Skip to content

[Netskope Alerts] Add text multi-field to netskope.alerts.breach.description field #13977

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
May 26, 2025
Merged
5 changes: 5 additions & 0 deletions packages/netskope/changelog.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.24.0"
changes:
- description: Add text multi-field to field netskope.alerts.breach.description
type: enhancement
link: https://github.com/elastic/integrations/pull/13977
- version: "1.23.1"
changes:
- description: Ignore empty string values for some fields.
Expand Down
5 changes: 4 additions & 1 deletion packages/netskope/data_stream/alerts/fields/fields.yml
Original file line number Diff line number Diff line change
Expand Up @@ -219,8 +219,11 @@
fields:
- name: description
type: keyword
multi_fields:
- name: text
type: match_only_text
description: |
N/A
Breach description for compromised credentials.
- name: date
type: double
description: |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2421,4 +2421,4 @@
}
}
]
}
}
3 changes: 2 additions & 1 deletion packages/netskope/docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,8 @@ Default port: _9021_
| netskope.alerts.audit.type | The sub category in audit according to SaaS / IaaS apps. | keyword |
| netskope.alerts.bin.timestamp | Applicable to only: Shared Credentials, Data Exfiltration, Bulk Anomaly types( Bulk Upload/Download/Delete) and Failed Login Anomaly type. Bin TimeStamp (is a window used that is used for certain types of anomalies - for breaking into several windows per day/hour). | long |
| netskope.alerts.breach.date | Breach date for compromised credentials. | double |
| netskope.alerts.breach.description | N/A | keyword |
| netskope.alerts.breach.description | Breach description for compromised credentials. | keyword |
| netskope.alerts.breach.description.text | Multi-field of `netskope.alerts.breach.description`. | match_only_text |
| netskope.alerts.breach.id | Breach ID for compromised credentials. | keyword |
| netskope.alerts.breach.media_references | Media references of breach. | keyword |
| netskope.alerts.breach.score | Breach score for compromised credentials. | long |
Expand Down
2 changes: 1 addition & 1 deletion packages/netskope/manifest.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: "3.0.3"
name: netskope
title: "Netskope"
version: "1.23.1"
version: "1.24.0"
description: Collect logs from Netskope with Elastic Agent.
type: integration
categories:
Expand Down