Add vulnerability management integration #5266

amirbenun · 2023-02-14T04:48:55Z

What does this PR do?

Add a new cloud security policy template for vulnerability management that will form as a new integration
Resolves #5328

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

[ ]

How to test this PR locally

Related issues

Screenshots

elasticmachine · 2023-02-14T05:07:10Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-02-23T10:48:54.908+0000
Duration: 14 min 9 sec

Test stats 🧪

Test	Results
Failed	0
Passed	4
Skipped	0
Total	4

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

opauloh · 2023-02-14T19:38:19Z

Hi @amirbenun,

Here's the icon for vulnerability management in case you want to include it in your PR

SVG

<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none" viewBox="0 0 32 32">
  <path fill="#00BFB3" fill-rule="evenodd" d="M11.05 2.086 6.808 6.329 16 15.52l9.192-9.192-4.242-4.243L16 7.036l-4.95-4.95Z" clip-rule="evenodd"/>
  <path fill="#FA744E" d="M4.686 19.764a8 8 0 0 1 0-11.314L16 19.764v11.313L4.686 19.763Z"/>
  <path fill="#343741" d="M27.314 8.45a8 8 0 0 1 0 11.314L16 31.077V19.763L27.314 8.45Z"/>
</svg>

File (to add to packages/cloud_security_posture/img/logo_vuln_mgnt.svg)

Suggested changes to add to manifest.yaml

    icons:
      - src: /img/logo_vuln_mgnt.svg
        title: Vulnerability Management logo
        size: 32x32
        type: image/svg+xml

...cloud_security_posture/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml

packages/cloud_security_posture/data_stream/vulnerabilities/fields/ecs.yml

packages/cloud_security_posture/data_stream/vulnerabilities/manifest.yml

packages/cloud_security_posture/manifest.yml

packages/cloud_security_posture/changelog.yml

packages/cloud_security_posture/manifest.yml

elasticmachine · 2023-02-20T14:11:01Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`0/0`)	💚
Files	100.0% (`0/0`)	💚
Classes	100.0% (`0/0`)	💚
Methods	25.0% (`2/8`)	👎 -40.753
Lines	100.0% (`0/0`)	💚 0.465
Conditionals	100.0% (`0/0`)	💚

amirbenun · 2023-02-22T09:44:39Z

kfirpeled

LGTM

oren-zohar · 2023-02-22T11:14:50Z

...cloud_security_posture/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml

+processors:
+- set:
+    field: ecs.version
+    value: '8.6.0'


shouldn't it be the same version as the ELK version?

Honestly, I copied it from the findings data-stream. @kfirpeled what is the reason it points to 8.6?

Because that is the ECS version we support, it is defined here: https://github.com/elastic/integrations/blob/main/packages/cloud_security_posture/_dev/build/build.yml

packages/cloud_security_posture/data_stream/vulnerabilities/fields/cloudbeat.yml

packages/cloud_security_posture/data_stream/vulnerabilities/manifest.yml

packages/cloud_security_posture/manifest.yml

oren-zohar · 2023-02-22T15:49:14Z

packages/cloud_security_posture/data_stream/findings/fields/cloudbeat.yml

      type: date
      description: The commit time of the Cloudbeat.
      default_field: false
-    - name: kubernetes.version


removed from the wrong place?

oren-zohar · 2023-02-22T16:00:39Z

packages/cloud_security_posture/manifest.yml

+    title: Vulnerability Management
+    description: Scan for cloud resources vulnerabilities
+    categories:
+      - Vulnerability Management


Suggested change

- Vulnerability Management

- vulnerability_management

It looks like Credential Management is credential_management here (for reference categories.yml)

I think the CI didn't like that in any case

Should work based on the latest version of the package-registry

oren-zohar · 2023-02-23T09:27:50Z

Hey @mrodm the CI fails on the new vulnerability_management category, wasn't that suppose to be supported in the latest release? are we missing something here?

[2023-02-22T18:24:16.518Z]    1. file "/var/lib/jenkins/workspace/est-manager_integrations_PR-5266/src/github.com/elastic/integrations/packages/cloud_security_posture/manifest.yml" is invalid: field policy_templates.2.categories.0: policy_templates.2.categories.0 must be one of the following: "analytics_engine", "application_observability", "app_search", "auditd", "authentication", "aws", "azure", "big_data", "cdn_security", "cloud", "config_management", "connector", "connector_client", "connector_package", "containers", "content_source", "crawler", "credential_management", "crm", "custom", "custom_logs", "database_security", "datastore", "dns_security", "edr_xdr", "elasticsearch_sdk", "elastic_stack", "email_security", "enterprise_search", "firewall_security", "google_cloud", "iam", "ids_ips", "infrastructure", "java_observability", "kubernetes", "language_client", "languages", "load_balancer", "message_queue", "monitoring", "monitoring_infrastructure", "native_search", "network", "network_security", "notification", "observability", "os_system", "process_manager", "productivity", "productivity_security", "proxy_security", "sdk_search", "security", "stream_processing", "support", "threat_intel", "ticketing", "version_control", "virtualization", "vpn_security", "web", "web_application_firewall", "websphere", "workplace_search"

mrodm · 2023-02-23T12:09:28Z

Hey @mrodm the CI fails on the new vulnerability_management category, wasn't that suppose to be supported in the latest release? are we missing something here?

Checking the elastic-package version used (v0.74.0) here in the integrations repository, it does not contain the needed package-spec version (v2.5.1) that includes that new category.

