[Faitour] Initial Push of Beta Integration #13304

MakoWish · 2025-03-25T15:42:36Z

Type of change

Enhancement

Proposed commit message

This is an initial push for a new Integration Faitour: MakoWish/Faitour

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

Dashboards will be created once the beta is released and available

botelastic · 2025-04-24T23:59:58Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

MakoWish · 2025-04-25T16:07:10Z

This is still relevant, and I would like to see it merged. Is there anything else needed on my end to get this approved?

elasticmachine · 2025-05-14T00:07:13Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

packages/faitour/data_stream/honeypot/_dev/test/pipeline/test-events.log

packages/faitour/_dev/build/docs/README.md

packages/faitour/_dev/build/build.yml

packages/faitour/_dev/deploy/docker/docker-compose.yml

packages/faitour/changelog.yml

packages/faitour/data_stream/honeypot/_dev/test/pipeline/test-common-config.yml

packages/faitour/data_stream/honeypot/elasticsearch/ingest_pipeline/default.yml

efd6 · 2025-05-14T00:24:05Z

packages/faitour/data_stream/application/fields/agent.yml

Is there supposed to be an ingest pipeline and tests associated with this data stream?

I took this idea from a different integration that did the same (I forget which). Since I am using two different datasets for the application logs and the honeypot events, the integration tests fail if there is not also a second dataset defined. The one ingest pipeline under honeypot handles all the events.

Have you confirmed that this works in a real set-up?

efd6 · 2025-05-14T00:24:27Z

/test

efd6 · 2025-05-14T00:26:05Z

Forgot to mention; this will need to have a line added to .github/CODEOWNERS.

Commit suggested changes to README.md from code review. Co-authored-by: Dan Kortschak <[email protected]>

Commit suggested change to changelog.yml from code review. Co-authored-by: Dan Kortschak <[email protected]>

Co-authored-by: Dan Kortschak <[email protected]>

…to faitour

Co-authored-by: Dan Kortschak <[email protected]>

…common-config.yml Co-authored-by: Dan Kortschak <[email protected]>

…to faitour

MakoWish · 2025-05-14T19:16:36Z

All suggested changes have been made.

efd6 · 2025-05-14T21:49:31Z

/test

packages/faitour/data_stream/honeypot/elasticsearch/ingest_pipeline/default.yml

packages/faitour/data_stream/honeypot/_dev/test/pipeline/test-events.log-expected.json

packages/faitour/data_stream/honeypot/elasticsearch/ingest_pipeline/default.yml

efd6 · 2025-05-14T22:18:03Z

You will need to re-run elastic-package build.

efd6 · 2025-05-15T21:28:01Z

/test

elastic-vault-github-plugin-prod · 2025-05-15T21:49:15Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

efd6

Test coverage improvements only, then LGTM

packages/faitour/data_stream/honeypot/elasticsearch/ingest_pipeline/default.yml

efd6 · 2025-05-15T22:13:00Z

packages/faitour/data_stream/honeypot/elasticsearch/ingest_pipeline/default.yml

+  ##############################
+  ## Handle ECS Server Fields ##
+  ##############################
+  - rename:


Add a test sample event to test this processor.

I could have sworn the pipeline tests passed before with both the faitour.honeypot and faitour.application datastreams when I had too many test events, but now that I am trying to add a test event that would be in the faitour.application datastream for this, the pipeline tests are failing with:

FAILURE DETAILS: faitour/honeypot test-events.log: [0] field "event.dataset" should have value in ["faitour.honeypot"], it has "faitour.application" [1] parsing field value failed: field "event.dataset"'s value "faitour.application" does not match the declared constant_keyword value "faitour.honeypot"

I don't want two separate logs in my application, but I do want events related to the application distinguishable from activity against the honeypot in Elastic. I tried removing the event.dataset field declaration from base-fields.yml, and that handled the error [1], but it still gives the same error [0].

How can I add an event for data_stream.dataset: faitour.application into the test events and get around this? The events do get parsed properly.

How can I add an event for data_stream.dataset: faitour.application into the test events and get around this?

If you want to do something like this you will need to route one of them to a different data stream. I'm not sure that this feels like it is worth it; testing in this case is harder (read, "not actually possible at the moment").

Can you tolerate a softer separation between the two types of data?

