[ML] Fixes errors in JSON of SIEM module job configurations #48508
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
peteharverson
added
:ml
Feature:Anomaly Detection
|
Pinging @elastic/ml-ui (:ml) |
💚 Build Succeeded |
💚 Build Succeeded |
XavierM
approved these changes
Oct 17, 2019
walterra
approved these changes
Oct 17, 2019
peteharverson
added a commit
to peteharverson/kibana
that referenced
this pull request
Oct 17, 2019
…48508) * [ML] Fixes errors in JSON of SIEM module job configurations * [ML] Fixes queries in custom URLs for two SIEM jobs
peteharverson
added a commit
to peteharverson/kibana
that referenced
this pull request
Oct 17, 2019
…48508) * [ML] Fixes errors in JSON of SIEM module job configurations * [ML] Fixes queries in custom URLs for two SIEM jobs
💚 Build Succeeded |
peteharverson
added a commit
that referenced
this pull request
Oct 17, 2019
peteharverson
added a commit
that referenced
this pull request
Oct 18, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Fixes errors in the JSON of five of the SIEM module job configration files, introduced in #48123, which was preventing the jobs loading and running correctly.
Also removes the job and datafeed configuration files for the
suspicious_login_activity_ecsjob which had been incorrectly left inside thesiem_auditbeatmodule when that job was moved to the newsiem_auditbeat_authmodule (note this job was had already been removed from themanifest.jsonfile so the job was no longer loaded in thesiem_auditbeatmodule).Plus a fix for the custom URLs for
linux_anomalous_network_port_activity_ecsandwindows_anomalous_user_name_ecs, to ensure the anomalous process / user name is passed in the right format for the query bar on the SIEM dashboard.