[island_browser] Add siem_event Dataset and Deprecate admin_actions and audit - #20908
[island_browser] Add siem_event Dataset and Deprecate admin_actions and audit#20908mohitjha-elastic wants to merge 2 commits into
Conversation
mohitjha-elastic
added
documentation
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
Elastic Docs Style Checker (Vale)Summary: 4 warnings found
|
| File | Line | Rule | Message |
|---|---|---|---|
| packages/island_browser/_dev/build/docs/README.md | 72 | Elastic.MenuArrowsBold | Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy. |
| packages/island_browser/_dev/build/docs/README.md | 72 | Elastic.MenuArrows | Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy. |
| packages/island_browser/_dev/build/docs/README.md | 72 | Elastic.MenuArrows | Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy. |
| packages/island_browser/_dev/build/docs/README.md | 72 | Elastic.MenuArrows | Use '→' to separate menu items, not '' or '='. Example: Select Manage index → Add lifecycle policy. |
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.
f3acafb to
a5c09e7
Compare
|
✅ All changelog entries have the correct PR link. |
![vera-review-bot[bot]](https://avatars.githubusercontent.com/in/3297022?s=60&v=4){kind=small}
| }).do_request().as(post_resp, | ||
| (post_resp.StatusCode == 204 || post_resp.StatusCode == 200) ? | ||
| // Events are only emitted after a successful acknowledgment. | ||
| { |
There was a problem hiding this comment.
Severity: 🟠 High confidence: high path: packages/island_browser/data_stream/siem_event/agent/stream/cel.yml.hbs:85
The SIEM acknowledgement branch returns a fresh state map that omits api_key and audit_id, so after the first batch of events the agent loses its credentials and every later poll fails. Wrap the returned maps in state.with(...) so existing state keys persist.
Details
The Filebeat CEL input sets the next evaluation's state to exactly the value the program returns (minus events); only cursor survives an input restart, and state.url is re-seeded here from resource.url. Any other custom key that is not in the returned map is dropped on the next iteration (confirmed against the Filebeat input-cel docs: "the input will populate the state variable with the return value of the previous execution" and "The state.url field must be present in the returned value to ensure that it is available in the next evaluation").
The outer state.with(...) (line 26) correctly merges the GET result into state, and the idle/no-ack branch returns the full state (line 113), so those paths keep api_key/audit_id. But the two POST (acknowledgement) branches return brand-new object literals: the success branch at lines 85-92 ({ "events": ..., "page_id": null, "audits": null, "want_more": ... }) and the POST-error branch at lines 94-110. Neither includes api_key or audit_id. Because the success branch is the normal path taken whenever count != 0 (i.e., whenever events are actually collected), the very first poll that returns data corrupts the state: on the next evaluation state.audit_id is absent, so the GET URL construction ... + state.audit_id raises a no-such-key error and the Authorization: Bearer + state.api_key header can no longer be built. Collection permanently breaks after the first batch (and again one batch after any restart). The provided system test does not catch this because it only asserts that the first two documents arrive, which happens during the first evaluation before the state is lost.
Recommendation:
Return the acknowledgement branches through state.with(...) so api_key, audit_id and any other state keys are preserved (same as the outer merge and the idle path). Apply the same wrapping to the POST-error branch (lines 94-110).
).do_request().as(post_resp,
(post_resp.StatusCode == 204 || post_resp.StatusCode == 200) ?
// Events are only emitted after a successful acknowledgment.
state.with({
"events": state.audits.split("\n").filter(line, line != "").map(line, {
"message": line,
}),
"page_id": null,
"audits": null,
"want_more": state.want_more,
})
:
state.with({
"events": {
"error": {
"code": string(post_resp.StatusCode),
"id": string(post_resp.Status),
"message": "POST ...",
},
},
"page_id": null,
"audits": null,
"want_more": false,
})
)
🤖 AI-Generated Review | Vera Review Bot - v0.2.7 | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
| } | ||
| ) | ||
| ).as(state, | ||
| has(state.page_id) ? |
There was a problem hiding this comment.
Severity: 🟡 Medium confidence: medium path: packages/island_browser/data_stream/siem_event/agent/stream/cel.yml.hbs:72
has(state.page_id) is true when the empty/error branches set page_id to null (a present-but-null map key), so idle polls enter the ack POST and then run state.audits.split() on a null audits, erroring on every empty poll. Gate the POST on state.page_id != null instead.
Details
The empty-response branch (lines 43-50) and the GET-error branch (lines 53-69) set page_id and audits to null, expecting has(state.page_id) at line 72 to be false so control falls through to state at line 113. In CEL a map key that is explicitly present with a null value still satisfies has() (it tests key presence, not non-nullness), so has(state.page_id) evaluates to true on those branches. The program then takes the POST branch and evaluates state.audits.split("\n") (line 86) with state.audits == null, which has no matching overload and fails the evaluation — meaning every idle poll (count == 0) and every GET error would error instead of quietly retrying. Using an explicit non-null check makes the gate correct regardless of has()/null semantics.
Recommendation:
Gate the acknowledgement POST on an explicit non-null check (or omit page_id entirely in the empty/error branches so the key is absent):
).as(state,
state.page_id != null ?
post_request(
state.url.trim_right("/") + "/services/siem/api/v1/Audits/" + state.audit_id,
"application/json",
{"pageId": state.page_id}.encode_json()
)
// ... unchanged ...
:
state
)
🤖 AI-Generated Review | Vera Review Bot - v0.2.7 | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
|
🟢 No issues across the latest commits a5c09e7. Review summaryIssues found across earlier commits f3acafb — 1 high, 1 medium
🤖 AI-Generated Review | Vera Review Bot - v0.2.7 | 📚 Knowledge base: integration-skills
|
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
|
1 participant
Proposed commit message
Checklist
changelog.ymlfile.How to test this PR locally
Related Issues