Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cherry-pick #18591 to 7.8: o365: Support IPv4 enclosed in square brackets #18602

Merged
merged 2 commits into from
May 18, 2020
Merged

Cherry-pick #18591 to 7.8: o365: Support IPv4 enclosed in square brackets #18602

merged 2 commits into from
May 18, 2020

Conversation

adriansr
Copy link
Contributor

Cherry-pick of PR #18591 to 7.8 branch. Original message:

The O365 Management API is generating some events that contain a ClientIP / ClientIPAddress field consisting of an IPv4 address enclosed in square brackets. This is breaking ingestion of those events as the brackets are only stripped for IPv6 addresses.

"ClientIP": "[10.11.12.13]:12345"

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Fixes #18587

@adriansr
o365: Support IPv4 enclosed in square brackets (elastic#18591)
4611a4e 
The O365 Management API is generating some events that contain a
`ClientIP` / `ClientIPAddress` field consisting of an IPv4 address
enclosed in square brackets. This is breaking ingestion of those events
as the brackets are only stripped for IPv6 addresses.

> "ClientIP": "[10.11.12.13]:12345"

This patch adds support for IPv4 enclosed in brackets and a few other
edge cases.

Fixes elastic#18587

(cherry picked from commit eaf196d)
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 16, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label May 16, 2020
@elasticmachine
Copy link
Collaborator

elasticmachine commented May 16, 2020 •
edited
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

Test stats 🧪

Test Results
Failed 0
Passed 1680
Skipped 255
Total 1935

@adriansr adriansr merged commit 987bbdb into elastic:7.8 May 18, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kaiyan-sheng kaiyan-sheng kaiyan-sheng approved these changes

Assignees
No one assigned
Labels
backport review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@adriansr @elasticmachine @kaiyan-sheng