Skip to content

Conversation

@kcreddy
Copy link
Contributor

@kcreddy kcreddy commented May 2, 2025

Proposed commit message

ti_abusech: Increase memory for agentless deployment.

The agentless default memory is 1 Gi[1]. But this leads to OOM-kill 
and input restarts which further causes indexing spikes.
Increasing the memory to 2 Gi doesn't cause OOM-kill.

[1] https://github.com/elastic/security-team/blob/main/docs/cloud-security-team/agentless/onboard-integration.mdx#agentless-container-resource-configuration

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Screenshots

Before:

Agent logs (input STOPPED with exit code -1)

{"log.level":"info","@timestamp":"2025-04-30T16:49:03.363Z","message":"registering","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"id":"cel-ti_abusech.url-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67::https://urlhaus.abuse.ch/downloads/json","key":"cel-ti_abusech_url-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67::https://urlhaus_abuse_ch/downloads/json","uuid":"16c02628-e208-4b43-a8ff-cc3eedad4d8f","ecs.version":"1.6.0","log.logger":"metric_registry","log.origin":{"file.line":63,"file.name":"inputmon/input.go","function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewInputRegistry"},"service.name":"filebeat","input_type":"cel","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:03.366Z","message":"process repeated request","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"id":"cel-ti_abusech.url-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","input_url":"https://urlhaus.abuse.ch/downloads/json","ecs.version":"1.6.0","log.origin":{"file.line":225,"file.name":"cel/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1"},"service.name":"filebeat","input_source":"https://urlhaus.abuse.ch/downloads/json","log.logger":"input.cel","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-04-30T16:49:03.608Z","message":"single event object returned by evaluation","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"service.name":"filebeat","id":"cel-ti_abusech.malwarebazaar-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","input_source":"https://mb-api.abuse.ch/api/v1/","ecs.version":"1.6.0","log.logger":"input.cel","log.origin":{"file.line":407,"file.name":"cel/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1"},"input_url":"https://mb-api.abuse.ch/api/v1/","event":{"error":{"code":"402","id":"402 Payment Required","message":"POST:{\n    \"query_status\": \"ratelimited\",\n    \"msg\": \"Your request has been rate-limited. Please visit https:\\/\\/abuse.ch\\/rate-limit\\/ for more information.\"\n}"}},"ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-04-30T16:49:03.615Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67 (HEALTHY->DEGRADED): single event error object returned by evaluation: {\"error\":{\"code\":\"402\",\"id\":\"402 Payment Required\",\"message\":\"POST:{\\n    \\\"query_status\\\": \\\"ratelimited\\\",\\n    \\\"msg\\\": \\\"Your request has been rate-limited. Please visit https:\\\\/\\\\/abuse.ch\\\\/rate-limit\\\\/ for more information.\\\"\\n}\"}}","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"HEALTHY"},"unit":{"id":"cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","type":"input","state":"DEGRADED","old_state":"HEALTHY"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:04.860Z","message":"add_cloud_metadata: hosting provider type not detected.","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.logger":"add_cloud_metadata","log.origin":{"file.line":100,"file.name":"add_cloud_metadata/add_cloud_metadata.go","function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).init.func1"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:04.899Z","message":"Connecting to backoff(elasticsearch(https://0c0a9b03c334490ebd8bd527d95014f8.us-central1.gcp.cloud.es.io:443))","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"publisher_pipeline_output","log.origin":{"file.line":138,"file.name":"pipeline/client_worker.go","function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:05.008Z","message":"Attempting to connect to Elasticsearch version 8.18.0 (default)","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"esclientleg","log.origin":{"file.line":323,"file.name":"eslegclient/connection.go","function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*Connection).Ping"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:05.324Z","message":"Connection to backoff(elasticsearch(https://0c0a9b03c334490ebd8bd527d95014f8.us-central1.gcp.cloud.es.io:443)) established","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.logger":"publisher_pipeline_output","log.origin":{"file.line":146,"file.name":"pipeline/client_worker.go","function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:30.711Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":687},"message":"Component state changed cel-default (HEALTHY->STOPPED): Suppressing FAILED state due to restart for '28' exited with code '-1'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STOPPED","old_state":"HEALTHY"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:30.712Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67 (DEGRADED->STOPPED): Suppressing FAILED state due to restart for '28' exited with code '-1'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STOPPED"},"unit":{"id":"cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","type":"input","state":"STOPPED","old_state":"DEGRADED"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:30.712Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed cel-default (HEALTHY->STOPPED): Suppressing FAILED state due to restart for '28' exited with code '-1'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STOPPED"},"unit":{"id":"cel-default","type":"output","state":"STOPPED","old_state":"HEALTHY"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:31.714Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":667},"message":"Spawned new component cel-default: Starting: spawned pid '68'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:31.714Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":674},"message":"Spawned new unit cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67: Starting: spawned pid '68'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STARTING"},"unit":{"id":"cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","type":"input","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:31.714Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":674},"message":"Spawned new unit cel-default: Starting: spawned pid '68'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STARTING"},"unit":{"id":"cel-default","type":"output","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:31.809Z","message":"Home path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components] Config path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components] Data path: [/agentless/data/run/cel-default] Logs path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components/logs]","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.origin":{"file.line":1082,"file.name":"instance/beat.go","function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-04-30T16:49:31.810Z","message":"Beat ID: f2f6a96b-e3c6-490b-9722-453a4c35a4a9","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.origin":{"file.line":1090,"file.name":"instance/beat.go","function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}

Multiple errors inside same interval due to input restarts
Screenshot 2025-05-01 at 10 32 34 PM

After:

Agent logs (input doesn't get STOPPED)

{"log.level":"info","@timestamp":"2025-05-02T06:08:55.169Z","message":"BeatV2Manager.unitListen UnitChanged.ID(filestream-monitoring), UnitChanged.Type(added), UnitChanged.Trigger(4): added/feature_change_triggered","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-monitoring","type":"filestream"},"log":{"source":"filestream-monitoring"},"ecs.version":"1.6.0","log.logger":"centralmgmt.V2-manager","log.origin":{"file.line":506,"file.name":"management/managerV2.go","function":"github.com/elastic/beats/v7/x-pack/libbeat/management.(*BeatV2Manager).unitListen"},"service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-05-02T06:08:55.183Z","message":"single event object returned by evaluation","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"input_source":"https://mb-api.abuse.ch/api/v1/","event":{"error":{"code":"402","id":"402 Payment Required","message":"POST:{\n    \"query_status\": \"ratelimited\",\n    \"msg\": \"Your request has been rate-limited. Please visit https:\\/\\/abuse.ch\\/rate-limit\\/ for more information.\"\n}"}},"log.logger":"input.cel","id":"cel-ti_abusech.malwarebazaar-a4ca8426-13b0-4a46-a4bf-c73192e15d8d","input_url":"https://mb-api.abuse.ch/api/v1/","ecs.version":"1.6.0","log.origin":{"file.line":407,"file.name":"cel/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1"},"service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-05-02T06:08:55.183Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed cel-default-cel-ti_abusech-a4ca8426-13b0-4a46-a4bf-c73192e15d8d (HEALTHY->DEGRADED): single event error object returned by evaluation: {\"error\":{\"code\":\"402\",\"id\":\"402 Payment Required\",\"message\":\"POST:{\\n    \\\"query_status\\\": \\\"ratelimited\\\",\\n    \\\"msg\\\": \\\"Your request has been rate-limited. Please visit https:\\\\/\\\\/abuse.ch\\\\/rate-limit\\\\/ for more information.\\\"\\n}\"}}","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"HEALTHY"},"unit":{"id":"cel-default-cel-ti_abusech-a4ca8426-13b0-4a46-a4bf-c73192e15d8d","type":"input","state":"DEGRADED","old_state":"HEALTHY"},"ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-05-02T06:08:55.209Z","message":"single event object returned by evaluation","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.logger":"input.cel","log.origin":{"file.line":407,"file.name":"cel/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1"},"input_url":"https://threatfox-api.abuse.ch/api/v1/","ecs.version":"1.6.0","service.name":"filebeat","id":"cel-ti_abusech.threatfox-a4ca8426-13b0-4a46-a4bf-c73192e15d8d","input_source":"https://threatfox-api.abuse.ch/api/v1/","event":{"error":{"code":"402","id":"402 Payment Required","message":"POST https://threatfox-api.abuse.ch/api/v1:{\n    \"query_status\": \"ratelimited\",\n    \"msg\": \"Your request has been rate-limited. Please visit https:\\/\\/abuse.ch\\/rate-limit\\/ for more information.\"\n}"}},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-05-02T06:08:55.366Z","message":"Applying performance preset 'balanced': {\n  \"bulk_max_size\": 1600,\n  \"compression_level\": 1,\n  \"idle_connection_timeout\": \"3s\",\n  \"queue\": {\n    \"mem\": {\n      \"events\": 3200,\n      \"flush\": {\n        \"min_events\": 1600,\n        \"timeout\": \"10s\"\n      }\n    }\n  },\n  \"worker\": 1\n}","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"service.name":"metricbeat","ecs.version":"1.6.0","log.logger":"elasticsearch","log.origin":{"file.line":57,"file.name":"elasticsearch/elasticsearch.go","function":"github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.makeES"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-05-02T06:08:55.367Z","message":"elasticsearch url: https://2c3f6df68ecb40bb842c9457e68fa9c3.us-central1.gcp.cloud.es.io:443","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"ecs.version":"1.6.0","log.logger":"esclientleg","log.origin":{"file.line":132,"file.name":"eslegclient/connection.go","function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.NewConnection"},"service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-05-02T06:08:55.375Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed http/metrics-monitoring-metrics-monitoring-agent (STARTING->HEALTHY): Healthy","log":{"source":"elastic-agent"},"component":{"id":"http/metrics-monitoring","state":"HEALTHY"},"unit":{"id":"http/metrics-monitoring-metrics-monitoring-agent","type":"input","state":"HEALTHY","old_state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-05-02T06:08:55.375Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed http/metrics-monitoring (STARTING->HEALTHY): Healthy","log":{"source":"elastic-agent"},"component":{"id":"http/metrics-monitoring","state":"HEALTHY"},"unit":{"id":"http/metrics-monitoring","type":"output","state":"HEALTHY","old_state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-05-02T06:08:55.375Z","message":"Error fetching data for metricset http.json: error making http request: Get \"http://unix/stats\": dial unix /agentless/data/tmp/Hk6rvk9TDibMPcDvpl0jkLE-qDsHWVYL.sock: connect: no such file or directory","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"log.origin":{"file.line":333,"file.name":"module/wrapper.go","function":"github.com/elastic/beats/v7/metricbeat/mb/module.(*metricSetWrapper).handleFetchError"},"service.name":"metricbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-05-02T06:08:55.615Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":667},"message":"Spawned new component beat/metrics-monitoring: Starting: spawned pid '91'","log":{"source":"elastic-agent"},"component":{"id":"beat/metrics-monitoring","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-05-02T06:08:55.615Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":674},"message":"Spawned new unit beat/metrics-monitoring: Starting: spawned pid '91'","log":{"source":"elastic-agent"},"component":{"id":"beat/metrics-monitoring","state":"STARTING"},"unit":{"id":"beat/metrics-monitoring","type":"output","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-05-02T06:08:55.615Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":674},"message":"Spawned new unit beat/metrics-monitoring-metrics-monitoring-beats: Starting: spawned pid '91'","log":{"source":"elastic-agent"},"component":{"id":"beat/metrics-monitoring","state":"STARTING"},"unit":{"id":"beat/metrics-monitoring-metrics-monitoring-beats","type":"input","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-05-02T06:08:55.731Z","message":"Home path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components] Config path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components] Data path: [/agentless/data/run/beat/metrics-monitoring] Logs path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components/logs]","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"beat/metrics-monitoring","type":"beat/metrics"},"log":{"source":"beat/metrics-monitoring"},"log.origin":{"file.line":1082,"file.name":"instance/beat.go","function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure"},"service.name":"metricbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-05-02T06:08:55.734Z","message":"Beat ID: a937f5a7-e07b-4160-aa92-35ac89ee72bf","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"beat/metrics-monitoring","type":"beat/metrics"},"log":{"source":"beat/metrics-monitoring"},"service.name":"metricbeat","ecs.version":"1.6.0","log.origin":{"file.line":1090,"file.name":"instance/beat.go","function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure"},"ecs.version":"1.6.0"}

Single error per interval because of no input restarts
Screenshot 2025-05-02 at 1 23 04 PM

@kcreddy kcreddy self-assigned this May 2, 2025
@kcreddy kcreddy added enhancement New feature or request Integration:ti_abusech abuse.ch Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels May 2, 2025
@kcreddy kcreddy marked this pull request as ready for review May 2, 2025 08:08
@kcreddy kcreddy requested a review from a team as a code owner May 2, 2025 08:08
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

💚 Build Succeeded

cc @kcreddy

@elastic-sonarqube
Copy link

Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

What was the test methodology? Upload package zip file to kibana via API?

@kcreddy
Copy link
Contributor Author

kcreddy commented May 2, 2025

LGTM.

What was the test methodology? Upload package zip file to kibana via API?

Yes @andrewkroh.

@kcreddy kcreddy merged commit 1fc1642 into elastic:main May 2, 2025
7 checks passed
@elastic-vault-github-plugin-prod

Package ti_abusech - 2.10.0 containing this change is available at https://epr.elastic.co/package/ti_abusech/2.10.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:ti_abusech abuse.ch Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants