[eset_protect] Add support of a toggle to preserve or drop the HEARTBEAT messages

packages/eset_protect/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.11.0"
+  changes:
+    - description: "Add support for a toggle to preserve or drop the HEARTBEAT messages."
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15817
 - version: "1.10.0"
   changes:
     - description: "Enhance error handling for agent failures."

packages/eset_protect/data_stream/event/_dev/test/pipeline/test-event.log-expected.json

@@ -2637,6 +2637,17 @@
                 }
             }
         },
-        null
+        {
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "original": "HEARTBEAT"
+            },
+            "tags": [
+                "preserve_original_event",
+                "preserve_duplicate_custom_fields"
+            ]
+        }
     ]
 }

packages/eset_protect/data_stream/event/_dev/test/system/test-default-config.yml

@@ -60,4 +60,4 @@ data_stream:
         qEf55SihFqErRMeURPPF
         -----END CERTIFICATE-----
 assert:
-  hit_count: 1
+  hit_count: 2

packages/eset_protect/data_stream/event/agent/stream/tcp.yml.hbs

@@ -12,6 +12,9 @@ tags:
 {{#if preserve_duplicate_custom_fields}}
   - preserve_duplicate_custom_fields
 {{/if}}
+{{#if drop_heartbeat_message}}
+  - drop_heartbeat_message
+{{/if}}
 {{#each tags as |tag|}}
   - {{tag}}
 {{/each}}

packages/eset_protect/data_stream/event/elasticsearch/ingest_pipeline/default.yml

@@ -12,8 +12,8 @@ processors:
       ignore_failure: true
       tag: bom_removed
   - drop:
-      if: ctx.message == 'HEARTBEAT'
       tag: drop_heartbeat_events
+      if: ctx.message == 'HEARTBEAT' && ctx.tags != null && ctx.tags.contains('drop_heartbeat_message') == true
   - rename:
       field: message
       tag: rename_message_to_event_original
@@ -27,6 +27,9 @@ processors:
       ignore_missing: true
       description: The `message` field is no longer required if the document has an `event.original` field.
       if: ctx.event?.original != null
+  - terminate:
+      tag: terminate_processing_for_heartbeat_messages
+      if: ctx.event?.original == 'HEARTBEAT'
   - json:
       field: event.original
       tag: json_event_original

packages/eset_protect/data_stream/event/manifest.yml

@@ -42,6 +42,14 @@ streams:
         default:
           - forwarded
           - eset_protect-event
+      - name: drop_heartbeat_message
+        required: true
+        show_user: false
+        title: Drop HEARTBEAT message
+        description: Enable this toggle to drop HEARTBEAT messages. Disable it to retain HEARTBEAT messages in the data stream.
+        type: bool
+        multi: false
+        default: false
       - name: preserve_original_event
         required: true
         show_user: true

packages/eset_protect/data_stream/event/sample_event.json

@@ -1,15 +1,15 @@
 {
     "@timestamp": "2021-06-21T03:56:20.000Z",
     "agent": {
-        "ephemeral_id": "72d5910c-579d-4f1d-aae0-f5363b2e4d19",
-        "id": "c30da4c5-b5d9-49b7-8746-4fbfd111b834",
-        "name": "elastic-agent-98915",
+        "ephemeral_id": "15db6629-f3a1-4a0f-94ea-1bf6ec62aaba",
+        "id": "adf2804e-ca6b-4c6b-90af-e9060e7ee1b2",
+        "name": "elastic-agent-28441",
         "type": "filebeat",
         "version": "8.16.0"
     },
     "data_stream": {
         "dataset": "eset_protect.event",
-        "namespace": "90346",
+        "namespace": "71776",
         "type": "logs"
     },
     "destination": {
@@ -37,7 +37,7 @@
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "c30da4c5-b5d9-49b7-8746-4fbfd111b834",
+        "id": "adf2804e-ca6b-4c6b-90af-e9060e7ee1b2",
         "snapshot": false,
         "version": "8.16.0"
     },
@@ -72,7 +72,7 @@
             "web"
         ],
         "dataset": "eset_protect.event",
-        "ingested": "2025-10-29T13:29:00Z",
+        "ingested": "2025-10-30T10:35:48Z",
         "kind": "alert",
         "original": "{\"event_type\":\"FilteredWebsites_Event\",\"ipv4\":\"192.168.30.30\",\"hostname\":\"win-test\",\"group_name\":\"All/Lost & found\",\"os_name\":\"Microsoft Windows 11 Pro\",\"group_description\":\"Lost & found static group\",\"source_uuid\":\"d9477661-8fa4-4144-b8d4-e37b983bcd69\",\"occured\":\"21-Jun-2021 03:56:20\",\"severity\":\"Warning\",\"event\":\"An attempt to connect to URL\",\"target_address\":\"89.160.20.128\",\"target_address_type\":\"IPv4\",\"scanner_id\":\"HTTP filter\",\"action_taken\":\"blocked\",\"object_uri\":\"https://test.com\",\"hash\":\"ABCDAA625E6961037B8904E113FD0C232A7D0EDC\",\"username\":\"WIN-TEST\\\\Administrator\",\"processname\":\"C:\\\\Program Files\\\\Web browser\\\\brwser.exe\",\"rule_id\":\"Blocked by PUA blacklist\"}",
         "type": [
@@ -98,7 +98,7 @@
     },
     "log": {
         "source": {
-            "address": "192.168.241.3:46124"
+            "address": "192.168.241.3:58054"
         },
         "syslog": {
             "appname": "ERAServer",

packages/eset_protect/docs/README.md

@@ -380,15 +380,15 @@ An example event for `event` looks as following:
 {
     "@timestamp": "2021-06-21T03:56:20.000Z",
     "agent": {
-        "ephemeral_id": "72d5910c-579d-4f1d-aae0-f5363b2e4d19",
-        "id": "c30da4c5-b5d9-49b7-8746-4fbfd111b834",
-        "name": "elastic-agent-98915",
+        "ephemeral_id": "15db6629-f3a1-4a0f-94ea-1bf6ec62aaba",
+        "id": "adf2804e-ca6b-4c6b-90af-e9060e7ee1b2",
+        "name": "elastic-agent-28441",
         "type": "filebeat",
         "version": "8.16.0"
     },
     "data_stream": {
         "dataset": "eset_protect.event",
-        "namespace": "90346",
+        "namespace": "71776",
         "type": "logs"
     },
     "destination": {
@@ -416,7 +416,7 @@ An example event for `event` looks as following:
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "c30da4c5-b5d9-49b7-8746-4fbfd111b834",
+        "id": "adf2804e-ca6b-4c6b-90af-e9060e7ee1b2",
         "snapshot": false,
         "version": "8.16.0"
     },
@@ -451,7 +451,7 @@ An example event for `event` looks as following:
             "web"
         ],
         "dataset": "eset_protect.event",
-        "ingested": "2025-10-29T13:29:00Z",
+        "ingested": "2025-10-30T10:35:48Z",
         "kind": "alert",
         "original": "{\"event_type\":\"FilteredWebsites_Event\",\"ipv4\":\"192.168.30.30\",\"hostname\":\"win-test\",\"group_name\":\"All/Lost & found\",\"os_name\":\"Microsoft Windows 11 Pro\",\"group_description\":\"Lost & found static group\",\"source_uuid\":\"d9477661-8fa4-4144-b8d4-e37b983bcd69\",\"occured\":\"21-Jun-2021 03:56:20\",\"severity\":\"Warning\",\"event\":\"An attempt to connect to URL\",\"target_address\":\"89.160.20.128\",\"target_address_type\":\"IPv4\",\"scanner_id\":\"HTTP filter\",\"action_taken\":\"blocked\",\"object_uri\":\"https://test.com\",\"hash\":\"ABCDAA625E6961037B8904E113FD0C232A7D0EDC\",\"username\":\"WIN-TEST\\\\Administrator\",\"processname\":\"C:\\\\Program Files\\\\Web browser\\\\brwser.exe\",\"rule_id\":\"Blocked by PUA blacklist\"}",
         "type": [
@@ -477,7 +477,7 @@ An example event for `event` looks as following:
     },
     "log": {
         "source": {
-            "address": "192.168.241.3:46124"
+            "address": "192.168.241.3:58054"
         },
         "syslog": {
             "appname": "ERAServer",

packages/eset_protect/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.3.2
 name: eset_protect
 title: ESET PROTECT
-version: "1.10.0"
+version: "1.11.0"
 description: Collect logs from ESET PROTECT with Elastic Agent.
 type: integration
 categories: