Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

santa: add process.entity_id constructed from agent.id, pid and pidversion #3373

Merged
merged 3 commits into from
May 18, 2022

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented May 18, 2022

What does this PR do?

This adds a process.entity_id from the agent.id, the process.pid and the process.pidversion (stored in santa.pidversion).

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

Sorry, something went wrong.

@efd6 efd6 requested a review from a team as a code owner May 18, 2022 03:56
@efd6 efd6 self-assigned this May 18, 2022
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

Verified

This commit was signed with the committer’s verified signature.
mshibuya Mitsuhiro Shibuya
@elasticmachine
Copy link

elasticmachine commented May 18, 2022

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-05-18T06:18:32.801+0000

  • Duration: 13 min 55 sec

Test stats 🧪

Test Results
Failed 0
Passed 13
Skipped 0
Total 13

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

Comment on lines +23 to +26
- set:
field: process.entity_id
value: "{{{agent.id}}}-{{{process.entity_id}}}"
if: "ctx.agent?.id != null && ctx.process?.entity_id != null"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure who would set process.entity_id before ? Would this condition ever be true ?

Copy link
Contributor Author

@efd6 efd6 May 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The previous set processor may have. This part prepends the agent.id if it's available and needed (the null check is for the "if needed" part of that).

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

eeks missed it :) This enriches the existing field.

Isn't it worth having agent.id which I presume is almost always available for cases where process.pid and santa.pidversion are unavailable. That way there is at least one other identifying factor ? But none the less the user could always user agent.id directly I suppose. 👍

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that will be available independently.

Copy link
Contributor

@r00tu53r r00tu53r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Just a minor comment/question + rebuild required to regenerate README.

@r00tu53r
Copy link
Contributor

/test

@elasticmachine
Copy link

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 100.0% (1/1) 💚 3.659
Classes 100.0% (1/1) 💚 3.659
Methods 100.0% (12/12) 💚 11.036
Lines 87.963% (95/108) 👎 -2.126
Conditionals 100.0% (0/0) 💚

@efd6 efd6 requested a review from r00tu53r May 18, 2022 06:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request Integration:santa Google Santa
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants