github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

Fix issue with incorrect policy response attachment. (#113430)

Browse source 
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Pete Hampton 2021-10-04 22:00:21 +01:00 • committed by GitHub
parent 3efad94646
commit a565fa02f3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
x-pack/plugins/security_solution/server/lib/telemetry/receiver.ts
View file

@ -84,7 +84,7 @@ export class TelemetryReceiver {
policy_responses: {
terms: {
size: this.max_records,
field: 'Endpoint.policy.applied.id',
field: 'agent.id',
},
aggs: {
latest_response: {

9
x-pack/plugins/security_solution/server/lib/telemetry/tasks/endpoint.ts
View file

@ -190,13 +190,11 @@ export class TelemetryEndpointTask {
*
* As the policy id + policy version does not exist on the Endpoint Metrics document
* we need to fetch information about the Fleet Agent and sync the metrics document
* with the Fleet agent's policy data.
* with the Agent's policy data.
*
* 7.14 ~ An issue was created with the Endpoint agent team to add the policy id +
* policy version to the metrics document to circumvent and refactor away from
* this expensive join operation.
*/
const agentsResponse = endpointData.fleetAgentsResponse;
if (agentsResponse === undefined) {
this.logger.debug('no fleet agent information available');
return 0;
@ -286,7 +284,7 @@ export class TelemetryEndpointTask {
policyConfig = endpointPolicyCache.get(policyInformation) || null;
if (policyConfig) {
failedPolicy = policyResponses.get(policyConfig?.id);
failedPolicy = policyResponses.get(endpointAgentId);
}
}
@ -294,7 +292,6 @@ export class TelemetryEndpointTask {
return {
'@timestamp': executeTo,
agent_id: fleetAgentId,
endpoint_id: endpointAgentId,
endpoint_version: endpoint.endpoint_version,
endpoint_package_version: policyConfig?.package?.version || null,