ssi_some: prevent updating fleet health status to degraded #15415

navnit-elastic · 2025-09-22T07:04:17Z

Proposed commit message

Prevent updating fleet health status to degraded for following packages
when HTTPJSON template value evaluation is empty.

1password
google_scc
m365_defender
rapid7_insightvm

This change bumps minimum Kibana version to 8.19.4 and 9.1.4 and
adds do_not_log_filure: true in set processors to avoid updating
fleet health status to degraded.
This change also fixes the 1password package's system tests.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

Screenshots

elastic-vault-github-plugin-prod · 2025-09-22T07:48:42Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

elasticmachine · 2025-09-22T08:03:12Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

navnit-elastic · 2025-09-22T08:19:18Z

packages/1password/data_stream/audit_events/agent/stream/httpjson.yml.hbs

  - set:
      target: body.cursor
-      value: '[[if not (eq (len .cursor) 0)]][[.cursor.last_cursor]][[end]]'
+      value: >-


@efd6, If the terminate helper evaluates to an empty value, then we don't need to use terminate here, right? Also, I'm not sure about using "do_not_log_failure: true" without "fail_on_template_error: true". Does this scenario prevent changing health status to degraded?

If the terminate helper evaluates to an empty value, then we don't need to use terminate here, right?

That's correct. Note that terminate is an error-free termination of the template expansion, not a termination of the surrounding environment. Using terminate to stop pagination is incorrect.

Also, I'm not sure about using "do_not_log_failure: true" without "fail_on_template_error: true". Does this scenario prevent changing health status to degraded?

It should.

@efd6, Thank you for your answer.

efd6 · 2025-09-22T22:47:04Z

packages/1password/data_stream/audit_events/agent/stream/httpjson.yml.hbs

+        [[if not (eq (len .cursor) 0)]]
+          [[.cursor.last_cursor]]
+        [[else]]
+          [[terminate "cursor is empty"]]
+        [[end]]


We don't need to do this, just fail_on_template_error: true with the do_not_log_failure: true.

(comment applies throughout)

Updated in c9ccf9d. Not enabling fail_on_template_error because the error is expected here.

@efd6 @navnit-elastic , just FYI we have an open SDH on this.

efd6 · 2025-09-22T22:47:35Z

packages/1password/data_stream/audit_events/agent/stream/httpjson.yml.hbs

      value_type: int
-      value: '[[if eq (len .cursor) 0]]{{limit}}[[end]]'
+      value: >-
+        [[if eq (len .cursor) 0]]{{limit}}[[else]][[terminate "cursor is not empty"]][[end]]


Conflicts: packages/google_scc/changelog.yml packages/m365_defender/changelog.yml packages/rapid7_insightvm/changelog.yml

efd6

I've checked locally that this resolves the issue in 1password on 9.1.4 and that the current tip fails on that version of the stack.

I would like the change to be simplified though

diff --git a/packages/1password/data_stream/audit_events/agent/stream/httpjson.yml.hbs b/packages/1password/data_stream/audit_events/agent/stream/httpjson.yml.hbs
index 621af5d15d..1a6101567f 100644
--- a/packages/1password/data_stream/audit_events/agent/stream/httpjson.yml.hbs
+++ b/packages/1password/data_stream/audit_events/agent/stream/httpjson.yml.hbs
@@ -45,7 +45,7 @@ response.split:
 response.pagination:
   - set:
       target: body.cursor
-      value: '[[if eq .last_response.body.has_more true]][[.last_response.body.cursor]][[else]][[/*This is an empty value to stop pagination.*/]][[end]]'
+      value: '[[if eq .last_response.body.has_more true]][[.last_response.body.cursor]][[end]]'
       fail_on_template_error: true
       do_not_log_failure: true
   - delete:
diff --git a/packages/1password/data_stream/item_usages/agent/stream/httpjson.yml.hbs b/packages/1password/data_stream/item_usages/agent/stream/httpjson.yml.hbs
index 36b285bf19..06cb4c0889 100644
--- a/packages/1password/data_stream/item_usages/agent/stream/httpjson.yml.hbs
+++ b/packages/1password/data_stream/item_usages/agent/stream/httpjson.yml.hbs
@@ -46,7 +46,7 @@ response.split:
 response.pagination:
   - set:
       target: body.cursor
-      value: '[[if eq .last_response.body.has_more true]][[.last_response.body.cursor]][[else]][[/*This is an empty value to stop pagination.*/]][[end]]'
+      value: '[[if eq .last_response.body.has_more true]][[.last_response.body.cursor]][[end]]'
       fail_on_template_error: true
       do_not_log_failure: true
   - delete:
diff --git a/packages/1password/data_stream/signin_attempts/agent/stream/httpjson.yml.hbs b/packages/1password/data_stream/signin_attempts/agent/stream/httpjson.yml.hbs
index d12967a150..c5cd14d84d 100644
--- a/packages/1password/data_stream/signin_attempts/agent/stream/httpjson.yml.hbs
+++ b/packages/1password/data_stream/signin_attempts/agent/stream/httpjson.yml.hbs
@@ -46,7 +46,7 @@ response.split:
 response.pagination:
   - set:
       target: body.cursor
-      value: '[[if eq .last_response.body.has_more true]][[.last_response.body.cursor]][[else]][[/*This is an empty value to stop pagination.*/]][[end]]'
+      value: '[[if eq .last_response.body.has_more true]][[.last_response.body.cursor]][[end]]'
       fail_on_template_error: true
       do_not_log_failure: true
   - delete:

The else branch is not needed since in the absence of a true condition we already resolve to the empty string, and the use of the fail_on_template_error option indicates the rationale for the condition.

