elastic / elastic/integrations

ssi: add support for request trace deletion

Open
#13,002 2 comments 0 reactions 0 assignees View on GitHub
enhancement Integration:bitdefender Integration:carbon_black_cloud Integration:cisco_duo Integration:cloudflare_logpush Integration:crowdstrike Integration:eset_protect Integration:google_scc Integration:google_workspace Integration:imperva_cloud_waf Integration:m365_defender Integration:microsoft_defender_endpoint Integration:mimecast Integration:okta Integration:qualys_vmdr Integration:tenable_io Integration:ti_crowdstrike Integration:ti_opencti Integration:wiz Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

Filebeat v8.15.x added the ability to delete request traces on the agent's host[1]. Since #11954 a number of other integrations have come into the version range that can make use of this.

- [x] admin_by_request_epm #13035
- [x] authentik #17963
- [x] beyondinsight_password_safe #13035
- [x] bitdefender #17963
- [x] blacklens #13035
- [x] carbon_black_cloud #13035
- [x] checkpoint_email #11954
- [x] checkpoint_harmony_endpoint #17963
- [x] cisco_duo #17963
- [x] claroty_ctd #17963
- [x] cloudflare_logpush #12782
- [x] crowdstrike #13035
- [x] cyberark_epm #12198
- [x] digital_guardian #17963
- [x] entro #17963
- [x] eset_protect #17963
- [x] first_epss #17963
- [x] google_scc #13452
- [x] google_secops #12767
- [x] google_workspace #13035
- [x] imperva_cloud_waf #13035
- [x] m365_defender #13452
- [x] microsoft_defender_endpoint #13452
- [x] microsoft_sentinel #13452
- [x] mimecast #13035
- [x] o365 #13452
- [x] okta #11954 #13035
- [x] prisma_cloud #13452
- [x] proofpoint_itm #13153
- [x] qualys_vmdr #13035
- [x] sailpoint_identity_sc #13035
- [x] sentinel_one #13452
- [x] servicenow #13035
- [x] spycloud #17963
- [x] sublime_security #13035
- [x] symantec_endpoint_security #13035
- [x] sysdig #17963
- [x] tenable_io #13452
- [x] tenable_ot_security #13452
- [x] ti_abusech #13452
- [x] ti_crowdstrike #17963
- [x] ti_custom #17963
- [x] ti_opencti #17963
- [x] ti_threatq #13452
- [x] ti_domaintools #13035
- [x] withsecure_elements #17963
- [x] wiz #11954
- [x] zscaler_zia #13452

The list can be obtained by running (there are probably nicer implementations of this, but it works).
```
yq -o=json 'select(.owner.github == "elastic/security-service-integrations")|select((.conditions.kibana.version|contains("8.18.")) or (.conditions.kibana.version|contains("8.17.")) or (.conditions.kibana.version|contains("8.16.")) or (.conditions.kibana.version|contains("8.15.")))|{"name":.name,"policy":.policy_templates}' packages/**/manifest.yml|jq -c|egrep '"type":"(cel|httpjson|http_endpoint)"'|jq -r .name
```

A similar list for packages that have not yet come into range (currently at a version before v8.15):
- [ ] auth0 #20927
- [ ] bbot
- [ ] carbonblack_edr
- [ ] cisa_kevs #20927
- [ ] cisco_meraki
- [ ] cybereason #20927
- [ ] darktrace
- [ ] gigamon
- [ ] jamf_compliance_reporter
- [ ] jumpcloud #20927
- [ ] ti_cif3 #20927
- [ ] ti_cybersixgill #20927
- [ ] ti_eclecticiq #20927
- [ ] ti_maltiverse #20927
- [ ] ti_misp #20927
- [ ] ti_threatconnect #20927
- [ ] trellix_epo_cloud #20927
- [ ] zoom

[1]https://github.com/elastic/beats/pull/39969 and https://github.com/elastic/beats/pull/40004

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.