Skip to content

Added misconfiguration_workflow and vulnerability_workflow to related integrations #15151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 16 commits into from
Sep 24, 2025
Merged

Added misconfiguration_workflow and vulnerability_workflow to related integrations #15151

merged 16 commits into from
Sep 24, 2025

Conversation

@animehart
Copy link
Contributor

@animehart animehart commented Sep 3, 2025 •
edited
Loading

This PR adds these 2 new Categories

  • misconfiguration_workflow
  • vulnerability_workflow

To related CSP Integrations

  • Wiz
  • Rapid7 InsightVM
  • Google SCC
  • Amazon Security Hub
  • Amazon Inspector
  • AWS Config
  • Microsoft Defender for Endpoint
  • Microsoft Defender for Cloud
  • Microsoft Defender XDR
  • Tenable IO
  • Qualys VMDR
  • Cloud Security Posture

We are adding 1 or both of this 2 new categories to the integrations listed above as a part of our UX Improvements on Findings page. We want to make so that when user clicks on Add integration button on Findings Page, user will get redirected to Integration page with Security & vulnerability workflow or misconfiguration workflow sub category (depends on whether user clicks it from Misconfiguration tab or Vulnerability tab) already chosen for them

More about it can be seen in this PR (not merged yet, still waiting for this PR to be resolved first)

https://github.com/elastic/security-team/issues/11821#issuecomment-3247696334

@animehart animehart added the Integration:cloud_security_posture Security Posture Management label Sep 3, 2025
@andrewkroh andrewkroh added Integration:m365_defender Microsoft Defender XDR Integration:rapid7_insightvm Rapid7 InsightVM Integration:google_scc Google Security Command Center Integration:aws AWS Integration:microsoft_defender_endpoint Microsoft Defender for Endpoint Integration:qualys_vmdr Qualys VMDR Integration:microsoft_defender_cloud Microsoft Defender for Cloud Integration:wiz Wiz Integration:tenable_io Tenable Vulnerability Management labels Sep 4, 2025
@animehart animehart changed the title Added miscofiguration_workflow and vulnerability_workflow to related integrations Added misconfiguration_workflow and vulnerability_workflow to related integrations Sep 16, 2025
@animehart animehart marked this pull request as ready for review September 19, 2025 15:04
@animehart animehart requested review from a team as code owners September 19, 2025 15:04
@andrewkroh andrewkroh added Team:Cloud Security Cloud Security team [elastic/cloud-security-posture] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:obs-ds-hosted-services Observability Hosted Services team [elastic/obs-ds-hosted-services] labels Sep 19, 2025
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Kavindu-Dodan
Kavindu-Dodan approved these changes Sep 19, 2025
View reviewed changes
Copy link
Contributor

@Kavindu-Dodan Kavindu-Dodan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with respect to AWS package

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Sep 19, 2025 •
edited
Loading

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@animehart
Copy link
Contributor Author

/test benchmark fullreport

efd6
efd6 reviewed Sep 22, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would also be helpful to link to a discussion decision to allow reviewers to know that the decision to make the change was agreed to.

efd6
efd6 reviewed Sep 22, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally, the link to justifying text should be a summary and public rather than comments in a private discussion; we want users to be able to understand the rationale for code changes and there to be no ambiguity around the decisions that were made.

@animehart animehart requested a review from efd6 September 22, 2025 23:34
efd6
efd6 reviewed Sep 22, 2025
View reviewed changes
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SSI files LGTM pending @kcreddy's approval.

kcreddy
kcreddy reviewed Sep 23, 2025
View reviewed changes
Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#15151 (review). Please add misconfiguration_workflow to AWS Config.

kcreddy
kcreddy reviewed Sep 23, 2025
View reviewed changes
Copy link
Contributor

@kcreddy kcreddy left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CI errors are related to input health degradation happening from empty template evaluations. We have a fix in #15415

@animehart animehart requested a review from kcreddy September 23, 2025 05:21
kcreddy
kcreddy approved these changes Sep 23, 2025
View reviewed changes
Copy link
Contributor

@kcreddy kcreddy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks!
Please update the PR description by adding AWS Config to the list as well.

@elasticmachine
Copy link

💚 Build Succeeded

History

@elastic-sonarqube
Copy link

Quality Gate failed Quality Gate failed

Failed conditions
79.3% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

opauloh
opauloh approved these changes Sep 23, 2025
View reviewed changes
Copy link
Contributor

@opauloh opauloh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@animehart animehart merged commit bc1a78a into elastic:main Sep 24, 2025
8 of 9 checks passed
@elastic-vault-github-plugin-prod
Copy link

Package aws - 4.1.0 containing this change is available at https://epr.elastic.co/package/aws/4.1.0/

@elastic-vault-github-plugin-prod
Copy link

Package cloud_security_posture - 3.1.0-preview06 containing this change is available at https://epr.elastic.co/package/cloud_security_posture/3.1.0-preview06/

@elastic-vault-github-plugin-prod
Copy link

Package google_scc - 2.1.0 containing this change is available at https://epr.elastic.co/package/google_scc/2.1.0/

@elastic-vault-github-plugin-prod
Copy link

Package m365_defender - 4.1.0 containing this change is available at https://epr.elastic.co/package/m365_defender/4.1.0/

@elastic-vault-github-plugin-prod
Copy link

Package microsoft_defender_cloud - 3.1.0 containing this change is available at https://epr.elastic.co/package/microsoft_defender_cloud/3.1.0/

@elastic-vault-github-plugin-prod
Copy link

Package microsoft_defender_endpoint - 3.1.0 containing this change is available at https://epr.elastic.co/package/microsoft_defender_endpoint/3.1.0/

@elastic-vault-github-plugin-prod
Copy link

Package qualys_vmdr - 6.10.0 containing this change is available at https://epr.elastic.co/package/qualys_vmdr/6.10.0/

@elastic-vault-github-plugin-prod
Copy link

Package rapid7_insightvm - 2.3.0 containing this change is available at https://epr.elastic.co/package/rapid7_insightvm/2.3.0/

@elastic-vault-github-plugin-prod
Copy link

Package tenable_io - 4.4.0 containing this change is available at https://epr.elastic.co/package/tenable_io/4.4.0/

@elastic-vault-github-plugin-prod
Copy link

Package wiz - 3.9.0 containing this change is available at https://epr.elastic.co/package/wiz/3.9.0/

@shmsr
Copy link
Member

shmsr commented Sep 25, 2025 •
edited
Loading

Hi @animehart!

For aws package, I am facing these issues with the latest elastic-package (elastic-package@latest; not v0.115.0 currently in CI):

   1. file "/Users/subhamsarkar/go/src/github.com/elastic/integrations/build/packages/aws-4.3.0.zip/manifest.yml" is invalid: field policy_templates.4.categories.2: policy_templates.4.categories.2 must be one of the following: "advanced_analytics_ueba", "analytics_engine", "application_observability", "app_search", "auditd", "authentication", "aws", "azure", "big_data", "cdn_security", "cloud", "cloudsecurity_cdr", "config_management", "connector", "connector_client", "connector_package", "containers", "content_source", "crawler", "credential_management", "crm", "custom", "custom_logs", "database_security", "datastore", "dns_security", "edr_xdr", "elasticsearch_sdk", "elastic_stack", "email_security", "enterprise_search", "firewall_security", "google_cloud", "iam", "ids_ips", "infrastructure", "java_observability", "kubernetes", "language_client", "languages", "load_balancer", "message_queue", "monitoring", "native_search", "network", "network_security", "notification", "observability", "os_system", "process_manager", "productivity", "productivity_security", "proxy_security", "sdk_search", "security", "siem", "stream_processing", "support", "threat_intel", "ticketing", "version_control", "virtualization", "vpn_security", "vulnerability_management", "web", "web_application_firewall", "websphere", "workplace_search"
   2. file "/Users/subhamsarkar/go/src/github.com/elastic/integrations/build/packages/aws-4.3.0.zip/manifest.yml" is invalid: field policy_templates.27.categories.2: policy_templates.27.categories.2 must be one of the following: "advanced_analytics_ueba", "analytics_engine", "application_observability", "app_search", "auditd", "authentication", "aws", "azure", "big_data", "cdn_security", "cloud", "cloudsecurity_cdr", "config_management", "connector", "connector_client", "connector_package", "containers", "content_source", "crawler", "credential_management", "crm", "custom", "custom_logs", "database_security", "datastore", "dns_security", "edr_xdr", "elasticsearch_sdk", "elastic_stack", "email_security", "enterprise_search", "firewall_security", "google_cloud", "iam", "ids_ips", "infrastructure", "java_observability", "kubernetes", "language_client", "languages", "load_balancer", "message_queue", "monitoring", "native_search", "network", "network_security", "notification", "observability", "os_system", "process_manager", "productivity", "productivity_security", "proxy_security", "sdk_search", "security", "siem", "stream_processing", "support", "threat_intel", "ticketing", "version_control", "virtualization", "vpn_security", "vulnerability_management", "web", "web_application_firewall", "websphere", "workplace_search"

I tracked it down to:

  • misconfiguration_workflow
  • vulnerability_workflow

added in this PR.

I think you have to add the categories here as well: https://github.com/elastic/package-spec/blob/main/spec/integration/manifest.spec.yml (related PR: elastic/package-spec#515) so that elastic-package can see the updated list of categories.

@kcreddy
Copy link
Contributor

kcreddy commented Sep 26, 2025

@shmsr, you need to upgrade to latest elastic-package version because the new categories are added in recent version: elastic/package-spec#974

@elastic-vault-github-plugin-prod
Copy link

Package cloud_security_posture - 3.1.0 containing this change is available at https://epr.elastic.co/package/cloud_security_posture/3.1.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@efd6 efd6 efd6 left review comments

@Kavindu-Dodan Kavindu-Dodan Kavindu-Dodan approved these changes

@kcreddy kcreddy kcreddy approved these changes

@opauloh opauloh opauloh approved these changes

Assignees

No one assigned

Labels

Integration:aws AWS Integration:cloud_security_posture Security Posture Management Integration:google_scc Google Security Command Center Integration:m365_defender Microsoft Defender XDR Integration:microsoft_defender_cloud Microsoft Defender for Cloud Integration:microsoft_defender_endpoint Microsoft Defender for Endpoint Integration:qualys_vmdr Qualys VMDR Integration:rapid7_insightvm Rapid7 InsightVM Integration:tenable_io Tenable Vulnerability Management Integration:wiz Wiz Team:Cloud Security Cloud Security team [elastic/cloud-security-posture] Team:obs-ds-hosted-services Observability Hosted Services team [elastic/obs-ds-hosted-services] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@animehart @elasticmachine @shmsr @kcreddy @Kavindu-Dodan @opauloh @efd6 @andrewkroh