Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[7.x] [Security Solution][Detections] Support arrays in event fields for Severity/Risk overrides (#83723) #84643

Merged
merged 1 commit into from
Dec 1, 2020
Merged

[7.x] [Security Solution][Detections] Support arrays in event fields for Severity/Risk overrides (#83723) #84643

merged 1 commit into from
Dec 1, 2020

Commits on Dec 1, 2020

  1. [Security Solution][Detections] Support arrays in event fields for Se… 

    …verity/Risk overrides (elastic#83723)

This PR changes the behavior of severity and risk score overrides in two ways:

- adds support for arrays in the mapped event fields (so a rule can be triggered by an event where e.g. `event.custom_severity` has a value like `[45, 70, 90]`)
- makes the logic of overrides more flexible, resilient to the incoming values (filters out junk, extracts meaningful values, does its best to find a value that would fit the mapping)
    @banderror
    banderror committed Dec 1, 2020
    Configuration menu
    Copy the full SHA
    fdeb172 View commit details
    Browse the repository at this point in the history