Skip to content

[jamf_pro] Add event.module definition for the events data stream #14017

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 4 commits into from
May 28, 2025
Merged

[jamf_pro] Add event.module definition for the events data stream #14017

merged 4 commits into from
May 28, 2025

Conversation

chrisberkhout
Copy link
Contributor

@chrisberkhout chrisberkhout commented May 27, 2025 •
edited
Loading

Proposed commit message

[jamf_pro] Add event.module definition for the events data stream

This matches what was already present in the inventory data stream.

Also updates the sample_event.json files. The constant_keyword fields
aren't currently included by elastic-package.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

@chrisberkhout chrisberkhout self-assigned this May 27, 2025
@chrisberkhout chrisberkhout requested a review from a team as a code owner May 27, 2025 15:33
@chrisberkhout chrisberkhout added bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:jamf_pro Jamf Pro labels May 27, 2025
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@chrisberkhout chrisberkhout mentioned this pull request May 27, 2025
Open
@elastic-vault-github-plugin-prod
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

andrewkroh
andrewkroh reviewed May 27, 2025
View reviewed changes
Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The constant_keyword fields aren't currently included by elastic-package.

This is because the fields do not exist in the _source (which is by design to minimize event size). elastic-package would need to utilize fields.

packages/jamf_pro/data_stream/events/fields/base-fields.yml
@@ -15,3 +15,6 @@
- name: event.dataset
type: constant_keyword
value: jamf_pro.events
- name: event.module
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- name: event.module
- name: event.module
external: ecs

Let's use the ECS definition such that the table in the readme contains the ECS description.

https://github.com/elastic/integrations/wiki/Fleet-Package-Code-Review-Comments#defining-an-ecs-field-without-using-an-external-definition

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done for this and event.dataset and event.module in both data streams.

packages/jamf_pro/data_stream/events/fields/base-fields.yml
@@ -15,3 +15,6 @@
- name: event.dataset
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- name: event.dataset
- name: event.dataset
external: ecs

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done for this and event.dataset and event.module in both data streams.

@chrisberkhout chrisberkhout force-pushed the jamf_pro-event-module branch from 12d67e5 to cee15e8 Compare May 28, 2025 08:36
@chrisberkhout chrisberkhout requested a review from andrewkroh May 28, 2025 08:36
@elastic-sonarqube Elastic SonarQube
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

@elasticmachine
Copy link

💚 Build Succeeded

History

cc @chrisberkhout

@chrisberkhout chrisberkhout merged commit f02ac1c into elastic:main May 28, 2025
8 checks passed
@elastic-vault-github-plugin-prod
Copy link

Package jamf_pro - 0.5.3 containing this change is available at https://epr.elastic.co/package/jamf_pro/0.5.3/

anupratharamachandran pushed a commit to anupratharamachandran/integrations that referenced this pull request Jun 2, 2025
@chrisberkhout @anupratharamachandran
[jamf_pro] Add event.module definition for the events data stream (el…
6a9c573 
…astic#14017)

This matches what was already present in the inventory data stream.

Also updates the sample_event.json files. The constant_keyword fields
aren't currently included by elastic-package.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees

@chrisberkhout chrisberkhout

Labels
bugfix Pull request that fixes a bug issue Integration:jamf_pro Jamf Pro Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@chrisberkhout @elasticmachine @andrewkroh