I will tolerate whatever it takes to not have to completely rewrite my logging, hahaha!

packages/faitour/data_stream/honeypot/elasticsearch/ingest_pipeline/default.yml

efd6 · 2025-05-18T22:56:45Z

/test

elasticmachine · 2025-05-18T23:15:19Z

💚 Build Succeeded

Buildkite Build
Commit: c6f5c62

History

💚 Build #26002 succeeded c6f5c62
💔 Build #25963 failed 543abfb
💔 Build #25920 failed 2a9b461

elastic-sonarqube · 2025-05-18T23:15:23Z

Quality Gate failed

Failed conditions
47.7% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

botelastic · 2025-06-20T16:34:12Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

botelastic · 2025-07-31T17:17:07Z

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

botelastic · 2025-08-30T18:00:31Z

Hi! This PR has been stale for a while and we're going to close it as part of our cleanup procedure. We appreciate your contribution and would like to apologize if we have not been able to review it, due to the current heavy load of the team. Feel free to re-open this PR if you think it should stay open and is worth rebasing. Thank you for your contribution!

Initial push of Faitour integration

3392e85

MakoWish marked this pull request as ready for review March 25, 2025 15:45

Added entry to changelog.yml

21897b1

andrewkroh added the New Integration Issue or pull request for creating a new integration package. label Mar 25, 2025

botelastic bot added the Stalled label Apr 24, 2025

botelastic bot removed the Stalled label Apr 25, 2025

Merge branch 'main' into faitour

2a9b461

MakoWish requested a review from a team as a code owner May 13, 2025 23:47

efd6 requested a review from a team May 14, 2025 00:06

efd6 added the Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] label May 14, 2025

efd6 reviewed May 14, 2025

View reviewed changes

MakoWish and others added 12 commits May 14, 2025 12:20

Update packages/faitour/_dev/build/docs/README.md

383d108

Commit suggested changes to README.md from code review. Co-authored-by: Dan Kortschak <[email protected]>

Update packages/faitour/changelog.yml

4000777

Commit suggested change to changelog.yml from code review. Co-authored-by: Dan Kortschak <[email protected]>

Update packages/faitour/_dev/deploy/docker/docker-compose.yml

f1f9736

Co-authored-by: Dan Kortschak <[email protected]>

Reduce number of test events

c7e5730

Merge branch 'faitour' of https://github.com/MakoWish/integrations in…

a13ccc5

…to faitour

Merge branch 'elastic:main' into faitour

16fb9a3

Merge branch 'faitour' of https://github.com/MakoWish/integrations in…

e13384d

…to faitour

Update packages/faitour/_dev/build/build.yml

a60bd27

Co-authored-by: Dan Kortschak <[email protected]>

Update packages/faitour/data_stream/honeypot/_dev/test/pipeline/test-…

7db1a3a

…common-config.yml Co-authored-by: Dan Kortschak <[email protected]>

Update packages/faitour/data_stream/honeypot/_dev/test/pipeline/test-…

3500bf6

…common-config.yml Co-authored-by: Dan Kortschak <[email protected]>

Merge branch 'faitour' of https://github.com/MakoWish/integrations in…

2eace54

…to faitour

Change for code review.

543abfb

efd6 reviewed May 14, 2025

View reviewed changes

Additional corrections from code review

c6f5c62

efd6 reviewed May 15, 2025

View reviewed changes

botelastic bot added the Stalled label Jun 20, 2025

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jul 1, 2025

botelastic bot removed the Stalled label Jul 1, 2025

botelastic bot added the Stalled label Jul 31, 2025

botelastic bot closed this Aug 30, 2025

[Faitour] Initial Push of Beta Integration #13304

[Faitour] Initial Push of Beta Integration #13304

Uh oh!

Conversation

MakoWish commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Type of change

Proposed commit message

Checklist

Author's Checklist

Uh oh!

botelastic bot commented Apr 24, 2025

Uh oh!

MakoWish commented Apr 25, 2025

Uh oh!

elasticmachine commented May 14, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

efd6 May 14, 2025

Choose a reason for hiding this comment

Uh oh!

MakoWish May 14, 2025

Choose a reason for hiding this comment

Uh oh!

efd6 May 14, 2025

Choose a reason for hiding this comment

Uh oh!

efd6 commented May 14, 2025

Uh oh!

efd6 commented May 14, 2025

Uh oh!

MakoWish commented May 14, 2025

Uh oh!

efd6 commented May 14, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

efd6 commented May 14, 2025

Uh oh!

efd6 commented May 15, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented May 15, 2025

🚀 Benchmarks report

Uh oh!

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

efd6 May 15, 2025

Choose a reason for hiding this comment

Uh oh!

MakoWish May 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

efd6 May 18, 2025

Choose a reason for hiding this comment

Uh oh!

MakoWish May 21, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

efd6 commented May 18, 2025

Uh oh!

elasticmachine commented May 18, 2025

💚 Build Succeeded

History

Uh oh!

elastic-sonarqube bot commented May 18, 2025

Quality Gate failed

Uh oh!

MakoWish commented Mar 25, 2025 •

edited

Loading

MakoWish May 16, 2025 •

edited

Loading