Skip to content

Commit 343a5f2

Browse files
stefnestorstefnestor
committed
Merge branch 'master' into stefnestor-patch-1
2 parents 7925212 + d7f86ce commit 343a5f2

File tree

298 files changed

+23895
-3583
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

298 files changed

+23895
-3583
lines changed

‎.buildkite/pipeline.schedule-daily.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,13 +86,13 @@ steps:
8686
if: |
8787
build.env('TEST_PACKAGES_BASIC_SUBSCRIPTION') == "true"
8888
89-
- label: "Check integrations local stacks - Stack Version v9.1"
89+
- label: "Check integrations local stacks - Stack Version v9.2"
9090
trigger: "integrations"
9191
build:
9292
env:
9393
SERVERLESS: "false"
9494
FORCE_CHECK_ALL: "true"
95-
STACK_VERSION: 9.1.0-SNAPSHOT
95+
STACK_VERSION: 9.2.0-SNAPSHOT
9696
PUBLISH_COVERAGE_REPORTS: "false"
9797
depends_on:
9898
- step: "check"

‎.buildkite/pipeline.schedule-weekly.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,13 @@ steps:
2828
- step: "check"
2929
allow_failure: false
3030

31-
- label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.1"
31+
- label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.2"
3232
trigger: "integrations"
3333
build:
3434
env:
3535
SERVERLESS: "false"
3636
FORCE_CHECK_ALL: "true"
37-
STACK_VERSION: 9.1.0-SNAPSHOT
37+
STACK_VERSION: 9.2.0-SNAPSHOT
3838
PUBLISH_COVERAGE_REPORTS: "false"
3939
ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
4040
depends_on:

‎.buildkite/pull-requests.json

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,17 @@
1313
"always_trigger_comment_regex": "^(?:(?:buildkite\\W+)?(?:build|test)\\W+(?:this|it))|^/test$|^/test benchmark fullreport$",
1414
"skip_ci_labels": [],
1515
"skip_target_branches": [],
16-
"skip_ci_on_only_changed": ["^.github/workflows/", "^.github/dependabot.yml$", "^.github/ISSUE_TEMPLATE/", "^docs/", "^catalog-info.yaml$", "^.buildkite/pull-requests.json$"],
16+
"skip_ci_on_only_changed": [
17+
"^.github/workflows/",
18+
"^.github/dependabot.yml$",
19+
"^.github/ISSUE_TEMPLATE/",
20+
"^docs/",
21+
"^catalog-info.yaml$",
22+
"^.buildkite/pipeline.schedule-daily.yml$",
23+
"^.buildkite/pipeline.schedule-weekly.yml$",
24+
"^.buildkite/pipeline.backport.yml$",
25+
"^.buildkite/pull-requests.json$"
26+
],
1727
"always_require_ci_on_changed": []
1828
},
1929
{

‎.buildkite/scripts/common.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -746,7 +746,7 @@ is_pr_affected() {
746746
# Example:
747747
# https://buildkite.com/elastic/integrations/builds/25606
748748
# https://github.com/elastic/integrations/pull/13810
749-
if git diff --name-only "${commit_merge}" "${to}" | grep -E -v '^(packages/|\.github/(CODEOWNERS|ISSUE_TEMPLATE|PULL_REQUEST_TEMPLATE)|README\.md|docs/|catalog-info\.yaml|\.buildkite/pull-requests\.json)' > /dev/null; then
749+
if git diff --name-only "${commit_merge}" "${to}" | grep -E -v '^(packages/|\.github/(CODEOWNERS|ISSUE_TEMPLATE|PULL_REQUEST_TEMPLATE)|README\.md|docs/|catalog-info\.yaml|\.buildkite/(pull-requests\.json|pipeline\.schedule-daily\.yml|pipeline\.schedule-weekly\.yml|pipeline\.backport\.yml))' > /dev/null; then
750750
echo "[${package}] PR is affected: found non-package files"
751751
return 0
752752
fi

‎go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module github.com/elastic/integrations
33
go 1.24.2
44

55
require (
6-
github.com/Masterminds/semver/v3 v3.3.1
6+
github.com/Masterminds/semver/v3 v3.4.0
77
github.com/blang/semver v3.5.1+incompatible
88
github.com/cli/go-gh/v2 v2.12.1
99
github.com/elastic/elastic-package v0.112.0
@@ -91,7 +91,7 @@ require (
9191
github.com/go-openapi/jsonreference v0.21.0 // indirect
9292
github.com/go-openapi/strfmt v0.23.0 // indirect
9393
github.com/go-openapi/swag v0.23.0 // indirect
94-
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
94+
github.com/go-viper/mapstructure/v2 v2.3.0 // indirect
9595
github.com/gogo/protobuf v1.3.2 // indirect
9696
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
9797
github.com/google/btree v1.1.3 // indirect

‎go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,8 @@ github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ
6161
github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
6262
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
6363
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
64-
github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
65-
github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
64+
github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
65+
github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
6666
github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
6767
github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
6868
github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
@@ -232,8 +232,8 @@ github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+Gr
232232
github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
233233
github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
234234
github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
235-
github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
236-
github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
235+
github.com/go-viper/mapstructure/v2 v2.3.0 h1:27XbWsHIqhbdR5TIC911OfYvgSaW93HM+dX7970Q7jk=
236+
github.com/go-viper/mapstructure/v2 v2.3.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
237237
github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
238238
github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
239239
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=

‎packages/abnormal_security/_dev/build/docs/README.md

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
# Abnormal Security
1+
# Abnormal AI
22

3-
Abnormal Security is a behavioral AI-based email security platform that learns the behavior of every identity in a cloud email environment and analyzes the risk of every event to block even the most sophisticated attacks.
3+
Abnormal AI is a behavioral AI-based email security platform that learns the behavior of every identity in a cloud email environment and analyzes the risk of every event to block even the most sophisticated attacks.
44

5-
The Abnormal Security integration collects data for AI Security Mailbox (formerly known as Abuse Mailbox), Audit, Case, and Threat logs using REST API.
5+
The Abnormal AI integration collects data for AI Security Mailbox (formerly known as Abuse Mailbox), Audit, Case, and Threat logs using REST API.
66

77
## Data streams
88

9-
The Abnormal Security integration collects six types of logs:
9+
The Abnormal AI integration collects six types of logs:
1010

1111
- **[AI Security Mailbox](https://app.swaggerhub.com/apis-docs/abnormal-security/abx/1.4.3#/AI%20Security%20Mailbox%20(formerly%20known%20as%20Abuse%20Mailbox))** - Get details of AI Security Mailbox.
1212

@@ -26,31 +26,31 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst
2626

2727
## Setup
2828

29-
### To collect data from the Abnormal Security Client API:
29+
### To collect data from the Abnormal AI Client API:
3030

3131
#### Step 1: Go to Portal
32-
* Visit the [Abnormal Security Portal](https://portal.abnormalsecurity.com/home/settings/integrations) and click on the `Abnormal REST API` setting.
32+
* Visit the [Abnormal AI Portal](https://portal.abnormalsecurity.com/home/settings/integrations) and click on the `Abnormal REST API` setting.
3333

3434
#### Step 2: Generating the authentication token
35-
* Retrieve your authentication token. This token will be used further in the Elastic integration setup to authenticate and access different Abnormal Security Logs.
35+
* Retrieve your authentication token. This token will be used further in the Elastic integration setup to authenticate and access different Abnormal AI Logs.
3636

3737
#### Step 3: IP allowlisting
38-
* Abnormal Security requires you to restrict API access based on source IP. So in order for the integration to work, user needs to update the IP allowlisting to include the external source IP of the endpoint running the integration via Elastic Agent.
38+
* Abnormal AI requires you to restrict API access based on source IP. So in order for the integration to work, user needs to update the IP allowlisting to include the external source IP of the endpoint running the integration via Elastic Agent.
3939

4040
### Enabling the integration in Elastic:
4141

4242
1. In Kibana navigate to Management > Integrations.
43-
2. In "Search for integrations" top bar, search for `Abnormal Security`.
44-
3. Select the "Abnormal Security" integration from the search results.
45-
4. Select "Add Abnormal Security" to add the integration.
43+
2. In "Search for integrations" top bar, search for `Abnormal AI`.
44+
3. Select the "Abnormal AI" integration from the search results.
45+
4. Select "Add Abnormal AI" to add the integration.
4646
5. Add all the required integration configuration parameters, including Access Token, Interval, Initial Interval and Page Size to enable data collection.
4747
6. Select "Save and continue" to save the integration.
4848

