Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Osquery_manager: Input level settings for platform and version osquery pack constraint #1441

Closed
wants to merge 4 commits into from
Closed

Osquery_manager: Input level settings for platform and version osquery pack constraint #1441

wants to merge 4 commits into from

Conversation

aleksmaus
Copy link
Member

@aleksmaus aleksmaus commented Aug 3, 2021

What does this PR do?

Introduces the input level settings for platform and version osquery pack constraint.
The input level settings currently have to have a different name from the stream level settings otherwise they are applied to each stream, thus the names are iplatform and iversion.

The changes as is break the osquery manager integration configuration on kibana side.
so there are two things to fix on kibana side:

  1. kibana needs to be able to create integration configuration with empty vars
  2. the configuration page for osquery needs to remove compiled_input from the request payload when updating the streaming configuration via /api/fleet/package_policies/ API.

Example working request payload:

{
    "name": "osquery_manager-1",
    "description": "",
    "policy_id": "548a3940-df4e-11eb-8fdd-b98cebb63257",
    "namespace": "default",
    "inputs": [
        {
            "type": "osquery",
            "enabled": true,
            "streams": [
                {
                    "data_stream": {
                        "type": "logs",
                        "dataset": "osquery_manager.result"
                    },
                    "enabled": true,
                    "id": "osquery-osquery_manager.result-316fbc06-2bd8-470b-bab3-1a566e72bcf1",
                    "vars": {
                        "id": {
                            "type": "text",
                            "value": "users"
                        },
                        "interval": {
                            "type": "integer",
                            "value": 3600
                        },
                        "query": {
                            "type": "text",
                            "value": "select * from users limit 2"
                        },
                        "platform": {
                            "value": "darwin",
                            "type": "text"
                        },
                        "version": {
                            "value": "4.7.0",
                            "type": "text"
                        }
                    }
                }
            ],
            "policy_template": "osquery_manager",
            "vars": {
                "iplatform": {
                    "value": "posix",
                    "type": "text"
                },
                "iversion": {
                    "value": "4.7.0",
                    "type": "text"
                }
            }
        }
    ],
    "enabled": true,
    "output_id": "",
    "package": {
        "name": "osquery_manager",
        "title": "Osquery Manager",
        "version": "0.5.1"
    }
}

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

Screenshots

Resulting policy with the version and the platform constraints:
Screen Shot 2021-08-03 at 2 33 07 PM

@elasticmachine
Copy link

elasticmachine commented Aug 3, 2021

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2021-08-04T12:44:47.501+0000

  • Duration: 81 min 44 sec

  • Commit: 653cd5d

Test stats 🧪

Test Results
Failed 0
Passed 2629
Skipped 3
Total 2632

Trends 🧪

Image of Build Times

Image of Tests

@aleksmaus
Copy link
Member Author

closing as not relevant anymore

@aleksmaus aleksmaus closed this Jan 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request v7.16.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants