Fix missing event.action in S1 Network Events (#12285)

* [Enhancement] Fix missing `event.action` in S1 Network Events * Update packages/sentinel_one_cloud_funnel/changelog.yml
elastic · Jan 10, 2025 · c23b5a8 · c23b5a8
1 parent e6fa34e
commit c23b5a8
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 3 deletions.
diff --git a/packages/sentinel_one_cloud_funnel/changelog.yml b/packages/sentinel_one_cloud_funnel/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.8.1"
+  changes:
+    - description: Fix missing event.action in network events.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/12285
 - version: "1.8.0"
   changes:
     - description: Add support for Access Point ARN when collecting logs via the AWS S3 Bucket.

diff --git a/...e_cloud_funnel/data_stream/event/_dev/test/pipeline/test-network-action.log-expected.json b/...e_cloud_funnel/data_stream/event/_dev/test/pipeline/test-network-action.log-expected.json
@@ -11,6 +11,9 @@
                 "version": "8.11.0"
             },
             "event": {
+                "action": [
+                    "connection_attempted"
+                ],
                 "category": [
                     "network"
                 ],

diff --git a/..._cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-network-action.yml b/..._cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-network-action.yml
@@ -12,12 +12,12 @@ processors:
       field: event.action
       value: [connection_attempted]
       if: (ctx.sentinel_one_cloud_funnel?.event?.type == 'IPConnect' || ctx.sentinel_one_cloud_funnel?.event?.type == 'IP Connect') &&
-          ctx.sentinel_one_cloud_funnel?.event?.network?.direction == "OUTGOING"
+          ctx.json.event?.network?.direction == "OUTGOING"
   - set:
       field: event.action
       value: [connection_accepted]
       if: (ctx.sentinel_one_cloud_funnel?.event?.type == 'IPConnect' || ctx.sentinel_one_cloud_funnel?.event?.type == 'IP Connect') &&
-          ctx.sentinel_one_cloud_funnel?.event?.network?.direction == "INCOMING"
+          ctx.json.event?.network?.direction == "INCOMING"
   - rename:
       field: json.k8sCluster.containerId
       target_field: sentinel_one_cloud_funnel.event.k8s_cluster.container.id

diff --git a/packages/sentinel_one_cloud_funnel/manifest.yml b/packages/sentinel_one_cloud_funnel/manifest.yml
@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: sentinel_one_cloud_funnel
 title: SentinelOne Cloud Funnel
-version: "1.8.0"
+version: "1.8.1"
 description: Collect logs from SentinelOne Cloud Funnel with Elastic Agent.
 type: integration
 categories: ["security", "edr_xdr"]