Skip to content

[sysdig] Add support for security event datastream #13626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 8 commits into from
May 27, 2025
Merged

[sysdig] Add support for security event datastream #13626

merged 8 commits into from
May 27, 2025

Conversation

brijesh-elastic
Copy link
Contributor

Proposed commit message

sysdig: add support for security event datastream.

This security events logs provides an overview of your infrastructure,
and allows you to deep-dive into specific security events, distinguish,
false positives, and configure policies to enhance performance.

Sanitized test case inputs were obtained from live Sysdig Secure instance
using the Sysdig Next Gen API.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/sysdig directory.
  • Run the following command to run tests.

elastic-package test

Related issues

Screenshots

Security Event Dashboard

@brijesh-elastic brijesh-elastic added enhancement New feature or request Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:sysdig Sysdig Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Apr 21, 2025
@brijesh-elastic brijesh-elastic self-assigned this Apr 21, 2025
@brijesh-elastic brijesh-elastic requested a review from a team as a code owner April 21, 2025 13:50
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@andrewkroh andrewkroh added the dashboard Relates to a Kibana dashboard bug, enhancement, or modification. label Apr 21, 2025
kcreddy
kcreddy reviewed May 13, 2025
View reviewed changes
efd6
efd6 reviewed May 13, 2025
View reviewed changes
@brijesh-elastic brijesh-elastic requested review from efd6 and kcreddy May 15, 2025 21:02
kcreddy
kcreddy approved these changes May 16, 2025
View reviewed changes
Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Please wait for @efd6 approval.

efd6
efd6 requested changes May 16, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please address

@brijesh-elastic brijesh-elastic requested a review from efd6 May 19, 2025 08:57
efd6
efd6 reviewed May 19, 2025
View reviewed changes
@brijesh-elastic brijesh-elastic requested a review from efd6 May 21, 2025 09:23
@brijesh-elastic brijesh-elastic requested a review from kcreddy May 26, 2025 06:09
@elasticmachine
Copy link

💚 Build Succeeded

History

cc @brijesh-elastic

@elastic-sonarqube Elastic SonarQube
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
93.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

kcreddy
kcreddy approved these changes May 26, 2025
View reviewed changes
Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still LGTM

efd6
efd6 approved these changes May 26, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

@efd6 efd6 merged commit 24424bd into elastic:main May 27, 2025
8 checks passed
@elastic-vault-github-plugin-prod
Copy link

Package sysdig - 0.4.0 containing this change is available at https://epr.elastic.co/package/sysdig/0.4.0/

anupratharamachandran pushed a commit to anupratharamachandran/integrations that referenced this pull request Jun 2, 2025
@brijesh-elastic @anupratharamachandran
[sysdig] Add support for security event datastream (elastic#13626)
679101c 
This security events logs provides an overview of your infrastructure,
and allows you to deep-dive into specific security events, distinguish,
false positives, and configure policies to enhance performance.

Sanitized test case inputs were obtained from live Sysdig Secure instance
using the Sysdig Next Gen API.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kcreddy kcreddy kcreddy approved these changes

@efd6 efd6 efd6 approved these changes

Assignees

@brijesh-elastic brijesh-elastic

Labels
dashboard Relates to a Kibana dashboard bug, enhancement, or modification. enhancement New feature or request Integration:sysdig Sysdig Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Sysdig Secure] New data stream: Runtime Threat Detection
5 participants
@brijesh-elastic @elasticmachine @kcreddy @efd6 @andrewkroh