elastic/integrations issues and pull requests

#11345 - [azure_metrics] Enable subobjects: false on azure.resource.tags.*

Pull Request - State: open - Opened by zmoog 29 days ago - 2 comments
Labels: bugfix, Integration:azure_metrics, Team:obs-ds-hosted-services

#11344 - Add related.entity field to azure auditlogs and signinlogs default ingest pipeline

Pull Request - State: open - Opened by orouz 29 days ago - 1 comment
Labels: enhancement, Integration:azure, Team:Obs-InfraObs

#11343 - [azure_metrics]: integration fails ingest metrics when resource tags contain dots in the name

Issue - State: open - Opened by zmoog 29 days ago
Labels: bug, needs:triage, Integration:azure_metrics, Team:obs-ds-hosted-services

#11342 - o365: Add missing `resource.timeout` to CEL input.

Pull Request - State: open - Opened by kcreddy 29 days ago - 3 comments
Labels: Integration:o365, bugfix, Team:Security-Service Integrations

#11341 - [automation] Update packages in .github/ISSUE_TEMPLATE/integration_bug.yml

Pull Request - State: closed - Opened by github-actions[bot] 29 days ago - 1 comment
Labels: automation

#11340 - [Cloud Security] Update Wiz Vuln Mappings

Pull Request - State: open - Opened by CohenIdo 30 days ago - 2 comments
Labels: enhancement, Team:Cloud Security, Integration:wiz, Team:Security-Service Integrations

#11339 - barracuda.waf: Improve access logs parsing

Pull Request - State: open - Opened by kcreddy about 1 month ago - 4 comments
Labels: enhancement, Team:Security-Service Integrations, Integration:barracuda

#11338 - [Akamai] - Add option for a CEL based agent and integrate automatic error recovery.

Issue - State: open - Opened by ShourieG about 1 month ago - 2 comments
Labels: enhancement, Integration:akamai, Team:Security-Service Integrations

#11337 - [Stack 8.16.0-SNAPSHOT] [iptables] Failing test daily: system test: journald in iptables.log

Issue - State: open - Opened by elastic-vault-github-plugin-prod[bot] about 1 month ago
Labels: automation, Integration:iptables, flaky-test, Team:Security-Deployment and Devices

#11336 - [Auditd Manager] Add Session Data option

Pull Request - State: open - Opened by opauloh about 1 month ago - 3 comments
Labels: enhancement, Team:Cloud Security, Integration:auditd_manager, Team:Security-Linux Platform

#11335 - [Exchange Server] message tracking field relatedrecipientaddress incorrect mapping

Issue - State: open - Opened by rugenl about 1 month ago

#11334 - Allow system package to be installed on 9.0.0+ as well

Pull Request - State: open - Opened by ycombinator about 1 month ago - 3 comments
Labels: enhancement, Integration:system, Team:Obs-InfraObs

#11333 - [Cisco_duo] feature request - additional enrichment for access_device

Issue - State: open - Opened by eriroley about 1 month ago - 1 comment
Labels: enhancement, Integration:cisco_duo, Team:Security-Service Integrations

#11332 - Add Filestream integration

Pull Request - State: open - Opened by belimawr about 1 month ago - 1 comment
Labels: New Integration

#11331 - [forgerock]: Logs being pulled for wrong date time range

Issue - State: open - Opened by igrujic-ap about 1 month ago - 1 comment
Labels: needs:triage, Integration:forgerock, Team:Security-Service Integrations

#11330 - [O11y][HAProxy] `haproxy.stat.connection.total` field missing data for the backends or servers

Issue - State: open - Opened by harnish-elastic about 1 month ago
Labels: bug, Integration:haproxy, Team:Obs-InfraObs

#11329 - [integrations][o365] - Added guardrails to various array accessors to prevent out-of-bounds errors and cleaned up some existing code

Pull Request - State: open - Opened by ShourieG about 1 month ago - 7 comments
Labels: integration, Integration:o365, bugfix, Team:Security-Service Integrations

#11328 - [cisco_meraki_metrics] Enhance `Device Health` Dashboard

Issue - State: open - Opened by gpop63 about 1 month ago
Labels: Team:Obs-InfraObs, Integration:cisco_meraki_metrics

#11327 - [Cisco Duo] New data stream for Trust Monitor logs

Pull Request - State: open - Opened by chemamartinez about 1 month ago - 4 comments
Labels: enhancement, dashboard, Integration:cisco_duo, Team:Security-Service Integrations

#11326 - packages/salesforce: preparation for GA release

Pull Request - State: closed - Opened by shmsr about 1 month ago - 3 comments
Labels: enhancement, Team:Obs-InfraObs, Integration:salesforce

#11325 - [ti_mandiant_advantage] Fingerprint the full event

Pull Request - State: closed - Opened by andrewkroh about 1 month ago - 6 comments
Labels: bugfix, Integration:ti_mandiant_advantage, Team:Security-Service Integrations

#11324 - [ti_custom]: 406 Not Acceptable - Integration won't return any indicators

Issue - State: open - Opened by nicpenning about 1 month ago - 4 comments
Labels: needs:triage, Team:Security-Service Integrations, Integration:ti_custom

#11323 - [cisco_meraki_metrics] Update `kibana.version` to `8.15.3` upon release

Issue - State: open - Opened by gpop63 about 1 month ago
Labels: Team:Obs-InfraObs, Integration:cisco_meraki_metrics

#11322 - Fix changelog in network traffic

Pull Request - State: open - Opened by jsoriano about 1 month ago - 4 comments
Labels: Integration:network_traffic, Team:Security-Linux Platform

#11321 - [fortinet_fortigate]: pipeline-error unable to parse URI error.message

Issue - State: open - Opened by zez3 about 1 month ago - 2 comments
Labels: Integration:fortinet_fortigate, Team:Security-Deployment and Devices, mapping/pipeline issue

#11320 - [CyberArk PAS] Add support for monitoring data

Issue - State: open - Opened by jamiehynds about 1 month ago - 2 comments
Labels: enhancement, Integration:cyberarkpas, Team:Security-Service Integrations

#11319 - [Trend Micro Vision One] Add guidance to URL parameter

Issue - State: open - Opened by jamiehynds about 1 month ago - 1 comment
Labels: documentation, enhancement, Integration:trend_micro_vision_one, Team:Security-Service Integrations

#11318 - [vSphere][host] Update sample event

Pull Request - State: open - Opened by lucian-ioan about 1 month ago - 3 comments
Labels: enhancement, Integration:vsphere, Team:Obs-InfraObs

#11317 - slp_all: use triple-brace templating in templates

Pull Request - State: open - Opened by efd6 about 1 month ago - 4 comments
Labels: Integration:network_traffic, Integration:auditd, Integration:sysmon_linux, bugfix, Integration:cloud_defend, Team:Security-Linux Platform, Integration:system_audit

#11316 - swp_all: use triple-brace templating in complex templates

Pull Request - State: closed - Opened by efd6 about 1 month ago - 7 comments
Labels: Integration:microsoft_dhcp, Integration:hid_bravura_monitor, bugfix, Team:Security-Windows Platform, Integration:microsoft_dnsserver

#11315 - sdd_all: use triple-brace templating in complex templates

Pull Request - State: open - Opened by efd6 about 1 month ago - 4 comments
Labels: Integration:sophos, Integration:cef, Integration:zeek, Integration:iptables, Integration:juniper_srx, Integration:checkpoint, Integration:cisco_ise, Integration:modsecurity, Integration:cisco_ios, Integration:cisco_ftd, Integration:pfsense, Integration:cisco_secure_email_gateway, bugfix, Team:Security-Deployment and Devices, Integration:goflow2

#11314 - ssi_all: use triple-brace templating in complex templates

Pull Request - State: closed - Opened by efd6 about 1 month ago - 33 comments
Labels: Integration:symantec_endpoint, Integration:ti_misp, Integration:crowdstrike, Integration:okta, Integration:zoom, Integration:ti_cybersixgill, Integration:ti_abusech, Integration:cisco_umbrella, Integration:cisco_duo, Integration:github, Integration:netskope, Integration:mimecast, Integration:atlassian_jira, Integration:atlassian_bitbucket, Integration:akamai, Integration:slack, Integration:keycloak, Integration:thycotic_ss, Integration:forcepoint_web, bugfix, Integration:ti_maltiverse, Integration:bitdefender, Integration:qualys_vmdr, Team:Security-Service Integrations, Integration:cisa_kevs, Integration:aws_bedrock, Integration:opencanary, Integration:falco, Integration:gigamon, Integration:sysdig, Integration:ti_custom

