Skip to content

crowdstrike: add event categorization fields to process data in alerts #15616

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 23, 2025
Merged

crowdstrike: add event categorization fields to process data in alerts #15616

merged 2 commits into from
Oct 23, 2025

Conversation

@navnit-elastic
Copy link
Contributor

@navnit-elastic navnit-elastic commented Oct 9, 2025 •
edited
Loading

Proposed commit message

crowdstrike: add event categorization fields to process data in alerts

Set event.category to "process" and event.type to "start" when
certain process fields are present in the alerts dataset.
Previously, alerts were being sent without setting
the event.category and event.type fields.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Pipeline Tests:

--- Test results for package: crowdstrike - START ---
╭─────────────┬─────────────┬───────────┬───────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE     │ DATA STREAM │ TEST TYPE │ TEST NAME                                 │ RESULT │ TIME ELAPSED │
├─────────────┼─────────────┼───────────┼───────────────────────────────────────────┼────────┼──────────────┤
│ crowdstrike │ alert       │ pipeline  │ (ingest pipeline warnings test-alert.log) │ PASS   │ 358.102002ms │
│ crowdstrike │ alert       │ pipeline  │ test-alert.log                            │ PASS   │  543.17555ms │
╰─────────────┴─────────────┴───────────┴───────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: crowdstrike - END   ---
Done

Related issues

Screenshots

@navnit-elastic navnit-elastic self-assigned this Oct 9, 2025
@navnit-elastic navnit-elastic added enhancement New feature or request Integration:crowdstrike CrowdStrike Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Oct 9, 2025
@andrewkroh andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Oct 9, 2025
@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Oct 14, 2025

🚀 Benchmarks report

Package crowdstrike 👍(5) 💚(3) 💔(2)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
falcon 4405.29 3654.97 -750.32 (-17.03%) 💔
host 4566.21 3558.72 -1007.49 (-22.06%) 💔

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

elasticmachine commented Oct 14, 2025

💚 Build Succeeded

History

cc @navnit-elastic

@navnit-elastic navnit-elastic marked this pull request as ready for review October 14, 2025 08:45
@navnit-elastic navnit-elastic requested a review from a team as a code owner October 14, 2025 08:45
@elasticmachine
Copy link

elasticmachine commented Oct 14, 2025

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@navnit-elastic navnit-elastic mentioned this pull request Oct 14, 2025
Closed
tomsonpl
tomsonpl approved these changes Oct 14, 2025
View reviewed changes
Copy link
Contributor

@tomsonpl tomsonpl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, this looks great!

@tomsonpl
Copy link
Contributor

tomsonpl commented Oct 22, 2025

@navnit-elastic hey, just wanted to check in and see when it's planned to be released? :)

@navnit-elastic navnit-elastic merged commit 8bf7fb5 into elastic:main Oct 23, 2025
7 checks passed
@navnit-elastic
Copy link
Contributor Author

navnit-elastic commented Oct 23, 2025

@tomsonpl - Sorry for the delay here.

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Oct 23, 2025

Package crowdstrike - 2.5.2 containing this change is available at https://epr.elastic.co/package/crowdstrike/2.5.2/

agithomas pushed a commit to agithomas/integrations that referenced this pull request Oct 30, 2025
@navnit-elastic @agithomas
crowdstrike: add event categorization fields to process data in alerts (
a159a8f 
elastic#15616)

Set event.category to "process" and event.type to "start" when
certain process fields are present in the alerts dataset.
Previously, alerts were being sent without setting
the event.category and event.type fields.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tomsonpl tomsonpl tomsonpl approved these changes

@efd6 efd6 efd6 approved these changes

Assignees

@navnit-elastic navnit-elastic

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:crowdstrike CrowdStrike Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@navnit-elastic @elasticmachine @tomsonpl @efd6 @andrewkroh