Repository navigation
google_scc: use dynamic timestamps in finding pubsub mock data - #20815
Conversation
The pubsub system test variant feeds finding.log through `stream log`, which streamed each line verbatim, so the static eventTime values (2026-05-20) eventually aged past the latest_cdr_misconfigurations transform's now-90d window and the transform preview found no documents. stream v0.25.0 adds a `--template` flag to the log command. Enable it on the gcppubsub-finding service and replace the static eventTimes with the same `now -720h` template the httpjson config.yml already uses, so the findings stay current relative to wall-clock time. Fixes elastic#20792 Fixes elastic#20791
efd6
left a comment
There was a problem hiding this comment.
LGTM pending stream v0.25.0 release.
|
@kcreddy - 💤 This PR was approved before I picked it up, so I will leave it — automatic reviews are skipped on approved PRs. If you would still like a review, request one with a |
|
/test |
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
There was a problem hiding this comment.
Pull request overview
This PR updates the google_scc package’s pubsub system-test fixtures so that mocked Finding events always have a recent eventTime, preventing the latest_cdr_misconfigurations transform preview from returning no documents as fixtures age.
Changes:
- Replaced static
eventTimevalues in the pubsub Finding mock data with a dynamicnow - 720htemplate expression. - Updated the
gcppubsub-findingdocker-compose service to use a newerstreamimage and enabled template rendering for the log input.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| packages/google_scc/_dev/deploy/docker/files/finding.log | Switched mocked findings’ eventTime to a dynamic templated timestamp so fixtures remain within the transform’s time window. |
| packages/google_scc/_dev/deploy/docker/docker-compose.yml | Bumped gcppubsub-finding to stream:v0.25.0 and added --template so the Finding log fixture templates are rendered. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
💚 Build Succeeded
History
cc @kcreddy |
|
Tick the box to add this pull request to the merge queue (same as
|
Proposed commit message
Note
Test fixture changes. No changelog needed.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
System tests passes.
Related issues