Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

arista-switch-pack #26554

Merged
merged 62 commits into from
May 30, 2023
Merged

arista-switch-pack #26554

merged 62 commits into from
May 30, 2023

Conversation

cweltPA
Copy link
Contributor

@cweltPA cweltPA commented May 16, 2023

Status

  • In Progress
  • Ready
  • In Hold - (Reason for hold)

Related Issues

fixes: https://jira-hq.paloaltonetworks.local/browse/CIAC-6624

Description

A new XSIAM pack for Arista EOS Switches.

@cweltPA cweltPA changed the title arista-switch-pack-initialization arista-switch-pack May 16, 2023
@cweltPA cweltPA requested a review from ShirleyDenkberg May 28, 2023 06:54
@ShirleyDenkberg ShirleyDenkberg self-assigned this May 28, 2023
@cweltPA cweltPA requested a review from evisochek May 29, 2023 09:09
cweltPA and others added 11 commits May 29, 2023 12:38
* Added the base code

* more structural changes

* added yml and description

* added a test

* commit

* Adding tests

* added tests and documentation

* removed a duplicate yml conf

* commit

* commit

* commit

* commit

* commit

* changed events typo

* formating the code

* changes with nextLink

* added support for the pagination

* commit

* commit

* commit

* modified some tests

* Finished the tests and some fixes found by tests

* added some test and removed the first fetch time param

* fixed a test and some bugs in the code

* fixed extra arg in test_module

* commit

* fixes

* commit

* Added modelign rules

* added the  rule

* changes in yml and description

* Added documentation to functions

* Added documentation to tests

* removed a file

* changed to type 9 and bumped docker image

* Update Packs/AzureSecurityCenter/Integrations/MicrosoftDefenderForCloudEventCollector/MicrosoftDefenderForCloudEventCollector_description.md

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

* fixed a typo in microsoft

* changes after doc review

* small change in readme.md

* fix validations

* commit

* change in the modeling rules

* Added a first_fetch_time handeling

* changed the modeling rule of event.outcome_reason

* Added the first_fetch time parameter

* Empty-Commit

* review changes

* added some known limitations

* changed the hyrarcy of the modeling rules

* fixed xif

* modeling rules change names

* Fixed the modeling rules

* updated docker image

* removed the RN for the new pack

* minor readme changes

* Apply suggestions from code review

Docs review.

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>

* added RN and bumped version

---------

Co-authored-by: ShirleyDenkberg <62508050+ShirleyDenkberg@users.noreply.github.com>
@cweltPA
Copy link
Contributor Author

cweltPA commented May 30, 2023

@DeanArbel

Hey,

Seems that this PR validations fail only due to Modeling Rules Test-Data mismtaches.
These Test-Data mismatches are false-positives:

They occur because the modeling rules use a [RULE] stanza section,
which is currently unsupported by the Test-Data SDK functinality (The XQL query that is generated by the SDK test does not take into account the XDM fields that are mapped by invoking modeling rules that are defined under the [RULE] sections, so as a result, the " _| fields , , ... _ " stage on the XQL query does include all fields, and for these fields a NULL value is returned and fails the Test-Data validation.

There is a dev-task issue for this matter:
modeling-rules lack support in [RULE] sections

Hence, requesting a force merge for this PR.

Chanan

@evisochek FYI

@cweltPA cweltPA added the ForceMerge Forcing the merge of the PR despite the build status label May 30, 2023
@evisochek evisochek requested a review from DeanArbel May 30, 2023 12:32
@DeanArbel DeanArbel merged commit f9fcc4d into master May 30, 2023
@DeanArbel DeanArbel deleted the Arista-EOS-Switch branch May 30, 2023 14:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docs-approved ForceMerge Forcing the merge of the PR despite the build status
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants