Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 54fefd3

Browse files
kcreddykcreddy
authored
ti_*: Allow transforms to run unattended mode (#16535)
ti_*: Allow transforms to run unattended mode Right now transforms require manual intervention to restart them whenever there is network instability. This PR adds "settings.unattended = true" for all "ti_*" transforms to allow them auto-recover. Although the ideal way to solve this is by setting "settings.num_failure_retries: -1", it is not allowed by Transform API or package-spec yet. [git-generate] for transform in $(find packages/ti_*/ -type f -name transform.yml); do yq -i '.settings.unattended = true' "$transform" done for upd_transform in $(git diff --name-only packages/ | grep 'transform\.yml$'); do current_version=$(yq '._meta.fleet_transform_version' "$upd_transform") new_version=$(echo "$current_version" | awk -F. '{printf "%d.%d.%d", $1, $2+1, 0}') yq -i "._meta.fleet_transform_version = \"$new_version\"" "$upd_transform" echo "Updated $upd_transform: $current_version -> $new_version" done for package in $(git diff --name-only packages/ | cut -d'/' -f1,2 | sort -u) ; do cd $package && elastic-package changelog add --description "Allow transforms to run unattended mode." --type enhancement --next minor --link #16535 cd ../../ done
1 parent 98c2dc1 commit 54fefd3

67 files changed

Lines changed: 212 additions & 69 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎packages/ti_abusech/changelog.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "3.5.0"
3+
changes:
4+
- description: Allow transforms to run in unattended mode.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/16535
27
- version: "3.4.0"
38
changes:
49
- description: |
@@ -19,10 +24,7 @@
1924
- version: "3.1.0"
2025
changes:
2126
- description: >-
22-
Add terminate processor in ingest pipelines to filter out events containing CEL errors.
23-
Add `threat.indicator.marking.tlp` ECS field mapping in `threatfox` and `malwarebazaar` data streams.
24-
Add `threat.indicator.confidence` ECS field mapping in `malware` data stream.
25-
Improve system tests configuration.
27+
Add terminate processor in ingest pipelines to filter out events containing CEL errors. Add `threat.indicator.marking.tlp` ECS field mapping in `threatfox` and `malwarebazaar` data streams. Add `threat.indicator.confidence` ECS field mapping in `malware` data stream. Improve system tests configuration.
2628
type: enhancement
2729
link: https://github.com/elastic/integrations/pull/14586
2830
- version: "3.0.0"

‎packages/ti_abusech/elasticsearch/transform/latest_ja3_fingerprints/transform.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,6 @@ _meta:
3737
managed: true
3838
# Bump this version to delete, reinstall, and restart the transform during package.
3939
# Version bump is needed if there is any code change in transform.
40-
fleet_transform_version: 0.4.0
40+
fleet_transform_version: 0.5.0
41+
settings:
42+
unattended: true

‎packages/ti_abusech/elasticsearch/transform/latest_malware/transform.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,6 @@ _meta:
3838
managed: true
3939
# Bump this version to delete, reinstall, and restart the transform during package.
4040
# Version bump is needed if there is any code change in transform.
41-
fleet_transform_version: 0.4.0
41+
fleet_transform_version: 0.5.0
42+
settings:
43+
unattended: true

‎packages/ti_abusech/elasticsearch/transform/latest_malwarebazaar/transform.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,6 @@ _meta:
3838
managed: true
3939
# Bump this version to delete, reinstall, and restart the transform during package.
4040
# Version bump is needed if there is any code change in transform.
41-
fleet_transform_version: 0.4.0
41+
fleet_transform_version: 0.5.0
42+
settings:
43+
unattended: true

‎packages/ti_abusech/elasticsearch/transform/latest_sslblacklist/transform.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,6 @@ _meta:
3737
managed: true
3838
# Bump this version to delete, reinstall, and restart the transform during package.
3939
# Version bump is needed if there is any code change in transform.
40-
fleet_transform_version: 0.4.0
40+
fleet_transform_version: 0.5.0
41+
settings:
42+
unattended: true

‎packages/ti_abusech/elasticsearch/transform/latest_threatfox/transform.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,6 @@ _meta:
3737
managed: true
3838
# Bump this version to delete, reinstall, and restart the transform during package.
3939
# Version bump is needed if there is any code change in transform.
40-
fleet_transform_version: 0.4.0
40+
fleet_transform_version: 0.5.0
41+
settings:
42+
unattended: true

‎packages/ti_abusech/elasticsearch/transform/latest_url/transform.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,6 @@ _meta:
3737
managed: true
3838
# Bump this version to delete, reinstall, and restart the transform during package.
3939
# Version bump is needed if there is any code change in transform.
40-
fleet_transform_version: 0.4.0
40+
fleet_transform_version: 0.5.0
41+
settings:
42+
unattended: true

‎packages/ti_abusech/manifest.yml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
name: ti_abusech
22
title: abuse.ch
3-
version: "3.4.0"
3+
version: "3.5.0"
44
description: Ingest threat intelligence indicators from URL Haus, Malware Bazaar, and Threat Fox feeds with Elastic Agent.
55
type: integration
66
format_version: "3.3.2"
7-
categories:
7+
categories:
88
- security
99
- threat_intel
1010
conditions:
@@ -73,11 +73,7 @@ policy_templates:
7373
required: false
7474
show_user: false
7575
description: >-
76-
The request tracer logs requests and responses to the agent's local file-system for debugging configurations.
77-
Enabling this request tracing compromises security and should only be used for debugging. Disabling the request
78-
tracer will delete any stored traces.
79-
See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable)
80-
for details.
76+
The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.
8177
owner:
8278
github: elastic/security-service-integrations
8379
type: elastic

‎packages/ti_anomali/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.3.0"
3+
changes:
4+
- description: Allow transforms to run in unattended mode.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/16535
27
- version: "2.2.0"
38
changes:
49
- description: Added Agentless deployment mode.

‎packages/ti_anomali/elasticsearch/transform/latest_intelligence/transform.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,6 @@ retention_policy:
3232
_meta:
3333
managed: true
3434
# Bump this version to delete, reinstall, and restart the transform during package.
35-
fleet_transform_version: 0.3.0
35+
fleet_transform_version: 0.4.0
36+
settings:
37+
unattended: true

0 commit comments

Comments
 (0)