Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #22973 to 7.x: [Filebeat] improve logic for network.direction in sophos xg fileset #22989

Merged
merged 6 commits into from
Dec 10, 2020

Conversation

leehinman
Copy link
Contributor

@leehinman leehinman commented Dec 8, 2020

Cherry-pick of PR #22973 to 7.x branch. Original message:

What does this PR do?

sets network.direction to "external" when traffic src and dst are in 'WAN' zone

Why is it important?

data accuracy

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
    - [ ] I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=sophos TESTING_FILEBEAT_FILESETS=xg mage -v pythonIntegTest

Related issues

@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Dec 8, 2020
@elasticmachine
Copy link
Collaborator

elasticmachine commented Dec 8, 2020

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #22989 updated

  • Start Time: 2020-12-10T03:28:23.157+0000

  • Duration: 51 min 39 sec

Test stats 🧪

Test Results
Failed 0
Passed 2412
Skipped 261
Total 2673

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test Results
Failed 0
Passed 2412
Skipped 261
Total 2673

@@ -470,6 +470,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Improve panw ECS url fields mapping. {pull}22481[22481]
- Improve Nats filebeat dashboard. {pull}22726[22726]
- Add support for UNIX datagram sockets in `unix` input. {issues}18632[18632] {pull}22699[22699]
- Add new httpjson input features and mark old config ones for deprecation {pull}22320[22320]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's an extra entry here.

…lastic#22973)

* improve logic for network.direction in sophos xg fileset

- "external" when traffic src and dst are in 'WAN' zone

Relates elastic#21674

* Update CHANGELOG.next.asciidoc

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
(cherry picked from commit db4830b)
@leehinman leehinman merged commit 0e1ab12 into elastic:7.x Dec 10, 2020
@leehinman leehinman deleted the backport_22973_7.x branch December 10, 2020 14:52
@zube zube bot removed the [zube]: Done label Mar 11, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants