Initial Aruba Documentation #11101
Closed
Initial Aruba Documentation #11101
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
qcorporation
added
the
Team:Security-Deployment and Devices
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
signin_attempts |
6134.97 | 4219.41 | -1915.56 (-31.22%) | 💔 |
Package abnormal_security 👍(1) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
audit |
5154.64 | 4201.68 | -952.96 (-18.49%) | 💔 |
threat |
2785.52 | 1492.54 | -1292.98 (-46.42%) | 💔 |
Package activemq 👍(3) 💚(0) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
8474.58 | 5714.29 | -2760.29 (-32.57%) | 💔 |
topic |
111111.11 | 76923.08 | -34188.03 (-30.77%) | 💔 |
Package apache_tomcat 👍(2) 💚(0) 💔(7)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
access |
2531.65 | 1689.19 | -842.46 (-33.28%) | 💔 |
catalina |
13333.33 | 10638.3 | -2695.03 (-20.21%) | 💔 |
localhost |
25641.03 | 17857.14 | -7783.89 (-30.36%) | 💔 |
memory |
33333.33 | 16393.44 | -16939.89 (-50.82%) | 💔 |
request |
40000 | 25000 | -15000 (-37.5%) | 💔 |
session |
24390.24 | 19607.84 | -4782.4 (-19.61%) | 💔 |
thread_pool |
8403.36 | 6993.01 | -1410.35 (-16.78%) | 💔 |
Package auth0 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
logs |
6578.95 | 3816.79 | -2762.16 (-41.98%) | 💔 |
Package authentik 👍(1) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
group |
4504.5 | 3333.33 | -1171.17 (-26%) | 💔 |
Package aws 👍(10) 💚(6) 💔(3)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
route53_public_logs |
10000 | 8264.46 | -1735.54 (-17.36%) | 💔 |
vpcflow |
8000 | 5747.13 | -2252.87 (-28.16%) | 💔 |
cloudfront_logs |
2415.46 | 1416.43 | -999.03 (-41.36%) | 💔 |
Package azure 👍(6) 💚(2) 💔(3)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
activitylogs |
1607.72 | 1107.42 | -500.3 (-31.12%) | 💔 |
identity_protection |
4739.34 | 3731.34 | -1008 (-21.27%) | 💔 |
platformlogs |
5434.78 | 4385.96 | -1048.82 (-19.3%) | 💔 |
Package azure_frontdoor 👍(0) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
waf |
4149.38 | 3194.89 | -954.49 (-23%) | 💔 |
Package barracuda_cloudgen_firewall 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
11627.91 | 9615.38 | -2012.53 (-17.31%) | 💔 |
Package bitdefender 👍(1) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
push_statistics |
62500 | 38461.54 | -24038.46 (-38.46%) | 💔 |
Package bitwarden 👍(3) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
policy |
8196.72 | 6535.95 | -1660.77 (-20.26%) | 💔 |
Package box_events 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
events |
5405.41 | 3300.33 | -2105.08 (-38.94%) | 💔 |
Package carbon_black_cloud 👍(3) 💚(2) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
watchlist_hit |
3378.38 | 2801.12 | -577.26 (-17.09%) | 💔 |
Package ceph 👍(1) 💚(3) 💔(3)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
cluster_health |
30303.03 | 21739.13 | -8563.9 (-28.26%) | 💔 |
cluster_status |
7462.69 | 5319.15 | -2143.54 (-28.72%) | 💔 |
osd_tree |
25641.03 | 17241.38 | -8399.65 (-32.76%) | 💔 |
Package cisco_duo 👍(0) 💚(3) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
auth |
2057.61 | 1485.88 | -571.73 (-27.79%) | 💔 |
offline_enrollment |
32258.06 | 6329.11 | -25928.95 (-80.38%) | 💔 |
Package cisco_ftd 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
841.75 | 644.75 | -197 (-23.4%) | 💔 |
Package cisco_meraki 👍(1) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
events |
500000 | 333333.33 | -166666.67 (-33.33%) | 💔 |
Package citrix_adc 👍(4) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
