Skip to content

[cisco_secure_endpoint] fix template field indexing when next link is absent #16092

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Nov 28, 2025
Merged

[cisco_secure_endpoint] fix template field indexing when next link is absent #16092

merged 3 commits into from
Nov 28, 2025

Conversation

@brijesh-elastic
Copy link
Collaborator

@brijesh-elastic brijesh-elastic commented Nov 24, 2025 •
edited by moxarth-rathod
Loading

Proposed commit message

cisco_secure_endpoint: fix template field indexing when next link is absent

Don't updating fleet health status to degraded when HTTPJSON template
evaluation fails due to an absent metadata.links.next field.

This change bumps minimum kibana version to ^8.19.4 || ~9.0.7 || ^9.1.4

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/cisco_secure_endpoint directory.
  • Run the following command to run tests.

elastic-package test

Related issues

@brijesh-elastic brijesh-elastic self-assigned this Nov 24, 2025
@brijesh-elastic brijesh-elastic requested a review from a team as a code owner November 24, 2025 07:50
@brijesh-elastic brijesh-elastic added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:cisco_secure_endpoint Cisco Secure Endpoint Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Nov 24, 2025
@elasticmachine
Copy link

elasticmachine commented Nov 24, 2025

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 24, 2025

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@efd6 efd6 changed the title [cisco_secure_endpoint] Fix the template evaluation issue and update the system test to correctly match hit counts [cisco_secure_endpoint] Fix template field indexing issue Nov 24, 2025
@efd6 efd6 changed the title [cisco_secure_endpoint] Fix template field indexing issue [cisco_secure_endpoint] fix template field indexing when next link is absent Nov 24, 2025
efd6
efd6 approved these changes Nov 24, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested commit message:

cisco_secure_endpoint: fix template field indexing when next link is absent

Don't updating fleet health status to degraded when HTTPJSON template
evaluation fails due to an absent metadata.links.next field.

efd6
efd6 reviewed Nov 24, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit

@brijesh-elastic @efd6
Update changelog description
f88b0f0 
Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
@brijesh-elastic brijesh-elastic requested a review from efd6 November 25, 2025 10:06
@elasticmachine
Copy link

elasticmachine commented Nov 25, 2025

💚 Build Succeeded

History

cc @brijesh-elastic

kcreddy
kcreddy reviewed Nov 26, 2025
View reviewed changes
packages/cisco_secure_endpoint/_dev/deploy/docker/files/config.yml
offset: "1"
limit: "1"
start_date: "{start_date:\\d{4}(?:-\\d{2}){2}T(?:\\d{2})(?::\\d{2}){2}\\+00:00}"
start_date: "{start_date:.*}"
Copy link
Contributor

@kcreddy kcreddy Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any reason to remove the pattern here?

Copy link
Collaborator Author

@brijesh-elastic brijesh-elastic Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The earlier pattern was not matching correctly; the rule itself wasn't matched while running the system test. By updating it, the pattern now matches correctly, resulting in assert.hit_count: 2.

Copy link
Contributor

@kcreddy kcreddy Nov 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like we are hiding some formatting issue in the input. But this may not be the scope of this PR.

@brijesh-elastic brijesh-elastic merged commit 6d6c332 into elastic:main Nov 28, 2025
7 checks passed
@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 28, 2025

Package cisco_secure_endpoint - 2.33.0 containing this change is available at https://epr.elastic.co/package/cisco_secure_endpoint/2.33.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kcreddy kcreddy kcreddy approved these changes

@efd6 efd6 Awaiting requested review from efd6

Assignees

@brijesh-elastic brijesh-elastic

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:cisco_secure_endpoint Cisco Secure Endpoint Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@brijesh-elastic @elasticmachine @kcreddy @efd6