Similar changes should be applied to the other packages here.

elasticmachine · 2025-09-25T06:29:34Z

💚 Build Succeeded

Buildkite Build
Commit: 61e4ba9

History

💚 Build #31906 succeeded 18ca47a
💔 Build #31903 failed c9ccf9d
💚 Build #31768 succeeded cda5644

cc @navnit-elastic

elastic-sonarqube · 2025-09-25T06:29:39Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

efd6

Thanks

elastic-vault-github-plugin-prod · 2025-09-25T20:55:35Z

Package 1password - 1.34.0 containing this change is available at https://epr.elastic.co/package/1password/1.34.0/

elastic-vault-github-plugin-prod · 2025-09-25T20:55:36Z

Package google_scc - 2.2.0 containing this change is available at https://epr.elastic.co/package/google_scc/2.2.0/

elastic-vault-github-plugin-prod · 2025-09-25T20:55:36Z

Package m365_defender - 4.2.0 containing this change is available at https://epr.elastic.co/package/m365_defender/4.2.0/

elastic-vault-github-plugin-prod · 2025-09-25T20:55:37Z

Package rapid7_insightvm - 2.4.0 containing this change is available at https://epr.elastic.co/package/rapid7_insightvm/2.4.0/

…5415) Prevent updating fleet health status to degraded for following packages when HTTPJSON template value evaluation is empty: * 1password * google_scc * m365_defender * rapid7_insightvm This change bumps minimum Kibana version to 8.19.4 and 9.1.4 and adds do_not_log_filure: true in set processors to avoid updating fleet health status to degraded. This change also fixes the 1password package's system tests.

navnit-elastic added 4 commits September 22, 2025 12:30

handle rapid7_insightvm package

0ae4b1a

handle package google_scc

027aded

handle package m365_defender

e2dfa5f

handle package 1password

378e3eb

navnit-elastic self-assigned this Sep 22, 2025

navnit-elastic added 2 commits September 22, 2025 12:35

Update pr number in changelog.yml

3ee70f0

fix handle 1password package

cda5644

navnit-elastic requested a review from efd6 September 22, 2025 08:03

navnit-elastic marked this pull request as ready for review September 22, 2025 08:03

navnit-elastic requested a review from a team as a code owner September 22, 2025 08:03

brijesh-elastic mentioned this pull request Sep 22, 2025

[LogsDB] [Subscription basic] [google_scc] Failing test daily: system test: (elastic-agent logs - default) in google_scc.finding #14904

Closed

navnit-elastic commented Sep 22, 2025

View reviewed changes

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Sep 22, 2025

kcreddy mentioned this pull request Sep 23, 2025

Added misconfiguration_workflow and vulnerability_workflow to related integrations #15151

Merged

efd6 reviewed Sep 24, 2025

View reviewed changes

navnit-elastic added 2 commits September 24, 2025 12:59

revert use of terminate helper

c9ccf9d

Merge branch 'main' into 14980-degraded_httpjson_input

18ca47a

Conflicts: packages/google_scc/changelog.yml packages/m365_defender/changelog.yml packages/rapid7_insightvm/changelog.yml

efd6 reviewed Sep 24, 2025

View reviewed changes

simplify cursor evaluation logic

61e4ba9

efd6 approved these changes Sep 25, 2025

View reviewed changes

efd6 merged commit e46f81d into elastic:main Sep 25, 2025
9 checks passed

efd6 mentioned this pull request Sep 25, 2025

ssi: too many failing packages in daily job #15472

Open

24 tasks

chemamartinez mentioned this pull request Oct 1, 2025

Fix pagination in 1Password Audit collection #15407

Closed

2 tasks

navnit-elastic mentioned this pull request Nov 12, 2025

[ssi_some]Add support to affected integrations - Avoid updating Fleet health status to degraded when HTTPJSON template value evaluation is empty #14980

Closed

ssi_some: prevent updating fleet health status to degraded #15415

ssi_some: prevent updating fleet health status to degraded #15415

Uh oh!

Conversation

navnit-elastic commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

elastic-vault-github-plugin-prod bot commented Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Uh oh!

elasticmachine commented Sep 22, 2025

Uh oh!

navnit-elastic Sep 22, 2025

Choose a reason for hiding this comment

Uh oh!

efd6 Sep 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

navnit-elastic Sep 24, 2025

Choose a reason for hiding this comment

Uh oh!

efd6 Sep 22, 2025

Choose a reason for hiding this comment

Uh oh!

navnit-elastic Sep 24, 2025

Choose a reason for hiding this comment

Uh oh!

kcreddy Sep 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

efd6 Sep 22, 2025

Choose a reason for hiding this comment

Uh oh!

efd6 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Sep 25, 2025

💚 Build Succeeded

History

Uh oh!

elastic-sonarqube bot commented Sep 25, 2025

Quality Gate passed

Uh oh!

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Sep 25, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Sep 25, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Sep 25, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Sep 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

navnit-elastic commented Sep 22, 2025 •

edited

Loading

elastic-vault-github-plugin-prod bot commented Sep 22, 2025 •

edited

Loading

efd6 Sep 22, 2025 •

edited

Loading

kcreddy Sep 24, 2025 •

edited

Loading

efd6 left a comment •

edited

Loading