From c55c73c78baee668d75d78762d02cd3d37cc24a2 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Mon, 21 Jun 2021 15:27:08 -0400 Subject: [PATCH] Mark MISP module deprecated (#26174) Add deprecation notice to docs for the MISP module. The threat intel module should be used instead. Closes #25240 --- CHANGELOG.next.asciidoc | 1 + filebeat/docs/modules/misp.asciidoc | 2 ++ x-pack/filebeat/filebeat.reference.yml | 2 ++ x-pack/filebeat/module/misp/_meta/config.yml | 2 ++ x-pack/filebeat/module/misp/_meta/docs.asciidoc | 2 ++ x-pack/filebeat/modules.d/misp.yml.disabled | 2 ++ 6 files changed, 11 insertions(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 70f6f7f6393..9ba9149e252 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -1012,6 +1012,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Filebeat* +- Deprecate the MISP module. The Threat Intel module should be used instead. {issue}25240[25240] *Heartbeat* diff --git a/filebeat/docs/modules/misp.asciidoc b/filebeat/docs/modules/misp.asciidoc index 4eebc6150c4..b38ec8c0a66 100644 --- a/filebeat/docs/modules/misp.asciidoc +++ b/filebeat/docs/modules/misp.asciidoc @@ -10,6 +10,8 @@ This file is generated! See scripts/docs_collector.py == MISP module +deprecated::[7.14.0,"This module is deprecated. Use the <> instead."] + beta[] This is a filebeat module for reading threat intel information from the MISP platform (https://www.circl.lu/doc/misp/). It uses the httpjson input to access the MISP REST API interface. diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index 755fd914777..eb54d2f62b9 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -1537,6 +1537,8 @@ filebeat.modules: # var.tz_offset: local #--------------------------------- MISP Module --------------------------------- +# Deprecated in 7.14.0: Recommended to migrate to the Threat Intel module. + - module: misp threat: enabled: true diff --git a/x-pack/filebeat/module/misp/_meta/config.yml b/x-pack/filebeat/module/misp/_meta/config.yml index 67c7dc566d8..0eab72db205 100644 --- a/x-pack/filebeat/module/misp/_meta/config.yml +++ b/x-pack/filebeat/module/misp/_meta/config.yml @@ -1,3 +1,5 @@ +# Deprecated in 7.14.0: Recommended to migrate to the Threat Intel module. + - module: misp threat: enabled: true diff --git a/x-pack/filebeat/module/misp/_meta/docs.asciidoc b/x-pack/filebeat/module/misp/_meta/docs.asciidoc index ea0e671c06b..7025f65d7d9 100644 --- a/x-pack/filebeat/module/misp/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/misp/_meta/docs.asciidoc @@ -5,6 +5,8 @@ == MISP module +deprecated::[7.14.0,"This module is deprecated. Use the <> instead."] + beta[] This is a filebeat module for reading threat intel information from the MISP platform (https://www.circl.lu/doc/misp/). It uses the httpjson input to access the MISP REST API interface. diff --git a/x-pack/filebeat/modules.d/misp.yml.disabled b/x-pack/filebeat/modules.d/misp.yml.disabled index 25cbaf6b1b8..610cc874073 100644 --- a/x-pack/filebeat/modules.d/misp.yml.disabled +++ b/x-pack/filebeat/modules.d/misp.yml.disabled @@ -1,6 +1,8 @@ # Module: misp # Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-misp.html +# Deprecated in 7.14.0: Recommended to migrate to the Threat Intel module. + - module: misp threat: enabled: true