Add `backend` configuration key to fim integration by Tacklebox · Pull Request #8807 · elastic/integrations

Tacklebox · 2023-12-28T14:33:17Z

Proposed commit message

This adds the configuration key force_backend to select an event source for the fim integration on Linux. In order to support including user information on file integrity events across a wider range of linux kernel versions, two new event sources for auditbeat are being developed: ebpf, and kprobes. In order for a user to be able to select which one they would like to enable a configuration key is being added.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Related issues

File Integrity Monitoring | User Information - Linux #7401

pkoutsovasilis · 2024-01-16T22:03:56Z

ty @Tacklebox this LGTM, before I press the Approve @mmat11 any thoughts?

efd6

Add manifest version bump and changelog entries?

efd6 · 2024-01-16T22:28:33Z

packages/fim/data_stream/event/agent/stream/file_integrity.yml.hbs

 {{/each}}
 recursive: {{recursive}}
 scan_at_start: {{scan_at_start}}
+force_backend: {{force_backend}}


Does this have a configuration target yet? I don't see one in auditbeat.

Hello @efd6, the multiple backends for FIM is now part of auditbeat and here is the configuration target?!

packages/fim/manifest.yml

mmat11 · 2024-01-16T23:38:56Z

ty @Tacklebox this LGTM, before I press the Approve @mmat11 any thoughts?

LGTM, this should be merged after both the new backends are in auditbeat, right?

pkoutsovasilis · 2024-01-17T00:00:02Z

ty for the review @efd6 and the to the point comments. As @mmat11 mentioned above, this config change captured in the PR is about two new BackEnds for the file_integrity module of auditbeat, and I tend to agree here first merge the respective changes in the beats repo and then merge this one, any thoughts on that @efd6 ?

Use a select type instead of text Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

bhapas · 2024-01-17T10:34:27Z

ty for the review @efd6 and the to the point comments. As @mmat11 mentioned above, this config change captured in the PR is about two new BackEnds for the file_integrity module of auditbeat, and I tend to agree here first merge the respective changes in the beats repo and then merge this one, any thoughts on that @efd6 ?

@pkoutsovasilis The beats changes have to go in first and until beats latest is not released this change will not work.

Also, Can you reference the beats issue/PR in this PR.

botelastic · 2024-03-14T13:42:01Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

jamiehynds · 2024-03-14T14:02:54Z

ty for the review @efd6 and the to the point comments. As @mmat11 mentioned above, this config change captured in the PR is about two new BackEnds for the file_integrity module of auditbeat, and I tend to agree here first merge the respective changes in the beats repo and then merge this one, any thoughts on that @efd6 ?

@pkoutsovasilis The beats changes have to go in first and until beats latest is not released this change will not work.

Also, Can you reference the beats issue/PR in this PR.

@bhapas Beats PR here: elastic/beats#38199

botelastic · 2024-04-13T14:21:31Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

…fim_uid_support # Conflicts: # packages/fim/changelog.yml # packages/fim/manifest.yml

elastic-sonarqube · 2024-04-15T08:00:46Z

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

elasticmachine · 2024-04-15T08:00:47Z

💚 Build Succeeded

Buildkite Build
Commit: 820f755

History

💔 Build #10417 failed 23d2a11
💚 Build #8139 succeeded 0468d34
💚 Build #8111 succeeded d9d081f

cc @Tacklebox

elasticmachine · 2024-04-15T15:20:28Z

Package fim - 1.15.0 containing this change is available at https://epr.elastic.co/search?package=fim

Tacklebox added the enhancement New feature or request label Dec 28, 2023

Tacklebox requested review from mmat11 and pkoutsovasilis December 28, 2023 14:33

Added force_backend configuration key to fim integration

d9d081f

Tacklebox force-pushed the mborden/fim_uid_support branch from 90f2dae to d9d081f Compare January 16, 2024 15:55

Tacklebox marked this pull request as ready for review January 16, 2024 17:00

Tacklebox requested a review from a team as a code owner January 16, 2024 17:00

efd6 reviewed Jan 16, 2024

View reviewed changes

Tacklebox and others added 2 commits January 17, 2024 10:32

Update packages/fim/manifest.yml

f2141b3

Use a select type instead of text Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

Updated changelog and manifest

0468d34

Tacklebox self-assigned this Feb 13, 2024

botelastic bot added the Stalled label Mar 14, 2024

botelastic bot removed the Stalled label Mar 14, 2024

pkoutsovasilis mentioned this pull request Apr 8, 2024

File Integrity Monitoring | User Information - Linux | KProbe Backend #8692

Closed

botelastic bot added the Stalled label Apr 13, 2024

pkoutsovasilis changed the title ~~Add force_backend configuration key to fim integration~~ Add backend configuration key to fim integration Apr 15, 2024

botelastic bot removed the Stalled label Apr 15, 2024

feat(fim): update to latest multi-BE fim spec

23d2a11

Tacklebox requested a review from a team as a code owner April 15, 2024 07:44

Merge remote-tracking branch 'refs/remotes/origin/main' into mborden/…

820f755

…fim_uid_support # Conflicts: # packages/fim/changelog.yml # packages/fim/manifest.yml

nfritts approved these changes Apr 15, 2024

View reviewed changes

Tacklebox merged commit 002351e into main Apr 15, 2024

andrewkroh added the Integration:fim File Integrity Monitoring label Jul 22, 2024

Conversation

Tacklebox commented Dec 28, 2023

Proposed commit message

Checklist

Related issues

Uh oh!

pkoutsovasilis commented Jan 16, 2024

Uh oh!

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

efd6 Jan 16, 2024

Choose a reason for hiding this comment

Uh oh!

pkoutsovasilis Apr 15, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mmat11 commented Jan 16, 2024

Uh oh!

pkoutsovasilis commented Jan 17, 2024

Uh oh!

bhapas commented Jan 17, 2024

Uh oh!

botelastic bot commented Mar 14, 2024

Uh oh!

jamiehynds commented Mar 14, 2024

Uh oh!

botelastic bot commented Apr 13, 2024

Uh oh!

elastic-sonarqube bot commented Apr 15, 2024

Quality Gate passed

Uh oh!

elasticmachine commented Apr 15, 2024

💚 Build Succeeded

History

Uh oh!

elasticmachine commented Apr 15, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants