Skip to content

Commit 81b8efa

Browse files
v1vv1v
committed
Merge branch 'feature/use-google-secrets' into test/use-google-secrets
* feature/use-google-secrets: (43 commits) use -ci account [jamf_pro] Fix `flattened` field types for non-object values (#13985) [Netskope Alerts] Add text multi-field to netskope.alerts.breach.description field (#13977) zscaler_zia: add strict field template mode for tcp and http_endpoint input data streams (#13904) apm: Add config for tail-based sampling discard on write (#13950) [CI] Add dev/coverage into backport script (#13987) Update configuration updatecli for 8.x snapshot (#13981) [Prometheus] Add username, password, and SSL related fields for query dataset (#13969) o365: Ignore failures in rename processors for organization fields (#13983) aws.firewall: Document ingested log types of AWS Network Firewall (#13978) mimecast: resolve field data type conflicts between data streams (#13825) [Infoblox NIOS] Handle the parsing of IPv6 address (#13947) [Cribl] Fix handling of metric event type (#13930) zscaler_zpa: fix handling of multiple remote IPs, and event categorisation (#13755) Adding agentless deployment to the sublime security integration (#13963) [integration/system] add use_performance_counters in system integration (#13150) crowdstrike,m365_defender,microsoft_defender_{cloud,endpoint},sentinel_one: normalise severity handling (#13955) [forgerock] Map `forgerock.response.elapsedTime` as a long not a date (#13959) github: squelch errors from pagination ends (#13965) cisco_secure_endpoint: squelch errors from pagination ends (#13964) ...
2 parents 5ecfad8 + ca8359e commit 81b8efa

File tree

345 files changed

+12027
-6643
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

345 files changed

+12027
-6643
lines changed

‎.buildkite/pipeline.serverless.yml

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ env:
66
DOCKER_COMPOSE_VERSION: "v2.24.1"
77
DOCKER_VERSION: "false" # not required to set since system tests are not running yet
88
KIND_VERSION: 'v0.27.0'
9-
K8S_VERSION: 'v1.32.0'
9+
K8S_VERSION: 'v1.33.0'
1010
YQ_VERSION: 'v4.35.2'
1111
IMAGE_UBUNTU_X86_64: "family/core-ubuntu-2204"
1212
GH_CLI_VERSION: "2.29.0"
@@ -78,14 +78,11 @@ steps:
7878
lifetime: 10800 # seconds
7979
project-id: "elastic-observability-ci"
8080
project-number: "911195782929"
81-
- elastic/oblt-google-secrets#feature/add-initial-commit:
82-
project-id: "elastic-observability"
83-
secret: elastic-cloud-observability-team-qa-api-key
84-
env-var: "EC_API_KEY"
85-
- elastic/oblt-google-secrets#feature/add-initial-commit:
86-
project-id: "elastic-observability"
87-
secret: elastic-cloud-observability-team-qa-endpoint
88-
env-var: "EC_HOST"
81+
lifetime: 10800 # seconds
82+
- avaly/gcp-secret-manager#v1.2.0:
83+
env:
84+
EC_API_KEY: elastic-cloud-observability-team-qa-api-key
85+
EC_HOST: elastic-cloud-observability-team-qa-endpoint
8986
artifact_paths:
9087
- "build/test-results/*.xml"
9188
- "build/elastic-stack-dump/*/logs/*.log"

‎.buildkite/pipeline.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ env:
44
DOCKER_COMPOSE_VERSION: "v2.24.1"
55
DOCKER_VERSION: "26.1.2"
66
KIND_VERSION: 'v0.27.0'
7-
K8S_VERSION: 'v1.32.0'
7+
K8S_VERSION: 'v1.33.0'
88
YQ_VERSION: 'v4.35.2'
99
JQ_VERSION: '1.7'
1010
GH_CLI_VERSION: "2.29.0"

‎.buildkite/scripts/backport_branch.sh

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,10 +133,15 @@ updateBackportBranchContents() {
133133
# Update scripts used by mage
134134
local MAGEFILE_SCRIPTS_FOLDER="dev/citools"
135135
local TESTSREPORTER_SCRIPTS_FOLDER="dev/testsreporter"
136+
local COVERAGE_SCRIPTS_FOLDER="dev/coverage"
136137
if git ls-tree -d --name-only main:${MAGEFILE_SCRIPTS_FOLDER} > /dev/null 2>&1 ; then
137138
echo "Copying $MAGEFILE_SCRIPTS_FOLDER from $SOURCE_BRANCH..."
138139
git checkout "$SOURCE_BRANCH" -- "${MAGEFILE_SCRIPTS_FOLDER}"
140+
echo "Copying $TESTSREPORTER_SCRIPTS_FOLDER from $SOURCE_BRANCH..."
139141
git checkout "$SOURCE_BRANCH" -- "${TESTSREPORTER_SCRIPTS_FOLDER}"
142+
echo "Copying $COVERAGE_SCRIPTS_FOLDER from $SOURCE_BRANCH..."
143+
git checkout "$SOURCE_BRANCH" -- "${COVERAGE_SCRIPTS_FOLDER}"
144+
echo "Copying magefile.go from $SOURCE_BRANCH..."
140145
git checkout "$SOURCE_BRANCH" -- "magefile.go"
141146
# Run go mod tidy to update just the dependencies related to magefile and dev scripts
142147
go mod tidy
@@ -173,7 +178,8 @@ updateBackportBranchContents() {
173178

174179
if [ "$DRY_RUN" == "true" ];then
175180
echo "DRY_RUN mode, nothing will be pushed."
176-
git --no-pager diff $SOURCE_BRANCH...$BACKPORT_BRANCH_NAME
181+
# Show just the relevant files diff (go.mod, go.sum, .buildkite, dev and package to be backported)
182+
git --no-pager diff $SOURCE_BRANCH...$BACKPORT_BRANCH_NAME go.mod go.sum .buildkite/ dev/ "packages/${PACKAGE_NAME}"
177183
else
178184
echo "Pushing..."
179185
git push origin $BACKPORT_BRANCH_NAME

‎.github/workflows/bump-elastic-stack-version.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
- uses: actions/checkout@v4
2626

2727
- name: Install Updatecli in the runner
28-
uses: updatecli/updatecli-action@cf942226b953240efac9ff60bf42df2b908c2fa0 #v2.83.0
28+
uses: updatecli/updatecli-action@307ce72e224b82157cc31c78828f168b8e55d47d #v2.84.0
2929

3030
- name: Select diff action
3131
if: ${{ github.event_name == 'pull_request' }}

‎.github/workflows/updatecli/updatecli.d/bump-latest-8x-snapshot-version.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,13 @@ sources:
2929
name: Get latest snapshot
3030
kind: json
3131
spec:
32-
file: https://storage.googleapis.com/artifacts-api/snapshots/8.x.json
32+
file: https://storage.googleapis.com/artifacts-api/snapshots/8.19.json
3333
key: .version
3434
latestSnapshotMajorMinor:
3535
name: Get latest snapshort major and minor
3636
kind: json
3737
spec:
38-
file: https://storage.googleapis.com/artifacts-api/snapshots/8.x.json
38+
file: https://storage.googleapis.com/artifacts-api/snapshots/8.19.json
3939
key: .version
4040
transformers:
4141
- findsubmatch:

‎.mergify.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,15 @@ queue_rules:
44
conditions:
55
- check-success=integrations/pr-merge
66

7+
defaults:
8+
actions:
9+
backport:
10+
title: "[{{ destination_branch }}] (backport #{{ number }}) {{ title }}"
11+
assignees:
12+
- "{{ author }}"
13+
labels:
14+
- "backport"
15+
716
pull_request_rules:
817
- name: automatic merge of bot 🤖
918
conditions:
@@ -14,3 +23,15 @@ pull_request_rules:
1423
actions:
1524
queue:
1625
name: default
26+
27+
- name: notify the backport has not been merged yet
28+
conditions:
29+
- -merged
30+
- -closed
31+
- author=mergify[bot]
32+
- "#check-success>0"
33+
- schedule=Mon-Mon 06:00-10:00[Europe/Paris]
34+
actions:
35+
comment:
36+
message: |
37+
This pull request has not been merged yet. Could you please review and merge it @{{ assignee | join(', @') }}? 🙏

‎docs/docset.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
project: 'Integration developer guide'
2+
products:
3+
- id: integrations
24
exclude:
35
- ci_pipelines.md
46
- dashboard_guidelines.md

‎packages/abnormal_security/_dev/build/docs/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst
4848

4949
**Note**: By default, the URL is set to `https://api.abnormalplatform.com`. We have observed that Abnormal Security Base URL changes based on location so find your own base URL.
5050

51+
### Enabling enrichment for Threat events
52+
53+
Introduced in version 1.8.0, the Abnormal Security integration includes a new option called `Enable Attachments and Links enrichment` for the Threat data stream. When enabled, this feature enriches incoming threat events with additional details about any attachments and links included in the original message.
54+
5155
## Logs reference
5256

5357
### AI Security Mailbox

‎packages/abnormal_security/_dev/deploy/docker/files/config.yml

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,7 @@ rules:
403403
"messages": [
404404
{
405405
"abxMessageId": -1875077659085366331,
406+
"abxMessageIdStr": "-1875077659085366331",
406407
"abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/12345",
407408
"attachmentCount": 0,
408409
"attachmentNames": [],
@@ -448,6 +449,44 @@ rules:
448449
]
449450
}
450451
`}}
452+
- path: /v1/threats/184712ab-6d8b-47b3-89d3-a314efef79e2/attachments
453+
methods: ['GET']
454+
request_headers:
455+
Authorization:
456+
- "Bearer xxxx"
457+
responses:
458+
- status_code: 200
459+
headers:
460+
Content-Type:
461+
- 'application/json'
462+
body: |-
463+
{{ minify_json `
464+
{
465+
"attachments": [
466+
{
467+
"abxMessageIdStr": "-1875077659085366331",
468+
"abxMessageId": -1875077659085366331,
469+
"attachmentName": "attachment1.txt"
470+
}
471+
]
472+
}
473+
`}}
474+
- path: /v1/threats/184712ab-6d8b-47b3-89d3-a314efef79e2/links
475+
methods: ['GET']
476+
request_headers:
477+
Authorization:
478+
- "Bearer xxxx"
479+
responses:
480+
- status_code: 200
481+
headers:
482+
Content-Type:
483+
- 'application/json'
484+
body: |-
485+
{{ minify_json `
486+
{
487+
"links": []
488+
}
489+
`}}
451490
- path: /v1/threats/284712ab-6d8b-47b3-89d3-a314efef79e2
452491
methods: ['GET']
453492
query_params:
@@ -468,6 +507,7 @@ rules:
468507
"messages": [
469508
{
470509
"abxMessageId": 2260288475997441028,
510+
"abxMessageIdStr": "2260288475997441028",
471511
"abxPortalUrl": "https://portal.abnormalsecurity.com/home/threat-center/remediation-history/3456765434567654",
472512
"attachmentCount": 0,
473513
"attachmentNames": [],
@@ -512,6 +552,68 @@ rules:
512552
]
513553
}
514554
`}}
555+
- path: /v1/threats/284712ab-6d8b-47b3-89d3-a314efef79e2/attachments
556+
methods: ['GET']
557+
request_headers:
558+
Authorization:
559+
- "Bearer xxxx"
560+
responses:
561+
- status_code: 200
562+
headers:
563+
Content-Type:
564+
- 'application/json'
565+
body: |-
566+
{{ minify_json `
567+
{
568+
"attachments": [
569+
{
570+
"abxMessageIdStr": "2260288475997441028",
571+
"abxMessageId": 2260288475997441028,
572+
"attachmentName": "attachment1.txt"
573+
},
574+
{
575+
"abxMessageIdStr": "2260288475997441028",
576+
"abxMessageId": 2260288475997441028,
577+
"attachmentName": "attachment2.txt"
578+
}
579+
]
580+
}
581+
`}}
582+
- path: /v1/threats/284712ab-6d8b-47b3-89d3-a314efef79e2/links
583+
methods: ['GET']
584+
request_headers:
585+
Authorization:
586+
- "Bearer xxxx"
587+
responses:
588+
- status_code: 200
589+
headers:
590+
Content-Type:
591+
- 'application/json'
592+
body: |-
593+
{{ minify_json `
594+
{
595+
"links": [
596+
{
597+
"abxMessageIdStr": "2260288475997441028",
598+
"abxMessageId": 2260288475997441028,
599+
"domainLink": "lamronba.com",
600+
"linkType": "html href",
601+
"source": "body",
602+
"displayText": "This is not a spoof!",
603+
"linkUrl": "http://spoof.lamronba.com"
604+
},
605+
{
606+
"abxMessageIdStr": "2260288475997441028",
607+
"abxMessageId": 2260288475997441028,
608+
"domainLink": "lamronba2.com",
609+
"linkType": "html href",
610+
"source": "body",
611+
"displayText": "This is not a spoof!",
612+
"linkUrl": "http://spoof.lamronba2.com"
613+
}
614+
]
615+
}
616+
`}}
515617
- path: /v1/vendor-cases
516618
methods: ['GET']
517619
query_params:

‎packages/abnormal_security/changelog.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
# newer versions go on top
2+
- version: "1.8.0"
3+
changes:
4+
- description: Enrich threat events with attachment and link details.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13933
7+
- description: Use abxMessageIdStr instead of the deprecated abxMessageId as message identifier.
8+
type: bugfix
9+
link: https://github.com/elastic/integrations/pull/13933
210
- version: "1.7.0"
311
changes:
412
- description: Remove redundant installation instructions.

‎packages/abnormal_security/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,6 @@
6464
"preserve_duplicate_custom_fields"
6565
],
6666
"url": {
67-
"extension": "0/search_v2/666/purge_messages/",
6867
"original": "/v1.0/search_v2/666/purge_messages/",
6968
"path": "/v1.0/search_v2/666/purge_messages/"
7069
},
@@ -139,7 +138,6 @@
139138
"preserve_duplicate_custom_fields"
140139
],
141140
"url": {
142-
"extension": "0/messages/-3597017621819474673/email_content/",
143141
"original": "/v2.0/messages/-3597017621819474673/email_content/",
144142
"path": "/v2.0/messages/-3597017621819474673/email_content/"
145143
},
@@ -207,7 +205,6 @@
207205
"preserve_duplicate_custom_fields"
208206
],
209207
"url": {
210-
"extension": "0/search_v2/",
211208
"original": "/v1.0/search_v2/",
212209
"path": "/v1.0/search_v2/"
213210
},
@@ -345,7 +342,6 @@
345342
"preserve_duplicate_custom_fields"
346343
],
347344
"url": {
348-
"extension": "0/cases",
349345
"original": "/v2.0/cases",
350346
"path": "/v2.0/cases"
351347
},

0 commit comments

Comments
 (0)