#11313 - [cloudflare] Add health check to mock service

Pull Request - State: closed - Opened by chrisberkhout about 1 month ago - 4 comments
Labels: Integration:cloudflare, bugfix, Team:Security-Service Integrations

#11310 - [Kubernetest OTEL] Follow up enhancements

Pull Request - State: closed - Opened by tetianakravchenko about 1 month ago - 6 comments
Labels: enhancement, dashboard, Team:Cloudnative-Monitoring, Integration:kubernetes_otel

#11309 - [ti_anomali] Support the ThreatStream API

Pull Request - State: closed - Opened by chrisberkhout about 1 month ago - 7 comments
Labels: enhancement, dashboard, Integration:ti_anomali, Team:Security-Service Integrations

#11308 - Add the security capability to the tychon package

Pull Request - State: closed - Opened by jsoriano about 1 month ago - 6 comments
Labels: bugfix, Integration:tychon, Team:Security-Service Integrations

#11307 - Fix aws release version

Pull Request - State: open - Opened by kaiyan-sheng about 1 month ago - 3 comments
Labels: Integration:aws

#11306 - [Azure Logs] Certain fields are not being extracted

Issue - State: open - Opened by sheridansmall about 1 month ago
Labels: Integration:azure, needs:triage, Team:obs-ds-hosted-services

#11304 - Test branch package-spec#808 - DO NOT MERGE

Pull Request - State: closed - Opened by elastic-vault-github-plugin-prod[bot] about 1 month ago - 3 comments

#11297 - [Mimecast]: Siem loging doens't work anymore with elastic agent 7.17.24

Issue - State: open - Opened by Mschulpen about 1 month ago - 3 comments
Labels: Integration:mimecast, needs:triage, Team:Security-Service Integrations, troubleshooting

#11288 - [corelight] initial release of Corelight

Pull Request - State: open - Opened by sharadcrest about 1 month ago - 1 comment
Labels: New Integration, needs CLA

#11287 - swp_all: use triple-brace templating

Pull Request - State: closed - Opened by efd6 about 1 month ago - 6 comments
Labels: Integration:hid_bravura_monitor, bugfix, Team:Security-Windows Platform, Integration:mysql_enterprise

#11286 - sdd_all: use triple-brace templating

Pull Request - State: closed - Opened by efd6 about 1 month ago - 25 comments
Labels: Integration:sophos, Integration:cef, Integration:suricata, Integration:snort, Integration:juniper_srx, Integration:netflow, Integration:netscout, Integration:bluecoat, Integration:radware, Integration:checkpoint, Integration:cisco_ise, Integration:modsecurity, Integration:pfsense, Integration:citrix_waf, bugfix, Integration:fortinet_fortigate, Team:Security-Deployment and Devices, Integration:juniper_junos, Integration:juniper_netscreen, Integration:fortinet_forticlient, Integration:fortinet_fortiedr, Integration:osquery, Integration:qnap_nas

#11285 - feat: add Nginx Ingress Controller Otel integration

Pull Request - State: open - Opened by rogercoll about 1 month ago - 3 comments
Labels: New Integration

#11282 - crowdstrike: add shims to recover deprecated fields

Pull Request - State: open - Opened by efd6 about 1 month ago - 4 comments
Labels: enhancement, Integration:crowdstrike, Team:Security-Service Integrations

#11281 - Add aws.metrics_names_fingerprint field and mark it as a dimension

Pull Request - State: open - Opened by kaiyan-sheng about 1 month ago - 5 comments
Labels: Integration:aws, Team:Obs-InfraObs, bugfix, Team:Security-Service Integrations, Team:obs-ds-hosted-services

