Skip to content

fortinet_fortigate: fix handling of events with from fields - #3901

Merged
efd6 merged 1 commit into
elastic:mainfrom
efd6:3897-fortinet_fortigate
Jul 29, 2022
Merged

fortinet_fortigate: fix handling of events with from fields#3901
efd6 merged 1 commit into
elastic:mainfrom
efd6:3897-fortinet_fortigate

Conversation

@efd6

@efd6 efd6 commented Jul 29, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

Previously, the rename would attempt to redo work already done by the
append, causing a pipeline failure. So remove it.

What does this PR do?

This fixes handling of SIP events by removing a redundant rename processor.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • This abuses the ECS to place the SIP address in the email address field. I'm not entirely convinced this is a good idea, or that it is commonly done. Input welcome. A potential enhancement would be to properly handle the SIP address.

How to test this PR locally

Related issues

Screenshots

@efd6 efd6 added bug Something isn't working, use only for issues Team:Security-External Integrations Integration:Fortinet (Deprecated) Use one of the specific fortinet_X labels. [Integration not found in source] labels Jul 29, 2022
@efd6 efd6 self-assigned this Jul 29, 2022
@efd6
fortinet_fortigate: fix handling of events with from fields
380ac87 
Previously, the rename would attempt to redo work already done by the
append, causing a pipeline failure. So remove it.
@efd6
efd6 force-pushed the 3897-fortinet_fortigate branch from 1e57e90 to 380ac87 Compare July 29, 2022 12:39
@elasticmachine

elasticmachine commented Jul 29, 2022 •
edited
Loading

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-07-29T12:40:22.663+0000

  • Duration: 18 min 6 sec

Test stats 🧪

Test Results
Failed 0
Passed 8
Skipped 0
Total 8

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@efd6
efd6 marked this pull request as ready for review July 29, 2022 12:43
@efd6
efd6 requested a review from a team as a code owner July 29, 2022 12:43
@elasticmachine

elasticmachine commented Jul 29, 2022

Copy link
Copy Markdown

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine

elasticmachine commented Jul 29, 2022

Copy link
Copy Markdown

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 100.0% (4/4) 💚 2.868
Classes 100.0% (4/4) 💚 2.868
Methods 100.0% (38/38) 💚 10.749
Lines 92.003% (1070/1163) 👍 1.402
Conditionals 100.0% (0/0) 💚

taylor-swanson
taylor-swanson approved these changes Jul 29, 2022
View reviewed changes

@taylor-swanson taylor-swanson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

I originally made the changes for the append/email, but that rename appears to be an oversight on my part. It should've been removed, which is being done here.

Since fortinet has been split into separate packages, I take it we are deprecating the fortinet package and only maintaining this one from now on?

@efd6

efd6 commented Jul 29, 2022

Copy link
Copy Markdown
Contributor Author

Since fortinet has been split into separate packages, I take it we are deprecating the fortinet package and only maintaining this one from now on?

That is my understanding.

@efd6
efd6 merged commit 308a85e into elastic:main Jul 29, 2022
@andrewkroh andrewkroh mentioned this pull request Aug 15, 2022
Merged
@efd6
efd6 deleted the 3897-fortinet_fortigate branch February 5, 2025 22:07
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@efd6
fortinet_fortigate: fix handling of events with from fields (elastic#…
6556b21 
…3901)

Previously, the rename would attempt to redo work already done by the
append, causing a pipeline failure. So remove it.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@taylor-swanson taylor-swanson taylor-swanson approved these changes

Assignees

@efd6 efd6

Labels

bug Something isn't working, use only for issues Integration:Fortinet (Deprecated) Use one of the specific fortinet_X labels. [Integration not found in source]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Fortinet Integration Error

3 participants

@efd6 @elasticmachine @taylor-swanson