Skip to content

google_scc: use dynamic timestamps in finding pubsub mock data - #20815

Merged
kcreddy merged 1 commit into
elastic:mainfrom
kcreddy:google_scc-syst-stream
Aug 20, 2026
Merged

kcreddy merged 1 commit into
elastic:mainfrom
kcreddy:google_scc-syst-stream

Conversation

@kcreddy

@kcreddy kcreddy commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Proposed commit message

google_scc: use dynamic timestamps in finding pubsub mock data

The pubsub system test variant feeds finding.log through `stream log`,
which streamed each line verbatim, so the static eventTime values
(2026-05-20) eventually aged past the latest_cdr_misconfigurations
transform's now-90d window and the transform preview found no documents.

stream v0.25.0 adds a `--template` flag to the log command. Enable it on
the gcppubsub-finding service and replace the static eventTimes with the
same `now -720h` template the httpjson config.yml already uses, so the
findings stay current relative to wall-clock time.

Fixes #20792
Fixes #20791

Note

Test fixture changes. No changelog needed.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

System tests passes.


--- Test results for package: google_scc - START ---
╭────────────┬─────────────┬───────────┬───────────┬────────┬───────────────╮
│ PACKAGE    │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │  TIME ELAPSED │
├────────────┼─────────────┼───────────┼───────────┼────────┼───────────────┤
│ google_scc │ finding     │ system    │ pubsub    │ PASS   │ 38.900429875s │
╰────────────┴─────────────┴───────────┴───────────┴────────┴───────────────╯
--- Test results for package: google_scc - END   ---
Done

Related issues

The pubsub system test variant feeds finding.log through `stream log`,
which streamed each line verbatim, so the static eventTime values
(2026-05-20) eventually aged past the latest_cdr_misconfigurations
transform's now-90d window and the transform preview found no documents.

stream v0.25.0 adds a `--template` flag to the log command. Enable it on
the gcppubsub-finding service and replace the static eventTimes with the
same `now -720h` template the httpjson config.yml already uses, so the
findings stay current relative to wall-clock time.

Fixes elastic#20792
Fixes elastic#20791

@efd6 efd6 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM pending stream v0.25.0 release.

@vera-review-bot

Copy link
Copy Markdown

@kcreddy - 💤 This PR was approved before I picked it up, so I will leave it — automatic reviews are skipped on approved PRs. If you would still like a review, request one with a @vera-review-bot review comment (members and owners only).

@kcreddy

kcreddy commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

/test

@kcreddy
kcreddy marked this pull request as ready for review August 20, 2026 05:56
@kcreddy
kcreddy requested a review from a team as a code owner August 20, 2026 05:56
Copilot AI lite review requested due to automatic review settings August 20, 2026 05:56
@kcreddy
kcreddy requested a review from a team as a code owner August 20, 2026 05:56
@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the google_scc package’s pubsub system-test fixtures so that mocked Finding events always have a recent eventTime, preventing the latest_cdr_misconfigurations transform preview from returning no documents as fixtures age.

Changes:

  • Replaced static eventTime values in the pubsub Finding mock data with a dynamic now - 720h template expression.
  • Updated the gcppubsub-finding docker-compose service to use a newer stream image and enabled template rendering for the log input.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
packages/google_scc/_dev/deploy/docker/files/finding.log Switched mocked findings’ eventTime to a dynamic templated timestamp so fixtures remain within the transform’s time window.
packages/google_scc/_dev/deploy/docker/docker-compose.yml Bumped gcppubsub-finding to stream:v0.25.0 and added --template so the Finding log fixture templates are rendered.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @kcreddy

@mergify

mergify Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@kcreddy
kcreddy merged commit 1a742d7 into elastic:main Aug 20, 2026
9 checks passed
@kcreddy
kcreddy deleted the google_scc-syst-stream branch August 20, 2026 07:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Integration:google_scc Google Security Command Center Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

3 participants