#11276 - [Amazon Security Lake] - OCSF v1.1 and how to move foreword

Issue - State: open - Opened by ShourieG about 1 month ago - 6 comments
Labels: Team:Fleet, discuss, Integration:amazon_security_lake, Team:Security-Service Integrations

#11273 - [Stack 8.16.0-SNAPSHOT] [docker] Failing test daily: system test: default in docker.network

Issue - State: open - Opened by elastic-vault-github-plugin-prod[bot] about 1 month ago
Labels: automation, Integration:docker, flaky-test, Team:Cloudnative-Monitoring

#11271 - [Cloud Security] Updating the CSPM integration with deployment_mode and secrets

Pull Request - State: open - Opened by seanrathier about 1 month ago - 4 comments
Labels: enhancement, Team:Cloud Security, Integration:cloud_security_posture, Team:Security-Service Integrations

#11267 - [Elastic Connectors] Add index name as input var

Pull Request - State: closed - Opened by jedrazb about 1 month ago - 3 comments
Labels: enhancement, Integration:elastic_connectors, Team:Search-Extract and Transform

#11258 - [citrix_adc] Make date/time format configurable

Pull Request - State: open - Opened by jrmolin about 1 month ago - 4 comments
Labels: enhancement, Team:Security-Deployment and Devices, Integration:citrix_adc

#11257 - [cisco_ftd] Fix parsing issues with message IDs 210007, 305013, and 302023

Pull Request - State: open - Opened by taylor-swanson about 1 month ago - 4 comments
Labels: Integration:cisco_ftd, bugfix, Team:Security-Deployment and Devices

#11256 - [AWS] Update integration name to Amazon Bedrock

Pull Request - State: closed - Opened by muthu-mps about 1 month ago - 4 comments
Labels: bugfix

#11255 - [vSphere] Release new integration version.

Pull Request - State: closed - Opened by niraj-elastic about 1 month ago - 4 comments
Labels: enhancement, Integration:vsphere, Team:Obs-InfraObs

#11254 - [Salesforce] Editing for GA

Pull Request - State: open - Opened by alaudazzi about 1 month ago - 3 comments
Labels: documentation, enhancement, Integration:salesforce

#11253 - [POC] Nginx otel integration with OTEL Templates

Pull Request - State: open - Opened by mrodm about 1 month ago - 1 comment

#11252 - [Cloud Security][Cloud Security Posture] Update kibana condition

Pull Request - State: open - Opened by orouz about 1 month ago - 3 comments
Labels: enhancement, Team:Cloud Security, Integration:cloud_security_posture

#11251 - Azure Logs: use one input per agent policy

Issue - State: open - Opened by zmoog about 1 month ago
Labels: enhancement, Integration:azure, Team:obs-ds-hosted-services

#11250 - forgerock: add a specific endpoint emulator for sytem tests

Issue - State: open - Opened by efd6 about 1 month ago - 1 comment
Labels: enhancement, Team:Security-Service Integrations

#11249 - [windows] Windows Defender Data stream overhaul to GA

Pull Request - State: open - Opened by nicpenning about 1 month ago - 5 comments
Labels: Integration:windows, Team:Elastic-Agent-Data-Plane, bugfix, Team:Security-Windows Platform

#11248 - qualys_vmdr: retain event.original as json

Pull Request - State: closed - Opened by efd6 about 1 month ago - 5 comments
Labels: enhancement, Integration:qualys_vmdr, Team:Security-Service Integrations

#11247 - [POC] Deployment mode for CSPM

Pull Request - State: closed - Opened by opauloh about 1 month ago - 1 comment
Labels: Integration:cloud_security_posture

#11246 - [Elastic Agent] Add data retention policy of 30d to all data streams

Pull Request - State: open - Opened by kpollich about 1 month ago - 8 comments
Labels: enhancement, Integration:elastic_agent

#11245 - Cloudtrail add origin and target

Pull Request - State: open - Opened by romulets about 1 month ago - 1 comment
Labels: Integration:aws

#11244 - [AWS Bedrock] Editing for GA

Pull Request - State: open - Opened by alaudazzi about 1 month ago - 5 comments
Labels: documentation, enhancement, Team:Security-Service Integrations, Integration:aws_bedrock

