elastic / elastic/integrations

[ Cloudflare Audit ] Flattened fields should to be duplicate as match_only_text to be used in Security Rules

Open
#14,459 3 comments 0 reactions 0 assignees View on GitHub
Integration:cloudflare_logpush Stalled Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

Hello,

The Cloudflare Audit dataset from the Cloudflare Logpush integration has 3 main fields:

- `cloudflare_logpush.audit.metadata`
- `cloudflare_logpush.audit.new_value`
- `cloudflare_logpush.audit.old_value`

All 3 are mapped as `flattened` which is expected since they can be very dynamic, but with them being `flattened` fields we cannot use them on Security ESQL rules as ESQL does not support `flattened` fields yet.

The alternative in this case would be to have a similar approach to what is done in other integrations, like the AWS Cloudtrail integration, where the field is duplicated with a different mapping.

In this case they could be duplicated as `match_only_text` to allow them to be used in ESQL rules.

For example, we could have something like this:

- `cloudflare_logpush.audit.text.metadata`
- `cloudflare_logpush.audit.text.new_value`
- `cloudflare_logpush.audit.text.old_value`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.