[Rule Tuning] Migrate Phase 1 vendor fields to ECS and trim non-ecs schema#6328
Draft
Mikaayenson wants to merge 3 commits into
Draft
[Rule Tuning] Migrate Phase 1 vendor fields to ECS and trim non-ecs schema#6328Mikaayenson wants to merge 3 commits into
Mikaayenson wants to merge 3 commits into
Conversation
…chema Remove ECS duplicate entries from non-ecs-schema.json, add a guard test, and update rule queries to use ECS fields where integrations dual-write. Resolves #1776
Contributor
Enhancement - GuidelinesThese guidelines serve as a reminder set of considerations when addressing adding a new schema feature to the code. Documentation and Context
Code Standards and Practices
Testing
Additional Schema Related Checks
|
1 similar comment
Contributor
Enhancement - GuidelinesThese guidelines serve as a reminder set of considerations when addressing adding a new schema feature to the code. Documentation and Context
Code Standards and Practices
Testing
Additional Schema Related Checks
|
|
⛔️ Test failed Results
|
Contributor
Author
|
Note: |
Scope is rules/ and rules_building_block/ only.
|
⛔️ Test failed Results
|
Mikaayenson
changed the title
Drop unrelated JumpCloud exclusion that referenced process.Ext fields outside the endpoint file schema. Apply ruff format to TestNonEcsSchema.
|
⛔️ Test failed Results
|
| event.code == "0100044547" and | ||
| fortinet.firewall.cfgpath == "firewall.policy" and | ||
| fortinet.firewall.action in ("Add", "Edit") and | ||
| event.action in ("Add", "Edit") and |
Contributor
There was a problem hiding this comment.
I this this change will not work without updating integrations to support it.
It looks like the event pipeline consumes fortinet.firewall.action only to derive
event.outcome / event.type, not event.action:
event.yml— full pipeline (noevent.actionmapping)event.yml#L3-L17—processors:block + firstfortinet.firewall.actionusage (event.outcome)
After routing, the main pipeline sets event.action from
fortinet.firewall.event.type (only when still null). For config events that means
event.action becomes the event.type value, and Add/Edit/download are never copied:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue link(s):
Resolves #1776
Summary - What I changed
Removed ECS duplicate fields from
non-ecs-schema.jsonto catch future duplicates.Updated rules in
rules/andrules_building_block/to use ECS field names where integrations already dual-write the data (Azure, Okta, Kubernetes, winlog, Fortinet, GitHub, and related sources).Did not migrate
aws.cloudtrail.user_identity.arntouser.entity.idbecause stack validation failed onfilebeat-*.How To Test
Checklist
schema,Rule: Tuningmeta:rapid-mergelabel if planning to merge within 24 hours