Skip to content

Commit 42751cb

Browse files
brijesh-elasticbrijesh-elastic
committed
Fix the template evaluation issue and update the system test to correctly match hit counts
1 parent cbbd016 commit 42751cb

File tree

7 files changed

+60
-33
lines changed

7 files changed

+60
-33
lines changed

‎packages/cisco_secure_endpoint/_dev/deploy/docker/files/config.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@ rules:
77
query_params:
88
offset: "1"
99
limit: "1"
10-
start_date: "{start_date:\\d{4}(?:-\\d{2}){2}T(?:\\d{2})(?::\\d{2}){2}\\+00:00}"
10+
start_date: "{start_date:.*}"
1111
responses:
1212
- status_code: 200
1313
headers:
1414
Content-Type:
1515
- application/json
16+
X-Rate-Limit-Remaining:
17+
- 58
1618
body: |-
1719
{
1820
"version": "v1.2.0",
@@ -44,6 +46,8 @@ rules:
4446
headers:
4547
Content-Type:
4648
- application/json
49+
X-Rate-Limit-Remaining:
50+
- 59
4751
body: |-
4852
{
4953
"version": "v1.2.0",

‎packages/cisco_secure_endpoint/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.33.0"
3+
changes:
4+
- description: Prevent updating fleet health status to degraded.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/1
27
- version: "2.32.0"
38
changes:
49
- description: Standardize user fields processing across integrations.

‎packages/cisco_secure_endpoint/data_stream/event/_dev/test/system/test-default-config.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,5 @@ data_stream:
1111
verification_mode: none
1212
limit: "1"
1313
enable_request_tracer: true
14+
assert:
15+
hit_count: 2

‎packages/cisco_secure_endpoint/data_stream/event/agent/stream/httpjson.yml.hbs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ response.split:
3636
response.pagination:
3737
- set:
3838
target: url.value
39-
value: '[[ .last_response.body.metadata.links.next ]]'
39+
value: '[[ if index .last_response.body.metadata.links "next" ]][[ .last_response.body.metadata.links.next ]][[ end ]]'
4040
fail_on_template_error: true
4141
do_not_log_failure: true
4242

‎packages/cisco_secure_endpoint/data_stream/event/sample_event.json‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
{
22
"@timestamp": "2021-01-13T10:13:08.000Z",
33
"agent": {
4-
"ephemeral_id": "5402117c-8965-4c2d-9404-2a1fb6c47431",
5-
"id": "49007565-f0ac-4df0-9672-50a3e25920e8",
6-
"name": "docker-fleet-agent",
4+
"ephemeral_id": "abbb4be9-abee-4a11-96f8-110da8d2017d",
5+
"id": "2954441e-28a7-4c00-a9ff-a00856b2ffcc",
6+
"name": "elastic-agent-95553",
77
"type": "filebeat",
8-
"version": "8.0.0"
8+
"version": "8.19.4"
99
},
1010
"cisco": {
1111
"secure_endpoint": {
@@ -15,7 +15,6 @@
1515
},
1616
"computer": {
1717
"active": true,
18-
"connector_guid": "test_connector_guid",
1918
"external_ip": "8.8.8.8",
2019
"network_addresses": [
2120
{
@@ -32,9 +31,6 @@
3231
"disposition": "Clean"
3332
}
3433
},
35-
"group_guids": [
36-
"test_group_guid"
37-
],
3834
"related": {
3935
"mac": [
4036
"38-1E-EB-BA-2C-15"
@@ -44,16 +40,16 @@
4440
},
4541
"data_stream": {
4642
"dataset": "cisco_secure_endpoint.event",
47-
"namespace": "ep",
43+
"namespace": "97647",
4844
"type": "logs"
4945
},
5046
"ecs": {
5147
"version": "8.11.0"
5248
},
5349
"elastic_agent": {
54-
"id": "49007565-f0ac-4df0-9672-50a3e25920e8",
50+
"id": "2954441e-28a7-4c00-a9ff-a00856b2ffcc",
5551
"snapshot": false,
56-
"version": "8.0.0"
52+
"version": "8.19.4"
5753
},
5854
"event": {
5955
"action": "Cloud IOC",
@@ -62,12 +58,12 @@
6258
"file"
6359
],
6460
"code": "1107296274",
65-
"created": "2023-06-01T09:45:22.836Z",
61+
"created": "2025-11-24T07:32:05.588Z",
6662
"dataset": "cisco_secure_endpoint.event",
6763
"id": "1515298355162029000",
68-
"ingested": "2023-06-01T09:45:23Z",
64+
"ingested": "2025-11-24T07:32:08Z",
6965
"kind": "alert",
70-
"original": "{\"data\":{\"cloud_ioc\":{\"description\":\"Microsoft Word launched PowerShell. This is indicative of multiple dropper variants that make use of Visual Basic Application macros to perform nefarious activities, such as downloading and executing malicious executables.\",\"short_description\":\"W32.WinWord.Powershell\"},\"computer\":{\"active\":true,\"connector_guid\":\"test_connector_guid\",\"external_ip\":\"8.8.8.8\",\"hostname\":\"Demo_AMP\",\"links\":{\"computer\":\"https://api.eu.amp.cisco.com/v1/computers/test_computer\",\"group\":\"https://api.eu.amp.cisco.com/v1/groups/test_group\",\"trajectory\":\"https://api.eu.amp.cisco.com/v1/computers/test_computer/trajectory\"},\"network_addresses\":[{\"ip\":\"10.10.10.10\",\"mac\":\"38:1e:eb:ba:2c:15\"}]},\"connector_guid\":\"test_connector_guid\",\"date\":\"2021-01-13T10:13:08+00:00\",\"event_type\":\"Cloud