[Entro Security] Initial release of the Entro Security Integration #14477
+1,641
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
robester0403
added
dashboard
robester0403
added
Team:Security-Service Integrations
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
efd6
reviewed
Jul 10, 2025
Comment on lines
17
to
23
| ## Requirements | ||
| You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware. | ||
|
|
||
| This integration has the following third-party requirements: | ||
|
|
||
| An active Entro Security platform subscription. | ||
| An API Token generated from the Entro Security platform with permissions to access the audit log endpoints. |
There was a problem hiding this comment.
Please make this match the conventions use in #13573.
| "date": "2025-06-27T20:12:44.000Z" | ||
| } | ||
| ] | ||
| `}} |
There was a problem hiding this comment.
Not quite done; the file now has a final whitespace indent. I suspect your editor was being Helpful™.
packages/entro/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
packages/entro/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
Comment on lines
60
to
63
| on_failure: | ||
| - set: | ||
| field: error.message | ||
| value: '{{ _ingest.on_failure_message }}' |
There was a problem hiding this comment.
Suggested change
| on_failure: | |
| - set: | |
| field: error.message | |
| value: '{{ _ingest.on_failure_message }}' | |
| on_failure: | |
| - set: | |
| field: event.kind | |
| value: pipeline_error | |
| - append: | |
| field: tags | |
| value: preserve_original_event | |
| allow_duplicates: false | |
| - append: | |
| field: error.message | |
| value: >- | |
| Processor '{{{ _ingest.on_failure_processor_type }}}' | |
| {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' | |
| {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}' |
and please make sure there is a final new line.
There was a problem hiding this comment.
Same file termination problem here.
packages/entro/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
| type: group | ||
| fields: | ||
| - name: value | ||
| type: keyword |
🚀 Benchmarks reportTo see the full report comment with |
andrewkroh
added
the
documentation
… issue, removed license, adjusted readme, regenerated tests, and fixed CEL & defa ult.yml
|
@efd6 I resolved the more simple issues I fixed in my last commit and left open some. These are still fixed but might be good to keep open in the conversation thread. |
|
This will need to have |
efd6
reviewed
Jul 11, 2025
| preserve_original_event: true | ||
| preserve_duplicate_custom_fields: true | ||
| assert: | ||
| hit_count: 8 |
robester0403
force-pushed
the
entro_security-0.1.0
branch
from
70bbbb5 to
e9e520b
Compare
💚 Build Succeeded
History
|
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed commit message
The initial release includes an audit data stream with its associated components:
Added data collection logic for the audit logs data stream.
Added the ingest pipeline for audit logs
Mapped fields according to the ECS schema and added Fields metadata in the appropriate yml files.
Added dashboards and visualizations.
Added test for pipeline for all the data stream.
Added system test cases for all the data stream.
Checklist
changelog.ymlfile.How to test this PR locally
Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/entro directory.
Run the following command to run tests.
Related issues
Screenshots