system |
6410.26 | 4830.92 | -1579.34 (-24.64%) | 💔 |
Package claroty_ctd 👍(2) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
event |
1394.7 | 1162.79 | -231.91 (-16.63%) | 💔 |
Package cloudflare_logpush 👍(6) 💚(5) 💔(7)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
gateway_network |
7194.24 | 5376.34 | -1817.9 (-25.27%) | 💔 |
sinkhole_http |
6134.97 | 3424.66 | -2710.31 (-44.18%) | 💔 |
spectrum_event |
3984.06 | 3003 | -981.06 (-24.62%) | 💔 |
workers_trace |
9090.91 | 3436.43 | -5654.48 (-62.2%) | 💔 |
dns_firewall |
5747.13 | 4347.83 | -1399.3 (-24.35%) | 💔 |
firewall_event |
3105.59 | 2314.81 | -790.78 (-25.46%) | 💔 |
gateway_dns |
4545.45 | 3846.15 | -699.3 (-15.38%) | 💔 |
Package couchbase 👍(1) 💚(6) 💔(3)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
bucket |
15873.02 | 10526.32 | -5346.7 (-33.68%) | 💔 |
database_stats |
32258.06 | 27027.03 | -5231.03 (-16.22%) | 💔 |
query_index |
9803.92 | 7936.51 | -1867.41 (-19.05%) | 💔 |
Package couchdb 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
server |
4405.29 | 3484.32 | -920.97 (-20.91%) | 💔 |
Package crowdstrike 👍(1) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
alert |
1071.81 | 813.01 | -258.8 (-24.15%) | 💔 |
host |
1818.18 | 1356.85 | -461.33 (-25.37%) | 💔 |
Package cybereason 👍(4) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
poll_malop |
1926.78 | 1557.63 | -369.15 (-19.16%) | 💔 |
Package darktrace 👍(2) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
system_status_alert |
4854.37 | 4000 | -854.37 (-17.6%) | 💔 |
Package eset_protect 👍(1) 💚(0) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
detection |
2409.64 | 1782.53 | -627.11 (-26.03%) | 💔 |
event |
2659.57 | 1845.02 | -814.55 (-30.63%) | 💔 |
Package f5 👍(1) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
bigipafm |
28571.43 | 19607.84 | -8963.59 (-31.37%) | 💔 |
Package forcepoint_web 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
logs |
2518.89 | 1953.13 | -565.76 (-22.46%) | 💔 |
Package forgerock 👍(5) 💚(2) 💔(4)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
am_access |
11235.96 | 8264.46 | -2971.5 (-26.45%) | 💔 |
am_activity |
26315.79 | 20000 | -6315.79 (-24%) | 💔 |
am_authentication |
17241.38 | 11111.11 | -6130.27 (-35.56%) | 💔 |
am_config |
30303.03 | 24390.24 | -5912.79 (-19.51%) | 💔 |
Package gcp 👍(4) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
firewall |
4032.26 | 3184.71 | -847.55 (-21.02%) | 💔 |
Package google_scc 👍(2) 💚(0) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
asset |
1490.31 | 1114.83 | -375.48 (-25.19%) | 💔 |
source |
35714.29 | 21739.13 | -13975.16 (-39.13%) | 💔 |
Package google_workspace 👍(8) 💚(2) 💔(4)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
user_accounts |
13513.51 | 10309.28 | -3204.23 (-23.71%) | 💔 |
context_aware_access |
4291.85 | 3533.57 | -758.28 (-17.67%) | 💔 |
gcp |
7092.2 | 5917.16 | -1175.04 (-16.57%) | 💔 |
groups |
7194.24 | 5000 | -2194.24 (-30.5%) | 💔 |
Package hadoop 👍(2) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
cluster |
5882.35 | 4255.32 | -1627.03 (-27.66%) | 💔 |
namenode |
11235.96 | 7462.69 | -3773.27 (-33.58%) | 💔 |
Package ibmmq 👍(0) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
qmgr |
3717.47 | 2257.34 | -1460.13 (-39.28%) | 💔 |
Package jamf_pro 👍(1) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
inventory |
6289.31 | 5050.51 | -1238.8 (-19.7%) | 💔 |
Package jamf_protect 👍(2) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
telemetry_legacy |
