[9.0.1] AMSI API changes for behavior rule alerts - process.Ext.api.parameters.content_name #609
Conversation
magermark
changed the title
magermark
changed the title
There was a problem hiding this comment.
Please add the definitions to the fields (the description, type, flat_name, etc) in custom_schemas (probably custom_schemas/custom_process.yml, but whatever is most relevant).
Then to add those fields to the alert data stream, please edit custom_subsets/elastic_endpoint/alerts/rule_detection_event.yaml to declare where the fields will go.
Then run make to generate the rest of the changes, which should include the change here under schemas.
sample values can be manually placed in package/endpoint/data_stream/alerts/sample_event.json to aid in automated testing for this repo
…d process.Ext.api.parameters.app_name
|
@pzl These fields were previously added by @jdu2600 under process.Ext.api.parameters: process.Ext.api.parameters.app_name: process.Ext.api.parameters.content_name: |
…arameters.content_name (#609) * Entries for process.Ext.api.parameters and process.Ext.api.parameters.content_name * Added process.Ext.api.parameters.app_name * custom_subsets changes for process.Ext.api.parameters.content_name and process.Ext.api.parameters.app_name * Add fields under parameters * testing * Test Windows * Revert Windows change * Revert .bat * Remove test * Remove test_name * Generated changes
…s.content_name (#609) (#626) * Entries for process.Ext.api.parameters and process.Ext.api.parameters.content_name * Added process.Ext.api.parameters.app_name * custom_subsets changes for process.Ext.api.parameters.content_name and process.Ext.api.parameters.app_name * Add fields under parameters * testing * Test Windows * Revert Windows change * Revert .bat * Remove test * Remove test_name * Generated changes Co-authored-by: Mark Mager <42077975+magermark@users.noreply.github.com>
Change Summary
Added new entries to accommodate
process.Ext.api.parameters.content_nameandprocess.Ext.api.parameters.app_namein behavior rule alerts. Entries were ported over from the same entries for AMSI API events: #572Release Target
9.0.1 - Required for upcoming third party testing