elastic.co/search?package=windows |
Proposed commit message
Apparently some events from Windows servers and workstations in Security channel have a lowercase channel name. This has not been observed in other channels, but defensively apply the same care there.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots