You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the ti_google_threat_intelligence integration, we use a transform that queries data from 14 threat list data streams (based on IP, Domain, URL, and Hash) and routes them through a pipeline to map under a common schema.
Currently, due to the limitation that integration version is not automatically tracked or updated within the transform’s pipeline definition, forgetting to manually update it during integration upgrades can lead to issues. There is no existing validation in the Elastic packaging to enforce this, and the issue is being tracked here: elastic/package-spec#833.
To proceed for now:
We’ve removed the attached pipeline from the transform.
This means incoming documents won’t be filtered unless the pipeline is manually added.
To ensure system tests continue to pass, we've included the <product>_fields.yml files for field mapping.