[forescout] Initial release of Forescout with Event and Host data streams#18493
[forescout] Initial release of Forescout with Event and Host data streams#18493janvi-elastic wants to merge 2 commits intomainfrom
Conversation
* [forescout] Add host data stream * update readme * update owner
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
| - name: data_stream.dataset | ||
| external: ecs | ||
| value: forescout.host | ||
| - name: data_stream.namespace | ||
| external: ecs | ||
| value: default | ||
| - name: data_stream.type | ||
| external: ecs | ||
| value: logs |
There was a problem hiding this comment.
🟠 High fields/base-fields.yml:1
Lines 3, 6, and 9 hardcode value entries for data_stream.dataset, data_stream.namespace, and data_stream.type. Since these are constant_keyword fields defined in ECS, hardcoding values forces the index mapping to expect those specific values. If a user configures a custom namespace in their agent policy, documents will fail to index due to mapping conflicts. Remove the value entries to allow runtime configuration, matching the standard pattern used across other integrations.
- name: data_stream.dataset
- external: ecs
- value: forescout.host
+- name: data_stream.dataset
+ external: ecs
- name: data_stream.namespace
- external: ecs
- value: default
+- name: data_stream.namespace
+ external: ecs
- name: data_stream.type
- external: ecs
- value: logs
+- name: data_stream.type
+ external: ecs🚀 Reply "fix it for me" or copy this AI Prompt for your agent:
In file packages/forescout/data_stream/host/fields/base-fields.yml around lines 1-9:
Lines 3, 6, and 9 hardcode `value` entries for `data_stream.dataset`, `data_stream.namespace`, and `data_stream.type`. Since these are `constant_keyword` fields defined in ECS, hardcoding values forces the index mapping to expect those specific values. If a user configures a custom namespace in their agent policy, documents will fail to index due to mapping conflicts. Remove the `value` entries to allow runtime configuration, matching the standard pattern used across other integrations.
| - forescout.host.timestamp | ||
| ignore_missing: true | ||
|
|
||
| # Remove `event.original` if `preserve_original_event` is not enabled |
There was a problem hiding this comment.
🟡 Medium ingest_pipeline/default.yml:209
When an inline on_failure handler appends to error.message, the pipeline later sets event.kind to pipeline_error and appends preserve_original_event to tags at lines 244-254 — but event.original has already been removed at lines 210-215 because the tag wasn't present yet. The original event is lost when errors occur, defeating the purpose of preservation. Move the error-detection block (lines 244-254) before the event.original removal (lines 209-215).
🚀 Reply "fix it for me" or copy this AI Prompt for your agent:
In file packages/forescout/data_stream/host/elasticsearch/ingest_pipeline/default.yml around line 209:
When an inline `on_failure` handler appends to `error.message`, the pipeline later sets `event.kind` to `pipeline_error` and appends `preserve_original_event` to `tags` at lines 244-254 — but `event.original` has already been removed at lines 210-215 because the tag wasn't present yet. The original event is lost when errors occur, defeating the purpose of preservation. Move the error-detection block (lines 244-254) before the `event.original` removal (lines 209-215).
💔 Build Failed
Failed CI Steps |
andrewkroh
added
New Integration
5 participants
Proposed commit message
Checklist
changelog.ymlfile.How to test this PR locally
To test the forescout package:
Related issues
Screenshots
Implementation details
Host Data is sent by the Forescout EyeExtend Connect app, and this integration package includes an ingest pipeline along with the associated dashboards.
Event data is sent over TCP and UDP.
Note: This integration follows a phased development process where individual data streams were reviewed and merged into a feature branch through separate PRs:
All PR's have been reviewed and merged in this feature branch, which is now ready for integration into the main branch.