Skip to content

[aws] Update inspector data stream for Cloud Detection and Response (CDR) workflow #14306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brijesh-elastic merged 19 commits into from
Jul 15, 2025
Merged

[aws] Update inspector data stream for Cloud Detection and Response (CDR) workflow #14306

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
9ff387c
Update inspector datastream to support Cloud Detection and Response (…
brijesh-elastic Jun 24, 2025
bbd4c37
Update changelog entry
brijesh-elastic Jun 24, 2025
671472d
address pr comment
brijesh-elastic Jun 26, 2025
34a8fd6
Populate resource.name and host.name when tags[].Name present
brijesh-elastic Jun 27, 2025
b9b2494
Merge branch 'main' into aws-4.0.0
brijesh-elastic Jun 27, 2025
729c0ce
Merge branch 'main' into aws-4.0.0
brijesh-elastic Jul 2, 2025
75cb248
update null reference condition in scripts
brijesh-elastic Jul 2, 2025
34fca8d
address pr comment
brijesh-elastic Jul 3, 2025
91bc1d0
Merge branch 'main' into aws-4.0.0
brijesh-elastic Jul 7, 2025
29880df
Merge branch 'main' into aws-4.0.0
brijesh-elastic Jul 8, 2025
70439b2
Update the kibana constraint to support ^8.19.0 || ^9.1.0
brijesh-elastic Jul 8, 2025
31c5699
update kibana constraints
brijesh-elastic Jul 9, 2025
4c117c1
Merge branch 'main' into aws-4.0.0
brijesh-elastic Jul 9, 2025
ec76fc1
address pr comments and skip the guardduty system test to pass the ci
brijesh-elastic Jul 10, 2025
740956b
Merge branch 'main' into aws-4.0.0
brijesh-elastic Jul 11, 2025
66c196a
remove changelog entry related to kibana constraint
brijesh-elastic Jul 14, 2025
c2747fc
Remove transform
brijesh-elastic Jul 15, 2025
79e53bf
Update changelog description & type
brijesh-elastic Jul 15, 2025
b888df3
Address PR comment
brijesh-elastic Jul 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update the kibana constraint to support ^8.19.0 || ^9.1.0
  • Loading branch information
@brijesh-elastic
brijesh-elastic committed Jul 8, 2025
commit 70439b262270834172185c6270971b8ac1d63908
3 changes: 3 additions & 0 deletions packages/aws/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@
- description: Enable request trace log removal.
type: enhancement
link: https://github.com/elastic/integrations/pull/14306

@ishleenk17 ishleenk17 Jul 15, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are we having same PR numbers and different descriptions ? Can't we combine these ?

- description: Update the kibana constraint to support ^8.19.0 || ^9.1.0
type: enhancement
link: https://github.com/elastic/integrations/pull/14306

@efd6 efd6 Jul 14, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is needed, and as it exists is misleading. The text here says (suggests?) that we are adding support for 8.19.0 and 9.1.0, but this is not what we are doing, we are restricting to these. I would instead suggest that this be removed since the behaviour is already implicitly documented by the integrations addition page for users who care about this.

- description: Remove metadata fields added by the Agentless policy.
type: bugfix
link: https://github.com/elastic/integrations/pull/14306
Expand Down
2 changes: 1 addition & 1 deletion packages/aws/manifest.yml
View file
Open in desktop

@kcreddy kcreddy Jun 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@maxcold, current kibana version constraint is following:

kibana:
    version: "~8.16.6 || ~8.17.4 || ^8.18.0 || ^9.0.0"

In Inspector, we don't have missing CVE values for package vulnerabilities. Also, it is not an array and always contain single values. For example: vulnerability.id: CVE-2025-38000

Do we still need to bump the minimum versions here? Related to multiple/empty CVEs: #14079 (comment)

@maxcold maxcold Jun 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kcreddy thanks for highlighting it! I need to test the integration with 8.18 and 9.0 to check that. Right now I'm testing with the latest 9.1 snapshot, will play with 8.18/9.0 version later

@maxcold maxcold Jun 25, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When testing 8.18 I realised that we don't support multiple packages in this version and also have some other rough edges. I think we will need to bump to ^8.19.0 || ^9.1.0" but let's wait for product feedback as well

@kcreddy kcreddy Jun 26, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws integration has shared ownership. If we are completely removing support for 8.17 and 8.18, we need everyone's approval on this.
Is it possible to backport this support multiple packages to 8.17.9 and 8.18.4?

@kcreddy kcreddy Jul 1, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @nick-alayil

@kcreddy kcreddy Jul 8, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@brijesh-elastic, please update the versions to: ^8.19.0 || ^9.1.0 similar to Tenable and Rapid7.

cc: @maxcold

Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ conditions:
elastic:
subscription: basic
kibana:
version: "~8.16.6 || ~8.17.4 || ^8.18.0 || ^9.0.0"
version: "~8.16.6 || ~8.17.4 || ^8.19.0 || ^9.1.0"

@maxcold maxcold Jul 9, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@brijesh-elastic @kcreddy as discussed this should be just ^8.19.0 || ^9.1.0, support for 8.16.x and 8.17.x will need to be removed with the adaptation of CDR transform

@kcreddy kcreddy Jul 16, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After another discussion, the version constraints and the transform changes will be part of another PR and merged close to 9.2.0 release.

screenshots:
- src: /img/metricbeat-aws-overview.png
title: metricbeat aws overview
Expand Down