elastic / elastic/apm

[SIEM integration] Standardize SQL information

Open
#129 1 comment 0 reactions 0 assignees View on GitHub
meta
Dominant language
Gherkin
Stars
427
Forks
125
PR merge metrics
No merged PRs in 30d

Description

As layed out in the [design doc](https://docs.google.com/document/d/1FoQRJkRQ1EhdZDGYnGNhCj4SKiY1quF9jII-XsWVOyA/edit#heading=h.jvh2iid8rap) information related to SQL queries could be interesting to integrate with the SIEM app. Required steps are:

- [ ] participate in defining SQL field set in ECS https://github.com/elastic/ecs/issues/514
- [ ] create mock ups for SIEM integration
- [ ] investigate if additional information should be collected by APM agents
- [ ] Failures in SQL queries result in a dedicated error event. Investigate if the error information should be duplicated in the span capturing the SQL information or if the separation into two events linking from the error to the span is fine.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.