49-
**Note**: By default, the URL is set to `https://api.abnormalplatform.com`. We have observed that Abnormal Security Base URL changes based on location so find your own base URL.
49+
**Note**: By default, the URL is set to `https://api.abnormalplatform.com`. We have observed that Abnormal AI Base URL changes based on location so find your own base URL.
5050

5151
### Enabling enrichment for Threat events
5252

53-
Introduced in version 1.8.0, the Abnormal Security integration includes a new option called `Enable Attachments and Links enrichment` for the Threat data stream. When enabled, this feature enriches incoming threat events with additional details about any attachments and links included in the original message.
53+
Introduced in version 1.8.0, the Abnormal AI integration includes a new option called `Enable Attachments and Links enrichment` for the Threat data stream. When enabled, this feature enriches incoming threat events with additional details about any attachments and links included in the original message.
5454

5555
## Logs reference
5656

‎packages/abnormal_security/changelog.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
# newer versions go on top
2+
- version: "1.9.0"
3+
changes:
4+
- description: |
5+
Rebrand integration to Abnormal AI to align with the current vendor's branding.
6+
This is a superficial branding update only and does not affect existing functionalities.
7+
type: enhancement
8+
link: https://github.com/elastic/integrations/pull/14357
29
- version: "1.8.1"
310
changes:
411
- description: Prevent loss of recent unprocessed messages by the `ai_security_mailbox_not_analyzed` data stream.

‎packages/abnormal_security/data_stream/ai_security_mailbox/manifest.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ streams:
1313
required: true
1414
show_user: true
1515
default: 24h
16-
description: How far back to pull the AI Security Mailbox logs from Abnormal Security API. Supported units for this parameter are h/m/s.
16+
description: How far back to pull the AI Security Mailbox logs from Abnormal AI API. Supported units for this parameter are h/m/s.
1717
- name: interval
1818
type: text
1919
title: Interval
20-
description: Duration between requests to the Abnormal Security API. Supported units for this parameter are h/m/s.
20+
description: Duration between requests to the Abnormal AI API. Supported units for this parameter are h/m/s.
2121
default: 5m
2222
multi: false
2323
required: true
@@ -28,7 +28,7 @@ streams:
2828
multi: false
2929
required: true
3030
show_user: false
31-
description: Page size for the response of the Abnormal Security API.
31+
description: Page size for the response of the Abnormal AI API.
3232
default: 100
3333
- name: http_client_timeout
3434
type: text

‎packages/abnormal_security/data_stream/ai_security_mailbox_not_analyzed/manifest.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,18 @@ streams:
1313
required: true
1414
show_user: true
1515
default: 2160h
16-
description: How far back to pull the AI Security Mailbox Not Analyzed messages from Abnormal Security API. Defaults to 90 days (2160h) before end. Supported units for this parameter are h/m/s.
16+
description: How far back to pull the AI Security Mailbox Not Analyzed messages from Abnormal AI API. Defaults to 90 days (2160h) before end. Supported units for this parameter are h/m/s.
1717
- name: wait_interval
1818
type: text
1919
title: Recent Message Grace Interval
2020
multi: false
2121
required: true
2222
show_user: true
23-
description: How long to wait before attempting to collect recent messages. This option allows the Abnormal Security API to complete analysis of messages before the agent attempts to collect them. This should not be greater than the initial interval. Supported units for this parameter are h/m/s.
23+
description: How long to wait before attempting to collect recent messages. This option allows the Abnormal AI API to complete analysis of messages before the agent attempts to collect them. This should not be greater than the initial interval. Supported units for this parameter are h/m/s.
2424
- name: interval
2525
type: text
2626
title: Interval
27-
description: Duration between requests to the Abnormal Security API. Defaults to 1 hour. Supported units for this parameter are h/m/s.
27+
description: Duration between requests to the Abnormal AI API. Defaults to 1 hour. Supported units for this parameter are h/m/s.
2828
default: 1h
2929
multi: false
3030
required: true

0 commit comments

Comments
 (0)