IOC\",\"event_type_id\":1107296274,\"file\":{\"disposition\":\"Clean\",\"file_name\":\"PowerShell.exe\",\"file_path\":\"/C:/Windows/SysWOW64/WindowsPowerShell/v1.0/PowerShell.exe\",\"identity\":{\"sha256\":\"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7\"},\"parent\":{\"disposition\":\"Clean\",\"identity\":{\"sha256\":\"3d46e95284f93bbb76b3b7e1bf0e1b2d51e8a9411c2b6e649112f22f92de63c2\"}}},\"group_guids\":[\"test_group_guid\"],\"id\":1515298355162029000,\"severity\":\"Medium\",\"start_date\":\"2021-01-13T10:13:08+00:00\",\"start_timestamp\":1610532788,\"timestamp\":1610532788,\"timestamp_nanoseconds\":162019000},\"metadata\":{\"links\":{\"next\":\"http://47c9519daa08:8080/v1/events?start_date=2023-05-31T09:45:22+00:00\\u0026limit=1\\u0026offset=1\",\"self\":\"http://47c9519daa08:8080/v1/events?start_date=2023-05-31T09:45:22+00:00\\u0026limit=1\"},\"results\":{\"current_item_count\":1,\"index\":0,\"items_per_page\":1,\"total\":2}},\"version\":\"v1.2.0\"}",
66+
"original": "{\"data\":{\"cloud_ioc\":{\"description\":\"Microsoft Word launched PowerShell. This is indicative of multiple dropper variants that make use of Visual Basic Application macros to perform nefarious activities, such as downloading and executing malicious executables.\",\"short_description\":\"W32.WinWord.Powershell\"},\"computer\":{\"active\":true,\"connector_guid\":\"test_connector_guid\",\"external_ip\":\"8.8.8.8\",\"hostname\":\"Demo_AMP\",\"links\":{\"computer\":\"https://api.eu.amp.cisco.com/v1/computers/test_computer\",\"group\":\"https://api.eu.amp.cisco.com/v1/groups/test_group\",\"trajectory\":\"https://api.eu.amp.cisco.com/v1/computers/test_computer/trajectory\"},\"network_addresses\":[{\"ip\":\"10.10.10.10\",\"mac\":\"38:1e:eb:ba:2c:15\"}]},\"connector_guid\":\"test_connector_guid\",\"date\":\"2021-01-13T10:13:08+00:00\",\"event_type\":\"Cloud IOC\",\"event_type_id\":1107296274,\"file\":{\"disposition\":\"Clean\",\"file_name\":\"PowerShell.exe\",\"file_path\":\"/C:/Windows/SysWOW64/WindowsPowerShell/v1.0/PowerShell.exe\",\"identity\":{\"sha256\":\"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7\"},\"parent\":{\"disposition\":\"Clean\",\"identity\":{\"sha256\":\"3d46e95284f93bbb76b3b7e1bf0e1b2d51e8a9411c2b6e649112f22f92de63c2\"}}},\"group_guids\":[\"test_group_guid\"],\"id\":1515298355162029000,\"severity\":\"Medium\",\"start_date\":\"2021-01-13T10:13:08+00:00\",\"start_timestamp\":1610532788,\"timestamp\":1610532788,\"timestamp_nanoseconds\":162019000},\"metadata\":{\"links\":{\"next\":\"http://0d71327368e2:8080/v1/events?start_date=2025-11-23T07:32:05+00:00\\u0026limit=1\\u0026offset=1\",\"self\":\"http://0d71327368e2:8080/v1/events?start_date=2025-11-23T07:32:05+00:00\\u0026limit=1\"},\"results\":{\"current_item_count\":1,\"index\":0,\"items_per_page\":1,\"total\":2}},\"version\":\"v1.2.0\"}",
7167
"severity": 2,
7268
"start": "2021-01-13T10:13:08.000Z"
7369
},
@@ -78,8 +74,20 @@
7874
"name": "PowerShell.exe",
7975
"path": "/C:/Windows/SysWOW64/WindowsPowerShell/v1.0/PowerShell.exe"
8076
},
77+
"group": {
78+
"id": [
79+
"test_group_guid"
80+
]
81+
},
8182
"host": {
8283
"hostname": "Demo_AMP",
84+
"id": "test_connector_guid",
85+
"ip": [
86+
"10.10.10.10"
87+
],
88+
"mac": [
89+
"38-1E-EB-BA-2C-15"
90+
],
8391
"name": "demo_amp"
8492
},
8593
"input": {
@@ -107,4 +115,4 @@
107115
"forwarded",
108116
"preserve_original_event"
109117
]
110-
}
118+
}

‎packages/cisco_secure_endpoint/docs/README.md‎

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,11 @@ An example event for `event` looks as following:
1616
{
1717
"@timestamp": "2021-01-13T10:13:08.000Z",
1818
"agent": {
19-
"ephemeral_id": "5402117c-8965-4c2d-9404-2a1fb6c47431",
20-
"id": "49007565-f0ac-4df0-9672-50a3e25920e8",
21-
"name": "docker-fleet-agent",
19+
"ephemeral_id": "abbb4be9-abee-4a11-96f8-110da8d2017d",
20+
"id": "2954441e-28a7-4c00-a9ff-a00856b2ffcc",
21+
"name": "elastic-agent-95553",
2222
"type": "filebeat",
23-
"version": "8.0.0"
23+
"version": "8.19.4"
2424
},
2525
"cisco": {
2626
"secure_endpoint": {
@@ -30,7 +30,6 @@ An example event for `event` looks as following:
3030
},
3131
"computer": {
3232
"active": true,
33-
"connector_guid": "test_connector_guid",
3433
"external_ip": "8.8.8.8",
3534
"network_addresses": [
3635
{
@@ -47,9 +46,6 @@ An example event for `event` looks as following:
4746
"disposition": "Clean"
4847
}
4948
},
50-
"group_guids": [
51-
"test_group_guid"
52-
],
5349
"related": {
5450
"mac": [
5551
"38-1E-EB-BA-2C-15"
@@ -59,16 +55,16 @@ An example event for `event` looks as following:
5955
},
6056
"data_stream": {
6157
"dataset": "cisco_secure_endpoint.event",
62-
"namespace": "ep",
58+
"namespace": "97647",
6359
"type": "logs"
6460
},
6561
"ecs": {
6662
"version": "8.11.0"
6763
},
6864
"elastic_agent": {
69-
"id": "49007565-f0ac-4df0-9672-50a3e25920e8",
65+
"id": "2954441e-28a7-4c00-a9ff-a00856b2ffcc",
7066
"snapshot": false,
71-
"version": "8.0.0"
67+
"version": "8.19.4"
7268
},
7369
"event": {
7470
"action": "Cloud IOC",
@@ -77,12 +73,12 @@ An example event for `event` looks as following:
7773
"file"
7874
],
7975
"code": "1107296274",
80-
"created": "2023-06-01T09:45:22.836Z",
76+
"created": "2025-11-24T07:32:05.588Z",
8177
"dataset": "cisco_secure_endpoint.event",
8278
"id": "1515298355162029000",
83-
"ingested": "2023-06-01T09:45:23Z",
79+
"ingested": "2025-11-24T07:32:08Z",
8480
"kind": "alert",
85-
"original": "{\"data\":{\"cloud_ioc\":{\"description\":\"Microsoft Word launched PowerShell. This is indicative of multiple dropper variants that make use of Visual Basic Application macros to perform nefarious activities, such as downloading and executing malicious executables.\",\"short_description\":\"W32.WinWord.Powershell\"},\"computer\":{\"active\":true,\"connector_guid\":\"test_connector_guid\",\"external_ip\":\"8.8.8.8\",\"hostname\":\"Demo_AMP\",\"links\":{\"computer\":\"https://api.eu.amp.cisco.com/v1/computers/test_computer\",\"group\":\"https://api.eu.amp.cisco.com/v1/groups/test_group\",\"trajectory\":\"https://api.eu.amp.cisco.com/v1/computers/test_computer/trajectory\"},\"network_addresses\":[{\"ip\":\"10.10.10.10\",\"mac\":\"38:1e:eb:ba:2c:15\"}]},\"connector_guid\":\"test_connector_guid\",\"date\":\"2021-01-13T10:13:08+00:00\",\"event_type\":\"Cloud IOC\",\"event_type_id\":1107296274,\"file\":{\"disposition\":\"Clean\",\"file_name\":\"PowerShell.exe\",\"file_path\":\"/C:/Windows/SysWOW64/WindowsPowerShell/v1.0/PowerShell.exe\",\"identity\":{\"sha256\":\"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7\"},\"parent\":{\"disposition\":\"Clean\",\"identity\":{\"sha256\":\"3d46e95284f93bbb76b3b7e1bf0e1b2d51e8a9411c2b6e649112f22f92de63c2\"}}},\"group_guids\":[\"test_group_guid\"],\"id\":1515298355162029000,\"severity\":\"Medium\",\"start_date\":\"2021-01-13T10:13:08+00:00\",\"start_timestamp\":1610532788,\"timestamp\":1610532788,\"timestamp_nanoseconds\":162019000},\"metadata\":{\"links\":{\"next\":\"http://47c9519daa08:8080/v1/events?start_date=2023-05-31T09:45:22+00:00\\u0026limit=1\\u0026offset=1\",\"self\":\"http://47c9519daa08:8080/v1/events?start_date=2023-05-31T09:45:22+00:00\\u0026limit=1\"},\"results\":{\"current_item_count\":1,\"index\":0,\"items_per_page\":1,\"total\":2}},\"version\":\"v1.2.0\"}",
81+
"original": "{\"data\":{\"cloud_ioc\":{\"description\":\"Microsoft Word launched PowerShell. This is indicative of multiple dropper variants that make use of Visual Basic Application macros to perform nefarious activities, such as downloading and executing malicious executables.\",\"short_description\":\"W32.WinWord.Powershell\"},\"computer\":{\"active\":true,\"connector_guid\":\"test_connector_guid\",\"external_ip\":\"8.8.8.8\",\"hostname\":\"Demo_AMP\",\"links\":{\"computer\":\"https://api.eu.amp.cisco.com/v1/computers/test_computer\",\"group\":\"https://api.eu.amp.cisco.com/v1/groups/test_group\",\"trajectory\":\"https://api.eu.amp.cisco.com/v1/computers/test_computer/trajectory\"},\"network_addresses\":[{\"ip\":\"10.10.10.10\",\"mac\":\"38:1e:eb:ba:2c:15\"}]},\"connector_guid\":\"test_connector_guid\",\"date\":\"2021-01-13T10:13:08+00:00\",\"event_type\":\"Cloud IOC\",\"event_type_id\":1107296274,\"file\":{\"disposition\":\"Clean\",\"file_name\":\"PowerShell.exe\",\"file_path\":\"/C:/Windows/SysWOW64/WindowsPowerShell/v1.0/PowerShell.exe\",\"identity\":{\"sha256\":\"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7\"},\"parent\":{\"disposition\":\"Clean\",\"identity\":{\"sha256\":\"3d46e95284f93bbb76b3b7e1bf0e1b2d51e8a9411c2b6e649112f22f92de63c2\"}}},\"group_guids\":[\"test_group_guid\"],\"id\":1515298355162029000,\"severity\":\"Medium\",\"start_date\":\"2021-01-13T10:13:08+00:00\",\"start_timestamp\":1610532788,\"timestamp\":1610532788,\"timestamp_nanoseconds\":162019000},\"metadata\":{\"links\":{\"next\":\"http://0d71327368e2:8080/v1/events?start_date=2025-11-23T07:32:05+00:00\\u0026limit=1\\u0026offset=1\",\"self\":\"http://0d71327368e2:8080/v1/events?start_date=2025-11-23T07:32:05+00:00\\u0026limit=1\"},\"results\":{\"current_item_count\":1,\"index\":0,\"items_per_page\":1,\"total\":2}},\"version\":\"v1.2.0\"}",
8682
"severity": 2,
8783
"start": "2021-01-13T10:13:08.000Z"
8884
},
@@ -93,8 +89,20 @@ An example event for `event` looks as following:
9389
"name": "PowerShell.exe",
9490
"path": "/C:/Windows/SysWOW64/WindowsPowerShell/v1.0/PowerShell.exe"
9591
},
92+
"group": {
93+
"id": [
94+
"test_group_guid"
95+
]
96+
},
9697
"host": {
9798
"hostname": "Demo_AMP",
99+
"id": "test_connector_guid",
100+
"ip": [
101+
"10.10.10.10"
102+
],
103+
"mac": [
104+
"38-1E-EB-BA-2C-15"
105+
],
98106
"name": "demo_amp"
99107
},
100108
"input": {

‎packages/cisco_secure_endpoint/manifest.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
format_version: "3.0.2"
22
name: cisco_secure_endpoint
33
title: Cisco Secure Endpoint
4-
version: "2.32.0"
4+
version: "2.33.0"
55
description: Collect logs from Cisco Secure Endpoint (AMP) with Elastic Agent.
66
type: integration
77
categories:
88
- security
99
- edr_xdr
1010
conditions:
1111
kibana:
12-
version: "^8.15.0 || ^9.0.0"
12+
version: "^8.19.4 || ~9.0.7 || ^9.1.4"
1313
icons:
1414
- src: /img/cisco.svg
1515
title: cisco

0 commit comments

Comments
 (0)