elastic / elastic/integrations

ssi: rewrite HTTP JSON data streams that do not use a persisted cursor to CEL

Open
#14,759 6 comments 0 reactions 0 assignees View on GitHub
Integration:bitdefender Integration:bitwarden Integration:cisa_kevs Integration:cisco_duo Integration:github Integration:google_scc Integration:lastpass Integration:rapid7_insightvm Integration:ti_maltiverse Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

A block on the revision of HTTP JSON-based integrations to use the CEL input is that under the current filebeat state store system, it is not possible to migrate the HTTP JSON stored cursor to be used by the CEL input. However, there are a number of HTTP JSON data streams that do not use a stored cursor, so these can be migrated to CEL without resolution of the state store issue, without any cursor state loss impact on users.

- [x] bitdefender #14787
- [ ] bitwarden.collection
- [ ] bitwarden.group
- [ ] bitwarden.member
- [ ] bitwarden.policy
- [x] cisa_kevs #14804
- [ ] cisco_duo.summary
- [ ] github.code_scanning
- [ ] github.dependabot
- [ ] github.issues
- [ ] github.secret_scanning
- [ ] google_scc.asset
- [ ] google_scc.source
- [ ] lastpass.detailed_shared_folder
- [ ] lastpass.user
- [ ] rapid7_insightvm.asset
- [ ] ti_maltiverse

Note that there may be other impacts on migration that should be investigated (for example if the integration makes use of the HTTP JSON rate limit mechanism which is not compatible with the CEL input's rate limiter).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.