Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Ingest] Add additional attributes to the Datasources Stored Object #65904

Closed
paul-tavares opened this issue May 8, 2020 · 7 comments · Fixed by #66127
Closed

[Ingest] Add additional attributes to the Datasources Stored Object #65904

paul-tavares opened this issue May 8, 2020 · 7 comments · Fixed by #66127
Assignees
Labels
Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Team:Fleet Team label for Observability Data Collection Fleet team

Comments

@paul-tavares
Copy link
Contributor

In support of Endpoint Security, add the following additional attributes to datasources:

  • updated_on : Date (ISO). Should be set every time the SO is updated
  • updated_by : User. Should be set every time the SO is updated
  • created_on : Date (ISO). Should be set once only during create
  • created_by : User. Should be set once only during create

REST Impact

  1. New attributes should be returned with every response that includes the Datasource
  2. None of these new attributes should be accepted via the REST API (POST, PUT, etc.)
  3. ❓ These should NOT be included in the JSON/YAML that is sent to the Agent (cc/ @nchaulet)

UI Impact

  1. ❓ Should these be shown in the UI? (either on the Agent Config > Datasources list/table? or the Edit Datasource View?) (/cc @hbharding)
@paul-tavares paul-tavares added the Team:Fleet Team label for Observability Data Collection Fleet team label May 8, 2020
@paul-tavares paul-tavares self-assigned this May 8, 2020
@kevinlog
Copy link
Contributor

kevinlog commented May 8, 2020

Thanks for creating this @paul-tavares , gonna add our team label as well.

@elasticmachine
Copy link
Contributor

Pinging @elastic/endpoint-management (Team:Endpoint Management)

@nchaulet
Copy link
Member

nchaulet commented May 8, 2020

❓ These should NOT be included in the JSON/YAML that is sent to the Agent (cc/ @nchaulet)

Yes we should not send this to the agent, the way we build the config allow to add new property to the saved object without impacting the agent final config

@jen-huang
Copy link
Contributor

Just an FYI as these will be changes to saved object mappings, we should check that the changes do not need migrations, or add correct migrations, so that previously saved data sources just work with the new mappings. (As these are completely new properties, I don't think we will need to add migrations 🤞)

@paul-tavares
Copy link
Contributor Author

Thanks @jen-huang for the heads up and for the link - now I know where to get dev info. about saved object 😄 👍

@hbharding
Copy link
Contributor

Should these be shown in the UI?

Yes! I think this is a good idea. I'll work on some designs and create a UI implementation issue.

@paul-tavares
Copy link
Contributor Author

So I do think we need migration to ensure these fields are returned for existing data being that I think we would like to define the (TS) types for these are required.

I will look closer into the Migration to figure out how to do it. I'm thinking all fields should be set SO's last update date (updated_at) and set the user to system.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Defend Workflows “EDR Workflows” sub-team of Security Solution Team:Fleet Team label for Observability Data Collection Fleet team
Projects
None yet
Development

Successfully merging a pull request may close this issue.

7 participants