santa: add process.entity_id constructed from agent.id, pid and pidversion #3373
Conversation
efd6
added
enhancement
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
| - set: | ||
| field: process.entity_id | ||
| value: "{{{agent.id}}}-{{{process.entity_id}}}" | ||
| if: "ctx.agent?.id != null && ctx.process?.entity_id != null" |
There was a problem hiding this comment.
I am not sure who would set process.entity_id before ? Would this condition ever be true ?
There was a problem hiding this comment.
The previous set processor may have. This part prepends the agent.id if it's available and needed (the null check is for the "if needed" part of that).
There was a problem hiding this comment.
eeks missed it :) This enriches the existing field.
Isn't it worth having agent.id which I presume is almost always available for cases where process.pid and santa.pidversion are unavailable. That way there is at least one other identifying factor ? But none the less the user could always user agent.id directly I suppose. 👍
There was a problem hiding this comment.
Yes, that will be available independently.
|
/test |
🌐 Coverage report
|
What does this PR do?
This adds a
process.entity_idfrom the agent.id, the process.pid and the process.pidversion (stored in santa.pidversion).Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots