github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

Send Endpoint Alert _id field up as insights docs track that on status changes (#116687)

Browse source 
* Send Endpoint Alert _id field up as insights docs track that on status changes

* Added test to make sure top-level underscore-prefixed fields are allowed

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Chris Donaher 2021-10-29 13:47:31 -06:00 • committed by GitHub
parent b59b132ff4
commit 478d138c32
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
x-pack/plugins/security_solution/server/lib/telemetry/filters.test.ts
View file

@ -10,6 +10,7 @@ import { copyAllowlistedFields } from './filters';
describe('Security Telemetry filters', () => {
describe('allowlistEventFields', () => {
const allowlist = {
_id: true,
a: true,
b: true,
c: {
@ -19,12 +20,14 @@ describe('Security Telemetry filters', () => {
it('filters top level', () => {
const event = {
_id: 'id',
a: 'a',
a1: 'a1',
b: 'b',
b1: 'b1',
};
expect(copyAllowlistedFields(allowlist, event)).toStrictEqual({
_id: 'id',
a: 'a',
b: 'b',
});

1
x-pack/plugins/security_solution/server/lib/telemetry/filters.ts
View file

@ -105,6 +105,7 @@ const allowlistBaseEventFields: AllowlistFields = {
// blindly. Object contents means that we only copy the fields that appear explicitly in
// the sub-object.
export const allowlistEventFields: AllowlistFields = {
_id: true,
'@timestamp': true,
agent: true,
Endpoint: true,