Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Netskope] Add support to handle null values in ip field and handle failure in uri_parts processor applied on url #3621

Closed
darshan-elastic opened this issue Jun 29, 2022 · 1 comment · Fixed by #3640
Assignees
Labels
enhancement New feature or request Integration:netskope Netskope

Comments

@darshan-elastic
Copy link
Contributor

darshan-elastic commented Jun 29, 2022

Problem statement:
Netskope events data is getting dropped when ip fields are having null values. When uri_parts processor is applied on url field and url field contains url without protocol in it, then data is getting dropped.

Describe the enhancement:
Data received from newer version of Netskope CLS, it is found that ip field are having null values because of which ip processor applied on that field is getting failed and so data is getting dropped. So there is a need to handle null values when received for the field source.ip, destination.ip and user.ip. There is a need to handle the failure in uri_parts processor when url field contains url without protocol in it.

@darshan-elastic darshan-elastic self-assigned this Jun 29, 2022
@darshan-elastic darshan-elastic added enhancement New feature or request Integration:netskope Netskope labels Jun 29, 2022
@darshan-elastic darshan-elastic changed the title [Netskope] Add support to handle null values in ip field when received from Netskope CLS [Netskope] Add support to handle null values in ip field and handle failure in uri_parts processor applied on url Jun 29, 2022
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

andrewkroh pushed a commit that referenced this issue Jul 19, 2022
This commit adds support of handling null values in ip fields and failure in uri_parts processor.

Fixes #3621

* Updated *.url fields from flattened to specific fields
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request Integration:netskope Netskope
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants