Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Amazon Security Lake] - OCSF v1.1 update with major refactor & adding support for dynamic template and mappings & system tests #10405

Merged
merged 40 commits into from
Oct 23, 2024
Merged

[Amazon Security Lake] - OCSF v1.1 update with major refactor & adding support for dynamic template and mappings & system tests #10405

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
40 commits
Select commit Hold shift + click to select a range
66c9372
added support for new user inventory info event class and updated inc…
ShourieG Jun 7, 2024
fb78670
trying to make a working system test
ShourieG Jun 13, 2024
3902a02
merged with upstream
ShourieG Jun 17, 2024
6bec44b
initial working system tests added pending elastic-package changes to…
ShourieG Jun 21, 2024
64f285b
merged with upstream/main
ShourieG Jul 2, 2024
118b2d2
test commit to be reverted
ShourieG Jul 10, 2024
185e2f9
initial working test for dynamic template
ShourieG Jul 12, 2024
f784e75
updated root org templates
ShourieG Jul 12, 2024
4282225
reworked 'org' object mapping as tynamic template for all data streams
ShourieG Jul 12, 2024
e2f8457
Merge branch 'main' into security_lake/ocsf_1.1
ShourieG Jul 23, 2024
d4788f4
Merge remote-tracking branch 'upstream/main' into security_lake/ocsf_1.1
ShourieG Jul 30, 2024
32ed102
segregated process fields in 'findings', added 'actor' fields for new…
ShourieG Jul 30, 2024
78c1ea2
added fulnerability findings support and segregated 'resource' group …
ShourieG Jul 30, 2024
0656284
Merge remote-tracking branch 'upstream/main' into security_lake/ocsf_1.1
ShourieG Jul 30, 2024
8f7122d
added ntp activity event class, deprecated proxy event class, aded pr…
ShourieG Aug 1, 2024
5352aac
added os patch state event class, segregated device fields across all…
ShourieG Aug 2, 2024
ac66e6e
added datastore activity event class, segregated actor, user & metada…
ShourieG Aug 6, 2024
73b7be8
added support for detection finding event class, segregated and mappe…
ShourieG Aug 6, 2024
1236584
added support of compliance finding event class, segregated and updat…
ShourieG Aug 7, 2024
03b5099
segregated and expanded api object across all data streams, added sup…
ShourieG Aug 7, 2024
e99119c
added support for Device Config State Change event class, updated sch…
ShourieG Aug 8, 2024
7e5f687
added support for scan activity event class
ShourieG Aug 8, 2024
516b63b
segregated file fields across required data streams, added support fo…
ShourieG Aug 8, 2024
bf779a5
added cwe & epss objects as flattened to cve object
ShourieG Aug 8, 2024
97459f5
converted feature object to follow dynamic mapping rules across all d…
ShourieG Aug 8, 2024
bb88d57
added firewall rule object to respective event categories
ShourieG Aug 8, 2024
f0fdc32
added some missing fields after locally running system tests for disc…
ShourieG Aug 9, 2024
0b356dc
reworked terrform deployer to support multi-bucket based system tests
ShourieG Aug 9, 2024
19ffbf7
updated docs and changelog
ShourieG Aug 9, 2024
dd90df2
fixed timestamp issues across all data streams, added all system test…
ShourieG Aug 13, 2024
360c3d8
resolved merge conflicts
ShourieG Aug 14, 2024
2b1250d
resolved merge conflicts
ShourieG Aug 19, 2024
2261431
removed system test configs until respective elastic-package changes …
ShourieG Aug 19, 2024
5794401
updated with main, resolved merge conflicts
ShourieG Aug 26, 2024
6e5bc7c
Merge remote-tracking branch 'upstream/main' into security_lake/ocsf_1.1
ShourieG Aug 29, 2024
c204d18
Merge remote-tracking branch 'upstream/main' into security_lake/ocsf_1.1
ShourieG Oct 21, 2024
14bb1a5
updated docs, optimised timestamp conversion logic and changed *.type…
ShourieG Oct 21, 2024
3ec9e28
changed algorithm_id from integer to keyword type mapping
ShourieG Oct 21, 2024
06209ba
updated state_id mappings from integer to keyword
ShourieG Oct 21, 2024
69b2f19
addressed PR comments and updated pipelines, file names and field map…
ShourieG Oct 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading