Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Session View] remove use of runtime mapping once endpoint fixes same_as_process boolean. #128962

Closed
mitodrummer opened this issue Mar 30, 2022 · 1 comment
Assignees
Labels
bug Fixes for quality problems that affect the customer experience Team: AWP: Platform Adaptive Workload Protection Platform team from Security Solution v8.2.0

Comments

@mitodrummer
Copy link
Contributor

Kibana version:
8.2

Describe the bug:
In order to query for all entry_session leaders for rendering in the sessions table, we currently need to use a complex runtime mapping. The ECS spec adds support for a entry_leader.same_as_process boolean, which can be used for this purpose.

e.g get all events WHERE process.entry_leader.same_as_process: true

Any additional context:
#127920 (comment)

@mitodrummer mitodrummer added bug Fixes for quality problems that affect the customer experience v8.2.0 Team: AWP: Platform Adaptive Workload Protection Platform team from Security Solution labels Mar 30, 2022
@mitodrummer
Copy link
Contributor Author

same_as_process should now be available in the latest endpoint-dev code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Team: AWP: Platform Adaptive Workload Protection Platform team from Security Solution v8.2.0
Projects
None yet
Development

No branches or pull requests

3 participants