Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[crowdstrike/fdr] Update aws-s3 input config to support custom SQS notification format #2193

Closed
andrewkroh opened this issue Nov 18, 2021 · 1 comment · Fixed by #2198
Closed

[crowdstrike/fdr] Update aws-s3 input config to support custom SQS notification format #2193

andrewkroh opened this issue Nov 18, 2021 · 1 comment · Fixed by #2198
Assignees
@marc-gr
Labels
bug Something isn't working, use only for issues Integration:crowdstrike CrowdStrike

Comments

@andrewkroh
Copy link
Member

The SQS notification format used by Crowdstrike is not the standard AWS S3 Event Notification format. In order to support the custom format Filebeat has been enhanced via elastic/beats#28946. To use the format that crowdstrke fdr data stream needs updated to add config to extract the S3 object key from the Crowdstrike SQS message.
@andrewkroh andrewkroh added bug Something isn't working, use only for issues Integration:crowdstrike CrowdStrike Team:Security-External Integrations labels Nov 18, 2021
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@marc-gr marc-gr mentioned this issue Nov 19, 2021
Merged
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@marc-gr marc-gr

Labels
bug Something isn't working, use only for issues Integration:crowdstrike CrowdStrike
Projects
None yet
Milestone
No milestone
3 participants
@andrewkroh @marc-gr @elasticmachine