Skip to content

Update influencer fields of Security ML integrations#20335

Open
sodhikirti07 wants to merge 3 commits into
mainfrom
update-influencer-fields-ml-integrations
Open

Update influencer fields of Security ML integrations#20335
sodhikirti07 wants to merge 3 commits into
mainfrom
update-influencer-fields-ml-integrations

Conversation

@sodhikirti07

@sodhikirti07 sodhikirti07 commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

  • Add and update influencers to ML jobs for DED, LMD, DGA and ProblemChild.
  • Update the source index of PAD windows transform to allow supported integration index only

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Using ITP

Related issues

Screenshots

@sodhikirti07 sodhikirti07 added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:lmd Lateral Movement Detection Integration:ded Data Exfiltration Detection Integration:dga Domain Generation Algorithm Detection Integration:problemchild Living off the Land Attack Detection Team:Security-Applied ML Elastic Security Protections Machine Learning (ML) team [elastic/sec-applied-ml] Integration:pad Privileged Access Detection labels Jul 23, 2026
@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@sodhikirti07
sodhikirti07 marked this pull request as ready for review July 23, 2026 15:24
@sodhikirti07
sodhikirti07 requested review from a team as code owners July 23, 2026 15:24
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 23, 2026

Copy link
Copy Markdown

Pinging @elastic/sec-applied-ml (Team:Security-Applied ML)

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 23, 2026

Copy link
Copy Markdown

💚 Build Succeeded

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Security-ML Integrations Test Pipeline — Integrations CI (run #5)

🟢 All packages passed

Package Stack version Result
ded 9.4.4 🟢
dga 9.4.4 🟢
lmd 9.4.4 🟢
pad 9.4.4 🟢
problemchild 9.4.4 🟢

@jmcarlock
jmcarlock self-requested a review July 23, 2026 19:49
jmcarlock
jmcarlock reviewed Jul 24, 2026
View reviewed changes
Comment thread packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml
field: user.id
script:
source: "return doc.containsKey('user.name') && !doc['user.name'].isEmpty() ? doc['user.name'].value : ''"
lang: painless

@jmcarlock jmcarlock Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we use missing_bucket: true for these instead?

jmcarlock
jmcarlock reviewed Jul 24, 2026
View reviewed changes
Comment thread packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml
field: network.transport
'process.executable':
terms:
field: process.executable

@jmcarlock jmcarlock Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One other thing I picked up, if you are using Network Packet Capture as the data source, do you need to enable the monitor_processes setting in the integration policy?
https://github.com/elastic/integrations/blob/63384ae307ea445e86c064c37c84eebf24815e97/packages/network_traffic/_dev/build/docs/README.md#monitor_processes

@mergify

mergify Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jmcarlock jmcarlock jmcarlock approved these changes

Assignees

No one assigned

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:ded Data Exfiltration Detection Integration:dga Domain Generation Algorithm Detection Integration:lmd Lateral Movement Detection Integration:pad Privileged Access Detection Integration:problemchild Living off the Land Attack Detection Team:Security-Applied ML Elastic Security Protections Machine Learning (ML) team [elastic/sec-applied-ml]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sodhikirti07 @jmcarlock