#11243 - [Kubernetes] Fix Overview dashboard Kibana id

Pull Request - State: closed - Opened by tetianakravchenko about 1 month ago - 4 comments
Labels: Integration:kubernetes, dashboard, Team:Cloudnative-Monitoring, bugfix

#11242 - [vSphere] Update README and fix Resourcepool datastream TSDB

Pull Request - State: closed - Opened by kush-elastic about 1 month ago - 5 comments
Labels: enhancement, Integration:vsphere, Team:Obs-InfraObs

#11241 - [Kubernetes]: Overview dashboard id changed

Issue - State: closed - Opened by flash1293 about 1 month ago
Labels: bug, Integration:kubernetes, Team:Cloudnative-Monitoring, needs:triage

#11240 - forgerock: fix handling of query time ranges

Pull Request - State: closed - Opened by efd6 about 1 month ago - 5 comments
Labels: bugfix, Integration:forgerock, Team:Security-Service Integrations

#11239 - Add aws.firehose.arn, aws.firehose.request_id and aws.metrics_names_fingerprint fields

Pull Request - State: open - Opened by kaiyan-sheng about 1 month ago - 9 comments
Labels: Integration:aws, Team:Obs-InfraObs, bugfix, Integration:awsfirehose, Team:Security-Service Integrations, Integration:aws_bedrock, Team:obs-ds-hosted-services

#11238 - [Cloud Security] enable asset inventory package to support agentless

Pull Request - State: open - Opened by Omolola-Akinleye about 1 month ago - 3 comments
Labels: enhancement, Team:Cloud Security, Integration:cloud_asset_inventory

#11237 - [fortinet_fortimanager] Add more ECS fields mappings

Pull Request - State: closed - Opened by aleksmaus about 1 month ago - 11 comments
Labels: enhancement, Team:Security-Deployment and Devices, Integration:fortinet_fortimanager

#11234 - [GitLab] Add sidekiq and pages datastreams

Pull Request - State: open - Opened by tehbooom about 1 month ago - 3 comments
Labels: enhancement, Team:Security-Service Integrations, Integration:gitlab

#11233 - Add related.entity field to azure activitylogs default ingest pipeline

Pull Request - State: open - Opened by orouz about 1 month ago - 4 comments
Labels: enhancement, Integration:azure, Team:Obs-InfraObs

#11232 - [Azure docs] Clarify generic vs specialized integrations

Pull Request - State: closed - Opened by alaudazzi about 1 month ago - 4 comments
Labels: documentation, enhancement, Integration:azure_metrics, Team:obs-ds-hosted-services

#11231 - [ti_*] Fix `labels.is_ioc_transform_source` values

Pull Request - State: closed - Opened by chrisberkhout about 1 month ago - 22 comments
Labels: Integration:ti_misp, dashboard, Integration:ti_cybersixgill, Integration:ti_abusech, Integration:ti_otx, Integration:ti_recordedfuture, Integration:ti_anomali, bugfix, Integration:ti_maltiverse, Integration:ti_threatq, Integration:ti_cif3, Integration:ti_rapid7_threat_command, Integration:ti_opencti, Integration:ti_crowdstrike, Integration:ti_eclecticiq, Team:Security-Service Integrations, Integration:ti_threatconnect, Integration:ti_eset, Integration:ti_custom

#11230 - [vSphere] Filter alerts and warnings from triggered alarms.

Pull Request - State: closed - Opened by niraj-elastic about 1 month ago - 4 comments
Labels: enhancement, Integration:vsphere, Team:Obs-InfraObs

#11229 - [vSphere][network] fix issue with TSDB network name

Pull Request - State: closed - Opened by kush-elastic about 1 month ago - 3 comments
Labels: Integration:vsphere, Team:Obs-InfraObs, bugfix

#11228 - Rename the ingestion-team

Pull Request - State: open - Opened by tutelaris about 1 month ago - 4 comments
Labels: Integration:elastic_connectors

