Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crowdstrike: add support for EppDetectionSummaryEvent events #12869

Merged
merged 7 commits into from
Mar 26, 2025
Merged

crowdstrike: add support for EppDetectionSummaryEvent events #12869

merged 7 commits into from
Mar 26, 2025
+1,532 −54

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented Feb 24, 2025 •
edited
Loading

Proposed commit message

See title.

Warning

This change needs more tests for coverage of all cases in the event structures that are expected in the new event type.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

Sorry, something went wrong.

@efd6 efd6 added enhancement New feature or request Integration:crowdstrike CrowdStrike Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Feb 24, 2025
@efd6 efd6 self-assigned this Feb 24, 2025
@efd6 efd6 force-pushed the 12867-crowdstrike branch 2 times, most recently from 73579d0 to 909cac0 Compare February 24, 2025 03:07
@elastic-vault-github-plugin-prod
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@efd6 efd6 force-pushed the 12867-crowdstrike branch from 909cac0 to ff1c8b7 Compare March 12, 2025 03:55
@efd6 efd6 marked this pull request as ready for review March 12, 2025 05:26
@efd6 efd6 requested a review from a team as a code owner March 12, 2025 05:26
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

chrisberkhout
chrisberkhout approved these changes Mar 17, 2025
View reviewed changes
Copy link
Contributor

@chrisberkhout chrisberkhout left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Warning:
This change needs more tests for coverage of all cases in the event structures that are expected in the new event type.

To be added in the future?

@efd6
Copy link
Contributor Author

efd6 commented Mar 17, 2025

To be added in the future?

Hopefully to be added in this change. Waiting on availability.

@efd6 efd6 force-pushed the 12867-crowdstrike branch from ff1c8b7 to eaca5e4 Compare March 23, 2025 22:13
@efd6 efd6 requested a review from chrisberkhout March 23, 2025 22:13
@efd6
Copy link
Contributor Author

efd6 commented Mar 23, 2025

Replayed the fdr changes on falcon. Largely the same except that falcon depends on a metadata field that triggers specific pipelines. The approach is to have a preamble pipeline that does the necessary changes and then passes on to the old pipeline.

Also added processor for the severity semantics changes. The pipeline tests look odd since (AFAICS) the severities in the test data were fabricated.

efd6
efd6 commented Mar 23, 2025
View reviewed changes
packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml
@@ -1501,6 +1501,7 @@ processors:
field: event.id
description: Concat the fields used in fingerprint.
tag: set_event_id
if: ctx.crowdstrike?.id != null || ctx.crowdstrike?.aid != null || ctx.crowdstrike?.cid != null
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kcreddy This likely never happens in real situations, but it does happen in tests. In case it actually does ever happen in real data, I think it would be best to not populate the field.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@efd6, Sounds good 👍🏼

@efd6 efd6 force-pushed the 12867-crowdstrike branch from 36d7f62 to 046c655 Compare March 25, 2025 19:36
@efd6 efd6 force-pushed the 12867-crowdstrike branch from 046c655 to ed1f080 Compare March 26, 2025 09:34
@elasticmachine
Copy link

💚 Build Succeeded

History

cc @efd6

@elastic-sonarqube Elastic SonarQube
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
96.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

@efd6 efd6 merged commit 9819fb7 into elastic:main Mar 26, 2025
7 checks passed
@efd6 efd6 mentioned this pull request Mar 26, 2025
Open
@elastic-vault-github-plugin-prod
Copy link

Package crowdstrike - 1.58.0 containing this change is available at https://epr.elastic.co/package/crowdstrike/1.58.0/

flexitrev pushed a commit that referenced this pull request Mar 28, 2025
@efd6 @flexitrev
crowdstrike: add support for EppDetectionSummaryEvent events (#12869)
597ce90 
Test cases added from:
* https://docs.sekoia.io/integration/categories/endpoint/crowdstrike_falcon/#__tabbed_1_6
* https://docs.sekoia.io/integration/categories/endpoint/crowdstrike_falcon/#__tabbed_1_7
* https://docs.sekoia.io/integration/categories/endpoint/crowdstrike_falcon/#__tabbed_1_8
flexitrev pushed a commit that referenced this pull request Mar 28, 2025
@efd6 @flexitrev
crowdstrike: add support for EppDetectionSummaryEvent events (#12869)
53ba957 
Test cases added from:
* https://docs.sekoia.io/integration/categories/endpoint/crowdstrike_falcon/#__tabbed_1_6
* https://docs.sekoia.io/integration/categories/endpoint/crowdstrike_falcon/#__tabbed_1_7
* https://docs.sekoia.io/integration/categories/endpoint/crowdstrike_falcon/#__tabbed_1_8
flexitrev pushed a commit that referenced this pull request Mar 28, 2025
@efd6 @flexitrev
crowdstrike: add support for EppDetectionSummaryEvent events (#12869)
f437641 
Test cases added from:
* https://docs.sekoia.io/integration/categories/endpoint/crowdstrike_falcon/#__tabbed_1_6
* https://docs.sekoia.io/integration/categories/endpoint/crowdstrike_falcon/#__tabbed_1_7
* https://docs.sekoia.io/integration/categories/endpoint/crowdstrike_falcon/#__tabbed_1_8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kcreddy kcreddy

@chrisberkhout chrisberkhout

Assignees

@efd6 efd6

Labels
enhancement New feature or request Integration:crowdstrike CrowdStrike Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

crowdstrike: add support for EppDetectionSummaryEvent
4 participants
@efd6 @elasticmachine @chrisberkhout @kcreddy