Skip to content

Update influencer fields of Security ML integrations - #20335

Merged
sodhikirti07 merged 4 commits into
mainfrom
update-influencer-fields-ml-integrations
Jul 28, 2026
Merged

Update influencer fields of Security ML integrations#20335
sodhikirti07 merged 4 commits into
mainfrom
update-influencer-fields-ml-integrations

Conversation

@sodhikirti07

@sodhikirti07 sodhikirti07 commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

  • Add and update influencers to ML jobs for DED, LMD, DGA and ProblemChild.
  • Update the source index of PAD windows transform to allow supported integration index only

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Using ITP

Related issues

Screenshots

@sodhikirti07 sodhikirti07 added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:lmd Lateral Movement Detection Integration:ded Data Exfiltration Detection Integration:dga Domain Generation Algorithm Detection Integration:problemchild Living off the Land Attack Detection Team:Security-Applied ML Elastic Security Protections Machine Learning (ML) team [elastic/sec-applied-ml] Integration:pad Privileged Access Detection labels Jul 23, 2026
@github-actions

github-actions Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Elastic Docs Style Checker (Vale)

Summary: 1 suggestion found

💡 Suggestions (1): Optional style improvements. Apply when helpful.
File Line Rule Message
packages/ded/docs/README.md 48 Elastic.WordChoice Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@sodhikirti07
sodhikirti07 marked this pull request as ready for review July 23, 2026 15:24
@sodhikirti07
sodhikirti07 requested review from a team as code owners July 23, 2026 15:24
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 23, 2026

Copy link
Copy Markdown

Pinging @elastic/sec-applied-ml (Team:Security-Applied ML)

@jmcarlock
jmcarlock self-requested a review July 23, 2026 19:49
jmcarlock
jmcarlock reviewed Jul 24, 2026
View reviewed changes
Comment thread packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml Outdated
field: user.id
script:
source: "return doc.containsKey('user.name') && !doc['user.name'].isEmpty() ? doc['user.name'].value : ''"
lang: painless

@jmcarlock jmcarlock Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we use missing_bucket: true for these instead?

@sodhikirti07 sodhikirti07 Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added this option instead of the script

jmcarlock
jmcarlock reviewed Jul 24, 2026
View reviewed changes
Comment thread packages/ded/elasticsearch/transform/pivot_transform_ea/transform.yml
field: network.transport
'process.executable':
terms:
field: process.executable

@jmcarlock jmcarlock Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One other thing I picked up, if you are using Network Packet Capture as the data source, do you need to enable the monitor_processes setting in the integration policy?
https://github.com/elastic/integrations/blob/63384ae307ea445e86c064c37c84eebf24815e97/packages/network_traffic/_dev/build/docs/README.md#monitor_processes

@sodhikirti07 sodhikirti07 Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good find, added this under a note in README

@mergify

mergify Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@sodhikirti07
sodhikirti07 requested a review from kapral18 July 27, 2026 14:32
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 27, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Security-ML Integrations Test Pipeline — Integrations CI (run #3)

🟢 All packages passed

Package Stack version Result
ded 9.4.4 🟢
dga 9.4.4 🟢
lmd 9.4.4 🟢
pad 9.4.4 🟢
problemchild 9.4.4 🟢

@sodhikirti07
sodhikirti07 merged commit d5f78fe into main Jul 28, 2026
13 checks passed
@sodhikirti07
sodhikirti07 deleted the update-influencer-fields-ml-integrations branch July 28, 2026 12:38
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Package ded - 3.4.0 containing this change is available at https://epr.elastic.co/package/ded/3.4.0/

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Package dga - 3.2.0 containing this change is available at https://epr.elastic.co/package/dga/3.2.0/

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Package lmd - 3.4.0 containing this change is available at https://epr.elastic.co/package/lmd/3.4.0/

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Package pad - 2.4.0 containing this change is available at https://epr.elastic.co/package/pad/2.4.0/

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Package problemchild - 3.2.0 containing this change is available at https://epr.elastic.co/package/problemchild/3.2.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kapral18 kapral18 kapral18 approved these changes
@jmcarlock jmcarlock jmcarlock approved these changes

Assignees

No one assigned

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:ded Data Exfiltration Detection Integration:dga Domain Generation Algorithm Detection Integration:lmd Lateral Movement Detection Integration:pad Privileged Access Detection Integration:problemchild Living off the Land Attack Detection Team:Security-Applied ML Elastic Security Protections Machine Learning (ML) team [elastic/sec-applied-ml]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sodhikirti07 @kapral18 @jmcarlock