Skip to content

Conversation

@moxarth-rathod
Copy link
Contributor

@moxarth-rathod moxarth-rathod commented Apr 21, 2025

Proposed commit message

eset_protect: syslog message prefix breaks event ingestion pipeline 
In the official documentation [1], they've mentioned a note regarding the
Syslog server supporting a UTF-8 BOM encoding. This PR fixes the ingestion
pipeline by adding a `dissect` processor to remove the BOM prefix from the 
syslog messages, so that the pipeline does not fail in case of the presence
of this prefix in the events.  
[1]https://help.eset.com/protect_cloud/en-US/admin_server_settings_export_to_syslog.html

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/eset_protect directory.
  • Run the following command to run tests.

elastic-package test

Related issues

@moxarth-rathod moxarth-rathod added bugfix Pull request that fixes a bug issue Integration:eset_protect ESET PROTECT Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Apr 21, 2025
@moxarth-rathod moxarth-rathod self-assigned this Apr 21, 2025
@moxarth-rathod moxarth-rathod requested a review from a team as a code owner April 21, 2025 07:31
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Apr 21, 2025

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

Copy link
Contributor

@ShourieG ShourieG left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@elastic-sonarqube
Copy link

@elasticmachine
Copy link

💚 Build Succeeded

History

cc @moxarth-rathod

@ShourieG ShourieG merged commit 2af9ff5 into elastic:main Apr 23, 2025
7 checks passed
@elastic-vault-github-plugin-prod

Package eset_protect - 1.7.1 containing this change is available at https://epr.elastic.co/package/eset_protect/1.7.1/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:eset_protect ESET PROTECT Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ESET PROTECT]: Syslog message prefix breaks event ingestion pipeline

4 participants