[Entity Analytics] Adding changes for event.ingested in riskScore and assetCriticality #203975
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
abhishekbhatia1710
added
backport:skip
|
Pinging @elastic/security-entity-analytics (Team:Entity Analytics) |
abhishekbhatia1710
changed the title
hop-dev
reviewed
Dec 19, 2024
x-pack/plugins/security_solution/server/lib/entity_analytics/utils/create_ingest_pipeline.ts
Outdated
Show resolved
Hide resolved
hop-dev
requested changes
Dec 19, 2024
|
@elasticmachine merge upstream |
|
merge conflict between base and head |
…ested-RiskScoreAndAssetCriticality
…' of https://github.com/abhishekbhatia1710/kibana into ea-11288-add-eventIngested-RiskScoreAndAssetCriticality
…' of https://github.com/abhishekbhatia1710/kibana into ea-11288-add-eventIngested-RiskScoreAndAssetCriticality
…' of https://github.com/abhishekbhatia1710/kibana into ea-11288-add-eventIngested-RiskScoreAndAssetCriticality
hop-dev
requested changes
Jan 7, 2025
...curity/plugins/security_solution/server/lib/entity_analytics/utils/create_ingest_pipeline.ts
Outdated
Show resolved
Hide resolved
...y/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_data_client.ts
Outdated
Show resolved
Hide resolved
|
|
||
| taskManager.registerTaskDefinitions({ | ||
| [TASK_TYPE]: { | ||
| title: `Copy @timestamp value to events.ingested`, |
There was a problem hiding this comment.
Suggested change
| title: `Copy @timestamp value to events.ingested`, | |
| title: `Copy Asset Criticality @timestamp value to events.ingested`, |
...y/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_data_client.ts
Outdated
Show resolved
Hide resolved
- removing the error.message block - Renaming methods - Removing scroll
💔 Build Failed
Failed CI StepsTest Failures
Metrics [docs]
History
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This pull request introduces changes to the asset criticality and risk score data clients to utilize a new ingest pipeline for adding event timestamps. The changes include the addition of utility functions for creating and retrieving the ingest pipeline, updates to the field mappings, and modifications to the data clients to integrate the new pipeline.
Ingest Pipeline Integration:
x-pack/plugins/security_solution/server/lib/entity_analytics/utils/create_ingest_pipeline.ts: Added new utility functionsgetIngestPipelineNameandcreateIngestTimestampPipelineto manage the ingest pipeline for adding event timestamps.Asset Criticality Data Client:
x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/asset_criticality_data_client.ts: Imported the new utility functions and updated theinitmethod to create the ingest timestamp pipeline. Additionally, modified the index settings to use the new ingest pipeline.Risk Score Data Client:
x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_data_client.ts: Imported the new utility functions, updated theinitmethod to create the ingest timestamp pipeline, and modified the index settings to use the new ingest pipeline.Field Mapping Updates:
x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/constants.ts: Added the field mappingevent.ingestedfor asset criticality.x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/configurations.ts: Added the field mappingevent.ingestedfor risk score.Checklist
Check the PR satisfies following conditions.
Reviewers should verify this PR satisfies this list as well.
release_note:*label is applied per the guidelines