#11227 - [CI] Update find oldest supported script

Pull Request - State: closed - Opened by mrodm about 1 month ago - 3 comments

#11225 - GCP Vertex AI LLM Integration

Pull Request - State: open - Opened by ishleenk17 about 1 month ago - 7 comments
Labels: New Integration

#11224 - [Stack 8.16.0-SNAPSHOT] [cyberarkpas] Failing test daily: system test: tcp in cyberarkpas.audit

Issue - State: open - Opened by elastic-vault-github-plugin-prod[bot] about 1 month ago - 1 comment
Labels: automation, flaky-test, Integration:cyberarkpas, Team:Security-Service Integrations

#11222 - f5_bigip: url decode user agent strings

Pull Request - State: open - Opened by efd6 about 1 month ago - 4 comments
Labels: enhancement, Integration:f5_bigip, Team:Security-Service Integrations

#11221 - carbon_black_cloud: fix timestamp type when using cursor value

Pull Request - State: closed - Opened by efd6 about 1 month ago - 5 comments
Labels: Integration:carbon_black_cloud, bugfix, Team:Security-Service Integrations

#11220 - [forgerock]: agent does not keep time stamp ranges within API requirements

Issue - State: closed - Opened by efd6 about 1 month ago - 2 comments
Labels: bug, Integration:forgerock, Team:Security-Service Integrations

#11219 - forgerock: fix handling of idm_core object payloads

Pull Request - State: open - Opened by efd6 about 1 month ago - 4 comments
Labels: bugfix, Integration:forgerock, Team:Security-Service Integrations

#11217 - Add in technique.name field to the transform. Remove milliseconds from TQL query.

Pull Request - State: open - Opened by GShepherdTC about 1 month ago - 6 comments
Labels: enhancement, Team:Security-Service Integrations, Integration:ti_threatconnect

#11216 - [google_workspace]: Remove link to unpublished security-labs blog from README.

Pull Request - State: closed - Opened by kcreddy about 1 month ago - 7 comments
Labels: documentation, Integration:google_workspace, bugfix, Team:Security-Service Integrations

#11215 - [New Integration] Envoyproxy

Pull Request - State: open - Opened by tehbooom about 1 month ago - 3 comments
Labels: New Integration, Team:Obs-InfraObs

#11214 - GA Security Integrations for Windows platform

Issue - State: open - Opened by intxgo about 1 month ago
Labels: Integration:windows_etw, Integration:microsoft_dnsserver

#11213 - Add condition field to Keycloak log datastream

Pull Request - State: closed - Opened by Alphayeeeet about 1 month ago - 12 comments
Labels: enhancement, Integration:keycloak, Team:Security-Service Integrations

#11210 - Migrate security service packages to GA

Pull Request - State: open - Opened by narph about 1 month ago - 6 comments
Labels: Team:Security-Service Integrations, Team:Security-Deployment and Devices, Integration:teleport, Integration:azure_network_watcher_vnet, Integration:opencanary, Integration:azure_network_watcher_nsg, Integration:watchguard_firebox, Integration:entityanalytics_ad, Integration:bbot, Integration:cybereason, Integration:gitlab, Integration:pps, Integration:symantec_endpoint_security, Integration:proofpoint_on_demand, Integration:prisma_access, Integration:digital_guardian, Integration:abnormal_security, Integration:falco, Integration:authentik, Integration:spycloud, Integration:gigamon, Integration:sublime_security

#11208 - [ti_*] IOC transform destinations incorrectly marked as sources

Issue - State: closed - Opened by chrisberkhout about 1 month ago - 1 comment
Labels: bug, Integration:ti_misp, Integration:ti_cybersixgill, Integration:ti_abusech, Integration:ti_otx, Integration:ti_recordedfuture, Integration:ti_anomali, Integration:ti_maltiverse, Integration:ti_threatq, Integration:ti_cif3, Integration:ti_rapid7_threat_command, Integration:ti_opencti, Integration:ti_mandiant_advantage, Integration:ti_crowdstrike, Integration:ti_eclecticiq, Team:Security-Service Integrations, Integration:ti_threatconnect, Integration:ti_eset, Integration:ti_custom

GitHub / elastic/integrations issues and pull requests