Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Telemetry][Security Solution] Enrich endpoint alerts with license info #188760

Merged
merged 6 commits into from
Jul 22, 2024

Conversation

szaffarano
Copy link
Contributor

@szaffarano szaffarano commented Jul 19, 2024

Summary

  • Includes license information as part of the enrichment when the telemetry events are sent to the endpoint-alerts channel.
  • Increment polling timeouts and enable integration tests marked as flaky.
  • Start using the async sender in the Endpoint Diagnostic Task.

Checklist

Delete any items that are not applicable to this PR.

@szaffarano szaffarano requested review from a team as code owners July 19, 2024 14:52
@szaffarano szaffarano added release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.14.0 v8.15.0 labels Jul 19, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

Copy link
Contributor

@JDKurma JDKurma left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@szaffarano szaffarano enabled auto-merge (squash) July 22, 2024 07:08
@kibana-ci
Copy link
Collaborator

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@szaffarano szaffarano deleted the szaffarano/license-info branch July 22, 2024 10:56
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jul 22, 2024
@kibanamachine
Copy link
Contributor

💔 Some backports could not be created

Status Branch Result
8.13 Backport failed because of merge conflicts
8.14 Backport failed because of merge conflicts
8.15

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 188760

Questions ?

Please refer to the Backport tool documentation

szaffarano added a commit to szaffarano/kibana that referenced this pull request Jul 22, 2024
…fo (elastic#188760)

(cherry picked from commit aa6aa26)

# Conflicts:
#	x-pack/plugins/security_solution/server/lib/telemetry/tasks/diagnostic.ts
@szaffarano
Copy link
Contributor Author

💔 Some backports could not be created

Status Branch Result
8.14
8.13 Conflict resolution was aborted by the user

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 188760

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jul 22, 2024
…ense info (#188760) (#188831)

# Backport

This will backport the following commits from `main` to `8.15`:
- [[Telemetry][Security Solution] Enrich endpoint alerts with license
info (#188760)](#188760)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Sebastián
Zaffarano","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-07-22T10:56:27Z","message":"[Telemetry][Security
Solution] Enrich endpoint alerts with license info
(#188760)","sha":"aa6aa2686641b428730f64c65a30003031d39c98","branchLabelMapping":{"^v8.16.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","v8.13.0","v8.14.0","v8.15.0","v8.16.0"],"title":"[Telemetry][Security
Solution] Enrich endpoint alerts with license
info","number":188760,"url":"https://github.com/elastic/kibana/pull/188760","mergeCommit":{"message":"[Telemetry][Security
Solution] Enrich endpoint alerts with license info
(#188760)","sha":"aa6aa2686641b428730f64c65a30003031d39c98"}},"sourceBranch":"main","suggestedTargetBranches":["8.13","8.14","8.15"],"targetPullRequestStates":[{"branch":"8.13","label":"v8.13.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.14","label":"v8.14.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.15","label":"v8.15.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/188760","number":188760,"mergeCommit":{"message":"[Telemetry][Security
Solution] Enrich endpoint alerts with license info
(#188760)","sha":"aa6aa2686641b428730f64c65a30003031d39c98"}}]}]
BACKPORT-->

Co-authored-by: Sebastián Zaffarano <[email protected]>
@szaffarano
Copy link
Contributor Author

💚 All backports created successfully

Status Branch Result
8.13

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

szaffarano added a commit to szaffarano/kibana that referenced this pull request Jul 23, 2024
…fo (elastic#188760)

(cherry picked from commit aa6aa26)

# Conflicts:
#	x-pack/plugins/security_solution/server/integration_tests/lib/helpers.ts
#	x-pack/plugins/security_solution/server/integration_tests/telemetry.test.ts
#	x-pack/plugins/security_solution/server/lib/telemetry/async_sender.ts
#	x-pack/plugins/security_solution/server/lib/telemetry/receiver.ts
#	x-pack/plugins/security_solution/server/lib/telemetry/tasks/diagnostic.ts
szaffarano added a commit that referenced this pull request Jul 23, 2024
…ense info (#188760) (#188834)

# Backport

This will backport the following commits from `main` to `8.14`:
- [[Telemetry][Security Solution] Enrich endpoint alerts with license
info (#188760)](#188760)

<!--- Backport version: 8.9.8 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Sebastián
Zaffarano","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-07-22T10:56:27Z","message":"[Telemetry][Security
Solution] Enrich endpoint alerts with license info
(#188760)","sha":"aa6aa2686641b428730f64c65a30003031d39c98","branchLabelMapping":{"^v8.16.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","v8.13.0","v8.14.0","v8.15.0","v8.16.0"],"number":188760,"url":"https://github.com/elastic/kibana/pull/188760","mergeCommit":{"message":"[Telemetry][Security
Solution] Enrich endpoint alerts with license info
(#188760)","sha":"aa6aa2686641b428730f64c65a30003031d39c98"}},"sourceBranch":"main","suggestedTargetBranches":["8.13","8.14"],"targetPullRequestStates":[{"branch":"8.13","label":"v8.13.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.14","label":"v8.14.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.15","label":"v8.15.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/188831","number":188831,"state":"OPEN"},{"branch":"main","label":"v8.16.0","labelRegex":"^v8.16.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/188760","number":188760,"mergeCommit":{"message":"[Telemetry][Security
Solution] Enrich endpoint alerts with license info
(#188760)","sha":"aa6aa2686641b428730f64c65a30003031d39c98"}}]}]
BACKPORT-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.13.0 v8.14.0 v8.14.4 v8.15.0 v8.16.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants