Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cherry-pick #20220 to 7.x: [Filebeat] Updates to Suricata module #20484

Merged
merged 2 commits into from
Aug 11, 2020
Merged

Cherry-pick #20220 to 7.x: [Filebeat] Updates to Suricata module #20484

merged 2 commits into from
Aug 11, 2020

Conversation

andrewkroh
Copy link
Member

@andrewkroh andrewkroh commented Aug 6, 2020 •
edited by zube bot
Loading

Cherry-pick of PR #20220 to 7.x branch. Original message:

What does this PR do?

This makes a few miscellaneous changes to the Suricata module to cleanup dashboards and fix a few minor issues in the pipeline.

  • Fix convert processor fail_on_error parameter naming.
  • Add event.ingested to ingest node pipeline.
  • Remove ECS suffixing from dashboard/viz titles.
  • Prioritize using ECS fields in dashboards.
  • Add Suricata logo to dashboards.

Checklist

  • My code follows the style guidelines of this project
  • I have made corresponding changes to the documentation
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

Screenshots

filebeat-suricata-alerts
filebeat-suricata-events

@andrewkroh
[Filebeat] Updates to Suricata module (elastic#20220)
ff592c5 
* Updates to Suricata module

- Fix convert processor fail_on_error parameter naming.
- Add event.ingested to ingest node pipeline.
- Remove ECS suffixing from dashboard/viz titles.
- Prioritize using ECS fields in dashboards.
- Add Suricata logo to dashboards.

* Always remove event.ingested from test data

(cherry picked from commit 0659a12)
@andrewkroh
Update Suricata dashboards (elastic#20394)
a205641 
This is a followup to elastic#20220 to get the correct dashboard files into place.

(cherry picked from commit b671339)
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Aug 6, 2020
@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20484 opened]

  • Start Time: 2020-08-06T19:19:04.621+0000

  • Duration: 56 min 27 sec

Test stats 🧪

Test Results
Failed 0
Passed 5504
Skipped 824
Total 6328

adriansr
adriansr approved these changes Aug 11, 2020
View reviewed changes
Copy link
Contributor

@adriansr adriansr left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dashboards contain more changes on this cherry-pick than in the original PR, but I checked that the files end up being equal.

@andrewkroh andrewkroh merged commit 0aa391f into elastic:7.x Aug 11, 2020
@zube zube bot removed the [zube]: Done label Nov 9, 2020
@andrewkroh andrewkroh deleted the backport_20220_7.x branch January 14, 2022 14:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@adriansr adriansr adriansr approved these changes

Assignees
No one assigned
Labels
backport
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@andrewkroh @elasticmachine @adriansr