A new release v0.75.0 has been created, once this version is updated in the integrations repository that category could be added in the packages.

elasticmachine · 2023-04-18T20:57:50Z

Package cloud_security_posture - 1.3.0-preview4 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

elasticmachine · 2023-04-19T23:04:40Z

Package cloud_security_posture - 1.3.0-preview5 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

elasticmachine · 2023-04-21T08:06:32Z

Package cloud_security_posture - 1.3.0-preview6 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

elasticmachine · 2023-04-27T19:35:29Z

Package cloud_security_posture - 1.3.0-preview7 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

elasticmachine · 2023-05-04T07:11:26Z

Package cloud_security_posture - 1.3.0-preview8 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

elasticmachine · 2023-05-07T16:08:22Z

Package cloud_security_posture - 1.3.0-preview9 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

elasticmachine · 2023-05-10T07:10:19Z

Package cloud_security_posture - 1.3.0-preview10 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

elasticmachine · 2023-05-10T23:39:56Z

Package cloud_security_posture - 1.3.0-preview91 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

elasticmachine · 2023-05-25T01:56:13Z

Package cloud_security_posture - 1.3.0 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

elasticmachine · 2023-07-09T08:01:37Z

Package cloud_security_posture - 1.3.1 containing this change is available at https://epr.elastic.co/search?package=cloud_security_posture

first commit

671d91c

amirbenun added the enhancement New feature or request label Feb 14, 2023

amirbenun requested a review from a team as a code owner February 14, 2023 04:48

amirbenun marked this pull request as draft February 14, 2023 04:49

Merge branch 'main' into add_vuln_mgmt

9a34ef5

kfirpeled reviewed Feb 14, 2023

View reviewed changes

amirbenun added 6 commits February 20, 2023 13:43

add vm logo

0ecd61d

Merge branch 'main' into add_vuln_mgmt

c67352a

vuln_mgmt

96fef9b

pipeline

8343af2

update ecs fields

2d14da7

typo

2821495

kfirpeled reviewed Feb 20, 2023

View reviewed changes

packages/cloud_security_posture/changelog.yml Outdated Show resolved Hide resolved

kfirpeled reviewed Feb 20, 2023

View reviewed changes

packages/cloud_security_posture/manifest.yml Show resolved Hide resolved

amirbenun added 2 commits February 20, 2023 19:23

Merge branch 'main' into add_vuln_mgmt

67c1cc9

1.3.0-preview

094223f

amirbenun added 3 commits February 20, 2023 20:17

add hbs

b52a0d0

dep

3106ec0

default region

359c182

amirbenun marked this pull request as ready for review February 22, 2023 09:44

kfirpeled approved these changes Feb 22, 2023

View reviewed changes

oren-zohar requested changes Feb 22, 2023

View reviewed changes

amirbenun added 2 commits February 22, 2023 20:30

cr

14d3150

Merge branch 'main' into add_vuln_mgmt

45d4158

amirbenun force-pushed the add_vuln_mgmt branch from bb11a46 to 45d4158 Compare February 22, 2023 15:02

remove k8s field

fa8960c

oren-zohar requested changes Feb 22, 2023

View reviewed changes

cr

9b50b2b

amirbenun added 2 commits February 23, 2023 15:09

remove cat

fa178ee

Merge branch 'main' into add_vuln_mgmt

66c9352

oren-zohar approved these changes Feb 23, 2023

View reviewed changes

amirbenun merged commit 0afe6ab into elastic:main Feb 23, 2023

amirbenun deleted the add_vuln_mgmt branch February 23, 2023 11:04

agithomas pushed a commit to agithomas/integrations that referenced this pull request Mar 20, 2023

Add vulnerability management integration (elastic#5266)

8dfbd60

agithomas pushed a commit to agithomas/integrations that referenced this pull request Mar 21, 2023

Add vulnerability management integration (elastic#5266)

4e08bb1

kfirpeled added the Team:Cloud Security Cloud Security team [elastic/cloud-security-posture] label Jun 26, 2023

Add vulnerability management integration #5266

Add vulnerability management integration #5266

Uh oh!

Conversation

amirbenun commented Feb 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

elasticmachine commented Feb 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

Uh oh!

opauloh commented Feb 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌐 Coverage report

Uh oh!

amirbenun commented Feb 22, 2023

Uh oh!

kfirpeled left a comment

Choose a reason for hiding this comment

Uh oh!

oren-zohar Feb 22, 2023

Choose a reason for hiding this comment

Uh oh!

amirbenun Feb 22, 2023

Choose a reason for hiding this comment

Uh oh!

kfirpeled Feb 23, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

oren-zohar Feb 22, 2023

Choose a reason for hiding this comment

Uh oh!

oren-zohar Feb 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

oren-zohar Feb 22, 2023

Choose a reason for hiding this comment

Uh oh!

oren-zohar Feb 22, 2023

Choose a reason for hiding this comment

Uh oh!

oren-zohar commented Feb 23, 2023

Uh oh!

mrodm commented Feb 23, 2023

Uh oh!

elasticmachine commented Apr 18, 2023

Uh oh!

elasticmachine commented Apr 19, 2023

Uh oh!

elasticmachine commented Apr 21, 2023

Uh oh!

elasticmachine commented Apr 27, 2023

Uh oh!

elasticmachine commented May 4, 2023

Uh oh!

elasticmachine commented May 7, 2023

Uh oh!

elasticmachine commented May 10, 2023

amirbenun commented Feb 14, 2023 •

edited

Loading

elasticmachine commented Feb 14, 2023 •

edited

Loading

opauloh commented Feb 14, 2023 •

edited

Loading

elasticmachine commented Feb 20, 2023 •

edited

Loading

oren-zohar Feb 22, 2023 •

edited

Loading