Azure / Azure/Azure-Sentinel

Cisco Umbrella CCF connector: expose IsCompressed / HasCsvHeader in the "Add new collector" GUI (silent failure otherwise)

Open
#14,514 7 comments 10 reactions 3 assignees Claimed by @hassanchawiche View on GitHub
Codeless Connector Framework (CCF) Connector Connector
Dominant language
Python
Stars
6.1k
Forks
3.8k
Avg merge
4d 7h
Merged PRs (30d)
125

Description

The Cisco Umbrella (Codeless Connector Framework) connector hardcodes the data format in the polling template. The "Add new collector" form only asks for Data type, Access Key, Secret Key, Bucket Name, Region, and Prefix. There is no way to set whether the source is gzip-compressed or whether the CSV has a header.

This is a problem because if the actual S3 files don't match the hardcoded dataFormat (e.g. files are gzip-compressed and headerless, but the template expects uncompressed CSV with a header), ingestion fails silently: the destination tables stay empty (or rows come in with only TimeGenerated populated and all other fields null), with no error surfaced in the connector UI or in SentinelHealth.

Request: Add optional inputs in the "Add new collector" context pane for IsCompressed and HasCsvHeader (mapped to properties.dataFormat), so collectors can be configured to match the real file format without editing/redeploying the solution template.
Additionally, it would help to surface a parse/format error somewhere visible instead of failing silently when the configured format doesn't match the data.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.