1984.13 | 1510.57 | -473.56 (-23.87%) | 💔 |
web_threat_events |
8547.01 | 5494.51 | -3052.5 (-35.71%) | 💔 |
Package kubernetes 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
container_logs |
200000 | 125000 | -75000 (-37.5%) | 💔 |
Package lastpass 👍(2) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
detailed_shared_folder |
10752.69 | 6410.26 | -4342.43 (-40.38%) | 💔 |
Package m365_defender 👍(3) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
alert |
857.63 | 594.88 | -262.75 (-30.64%) | 💔 |
Package mattermost 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
audit |
2985.07 | 2293.58 | -691.49 (-23.16%) | 💔 |
Package microsoft_dnsserver 👍(1) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
audit |
15873.02 | 6849.32 | -9023.7 (-56.85%) | 💔 |
Package microsoft_exchange_server 👍(2) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
smtp |
62500 | 41666.67 | -20833.33 (-33.33%) | 💔 |
Package mimecast 👍(4) 💚(5) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
archive_search_logs |
10309.28 | 6250 | -4059.28 (-39.38%) | 💔 |
Package modsecurity 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
auditlog |
553.4 | 395.26 | -158.14 (-28.58%) | 💔 |
Package mongodb_atlas 👍(6) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
project |
4651.16 | 2109.7 | -2541.46 (-54.64%) | 💔 |
Package mysql 👍(1) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
slowlog |
25641.03 | 19607.84 | -6033.19 (-23.53%) | 💔 |
Package nagios_xi 👍(0) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
events |
16393.44 | 13888.89 | -2504.55 (-15.28%) | 💔 |
service |
3246.75 | 1937.98 | -1308.77 (-40.31%) | 💔 |
Package netskope 👍(0) 💚(0) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
alerts |
1506.02 | 1180.64 | -325.38 (-21.61%) | 💔 |
events |
2358.49 | 1540.83 | -817.66 (-34.67%) | 💔 |
Package nginx_ingress_controller 👍(1) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
error |
38461.54 | 32258.06 | -6203.48 (-16.13%) | 💔 |
Package pps 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
4975.12 | 3703.7 | -1271.42 (-25.56%) | 💔 |
Package proofpoint_on_demand 👍(1) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
audit |
1872.66 | 1385.04 | -487.62 (-26.04%) | 💔 |
Package pulse_connect_secure 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
3759.4 | 1265.82 | -2493.58 (-66.33%) | 💔 |
Package rabbitmq 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
9090.91 | 4761.9 | -4329.01 (-47.62%) | 💔 |
Package redis 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
8620.69 | 5319.15 | -3301.54 (-38.3%) | 💔 |
Package salesforce 👍(2) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
setupaudittrail |
6289.31 | 4739.34 | -1549.97 (-24.64%) | 💔 |
Package snort 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
17857.14 | 14285.71 | -3571.43 (-20%) | 💔 |
Package snyk 👍(2) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
vulnerabilities |
5434.78 | 3690.04 | -1744.74 (-32.1%) | 💔 |
Package stormshield 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
2272.73 | 1754.39 | -518.34 (-22.81%) | 💔 |
Package sublime_security 👍(1) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
message_event |
6944.44 | 5847.95 | -1096.49 (-15.79%) | 💔 |
Package system 👍(1) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
syslog |
22222.22 | 16666.67 | -5555.55 (-25%) | 💔 |
Package tanium 👍(2) 💚(1) 💔(3)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
discover |
4149.38 | 3267.97 | -881.41 (-21.24%) | 💔 |
endpoint_config |
12820.51 | 5847.95 | -6972.56 (-54.39%) | 💔 |
reporting |
21739.13 | 14925.37 | -6813.76 (-31.34%) | 💔 |
Package thycotic_ss 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
logs |
3367 | 2739.73 | -627.27 (-18.63%) | 💔 |
Package ti_cif3 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
feed |
2985.07 | 1876.17 | -1108.9 (-37.15%) | 💔 |
Package ti_cybersixgill 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
threat |
3086.42 | 1972.39 | -1114.03 (-36.09%) | 💔 |
Package ti_eclecticiq 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
threat |
2577.32 | 2123.14 | -454.18 (-17.62%) | 💔 |
Package ti_eset 👍(3) 💚(1) 💔(3)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
apt |
1730.1 | 1364.26 | -365.84 (-21.15%) | 💔 |
botnet |
9345.79 | 5649.72 | -3696.07 (-39.55%) | 💔 |
cc |
11363.64 | 7142.86 | -4220.78 (-37.14%) | 💔 |
Package ti_rapid7_threat_command 👍(1) 💚(0) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
alert |
4237.29 | 3436.43 | -800.86 (-18.9%) | 💔 |
ioc |
2857.14 | 1934.24 | -922.9 (-32.3%) | 💔 |
Package tomcat 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
76923.08 | 58823.53 | -18099.55 (-23.53%) | 💔 |
Package trendmicro 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
deep_security |
1089.32 | 914.08 | -175.24 (-16.09%) | 💔 |
Package vsphere 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
3676.47 | 3058.1 | -618.37 (-16.82%) | 💔 |
Package windows 👍(6) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
applocker_msi_and_script |
8771.93 | 6250 | -2521.93 (-28.75%) | 💔 |
powershell_operational |
4629.63 | 3184.71 | -1444.92 (-31.21%) | 💔 |
Package wiz 👍(1) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
issue |
3333.33 | 2222.22 | -1111.11 (-33.33%) | 💔 |
vulnerability |
2481.39 | 1904.76 | -576.63 (-23.24%) | 💔 |
Package zeek 👍(24) 💚(11) 💔(8)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
ntp |
52631.58 | 35714.29 | -16917.29 (-32.14%) | 💔 |
signature |
62500 | 20000 | -42500 (-68%) | 💔 |
connection |
31250 | 17857.14 | -13392.86 (-42.86%) | 💔 |
software |
66666.67 | 55555.56 | -11111.11 (-16.67%) | 💔 |
dce_rpc |
21276.6 | 12987.01 | -8289.59 (-38.96%) | 💔 |
traceroute |
30303.03 | 22727.27 | -7575.76 (-25%) | 💔 |
weird |
40000 | 30303.03 | -9696.97 (-24.24%) | 💔 |
x509 |
13333.33 | 10989.01 | -2344.32 (-17.58%) | 💔 |
Package zerofox 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
alerts |
3367 | 2364.07 | -1002.93 (-29.79%) | 💔 |
Package zoom 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
webhook |
3558.72 | 2242.15 | -1316.57 (-37%) | 💔 |
Package zscaler_zia 👍(5) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
sandbox_report |
4166.67 | 3194.89 | -971.78 (-23.32%) | 💔 |
tunnel |
4651.16 | 3745.32 | -905.84 (-19.48%) | 💔 |
Package zscaler_zpa 👍(2) 💚(1) 💔(2)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
app_connector_status |
1996.01 | 1552.8 | -443.21 (-22.2%) | 💔 |
user_status |
6993.01 | 5405.41 | -1587.6 (-22.7%) | 💔 |
To see the full report comment with /test benchmark fullreport
|
Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
gogochan
reviewed
Sep 13, 2024
| multi: false | ||
| required: true | ||
| show_user: true | ||
| default: 514 |
There was a problem hiding this comment.
Would this also be 1470 like TCP?
I'd rather not default to sub-1024 port since this will require root in order to spawn the listener.
There was a problem hiding this comment.
good call on not using < 1024.
There was a problem hiding this comment.
If you take a look, the Aruba instructions at the CLI level for setting up log forward: https://www.arubanetworks.com/techdocs/AOS-CX/AOSCX-CLI-Bank/cli_4100i/Content/Chp_RSyslog/RSyslog_cmds/log-10.htm
The defaults are as follows
udp [<PORT-NUM>] | Range: 1 to 65535. Default: 514
tcp [<PORT-NUM>] | Range: 1 to 65535. Default: 1470
tls [<PORT-NUM>] | Range: 1 to 65535. Default: 6514
Trying to adhere to the same defaults from the Aruba documentation as a convenience for our customers to have ease of setup
packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
dwhyrock
reviewed
Sep 17, 2024
There was a problem hiding this comment.
I mostly have some questions about how this was done, especially about all the fields and how they were created/generated.
Overall it looks like a solid start to the integration.
I'll withhold my approval since it looks like CI isn't quite passing:
-| aruba.vrf.id | | long |
+| aruba.vrf.id | | keyword |
| aruba.vrf.name | | keyword |
Error: checking package failed: checking readme files are up-to-date failed: files do not match
https://buildkite.com/elastic/integrations/builds/16001#0191fffc-07da-4036-903d-c3e19b432020/445-451
| @@ -0,0 +1,3 @@ | |||
| dependencies: | |||
| ecs: | |||
| reference: "git@v8.11.0" | |||
There was a problem hiding this comment.
What's the decision-making process behind picking this version? This looks like the latest one that's been released from https://github.com/elastic/ecs/tags .
How does this part fit into the broader OTel/ECS efforts?
Understandable if you don't want to address this in this PR.
There was a problem hiding this comment.
@dwhyrock good question - it looks like we point to the latest ECS release, which at this point is 8.11.0
In general, our integrations for the foreseeable future will always speak ECS.
In contrast, if we were to pick an older ECS version, then we would not be able to specify fields that are released in a later release. That will limit our 'language' in which we can describe the log message that is coming from the appliance.
| @@ -0,0 +1,809 @@ | |||
| - name: aruba | |||
| type: group | |||
| fields: | |||
There was a problem hiding this comment.
I'm curious how you populated this file. Did you copy another integration's fields.yml and remove the descriptions? Or did you go into the logs and derive which fields we would need to populate?
There was a problem hiding this comment.
see this response for more details
For this file, I auto-generated using prompting into GitHub Copilot after I got the maps down in a file
| multi: false | ||
| required: true | ||
| show_user: true | ||
| default: 514 |
There was a problem hiding this comment.
good call on not using < 1024.
| Note: Field types are defined within `fields.yml` | ||
| Note: Descriptions have not been filled out | ||
|
|
||
| #### [AAA events](https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/events/AAA.htm) |
There was a problem hiding this comment.
Also curious about the workflow here. Was this automated in some way? Or was this as tedious as I am imagining it would be?
There was a problem hiding this comment.
It started manually. I began to look at the field mappings documentation and broke out the aruba events into their categories. I thought that in the future, we would be able to separate the work into these categories and assign each person working on Aruba a category.
As I continued, I knew that this would NOT be scalable, I leverged GitHub copilot by:
created an Aruba fields file
reduced the ecs_flat.yml file to their field values (without the description, type, etc)
and then I asked the GH copilot to map the Aruba fields to their respective ECS fields if it could. That got me 50% of the way, but I had to hand-inspect each field to see if it made sense and rejig the mappings from the LLM if there was a better mapping.
In that process I also asked GH copilot to alphabetize and deduplicate the fields.
Of the fields that didn't have a direct mapping I tried to find if that field was repeated across the event types, e.g. aruba.cat1.vrfid, and aruba.cat2.vrfid, in which case I'd make a common aruba.* field, which can be reused in all the categories.
Moving forward, there can be lots of automation/tooling to help us in this area, it just hasn't been done yet. I have a lot of ideas that can help reduce this work. Have to go through the pain to want to fix it though
💚 Build Succeeded
History
|
|
|
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Change Log
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally