Open P1llus opened 1 year ago
I am unable to replicate this. When I run the command in CEF at elastic/integrations@71947e057f2393cd7ee16137b8f951b8d7059f2e I get this
- script:
lang: painless
params:
extensions:
- name: cp_app_risk
to: checkpoint.app_risk
- # This mapping is a mix of [1] and [2] above.
convert:
critical: 5
high: 4
informational: 0
low: 2
medium: 3
unknown: 0
very-high: 5
very-low: 1
name: cp_app_risk
to: event.risk_score
- name: cp_severity
to: checkpoint.severity
- convert:
critical: 4
high: 3
informational: 0
low: 1
medium: 2
# This mapping is a mix of [1] and [2] above.
unknown: 0
very-high: 4
very-low: 1
name: cp_severity
to: event.severity
# Number of events associated with the log
- name: baseEventCount
to: checkpoint.event_count
# Log type
- name: deviceExternalId
to: observer.type
# Product Family (override deviceExternalId if present).
- convert:
'0': Network
'1': Endpoint
'2': Access
'3': Threat
'4': Mobile
name: deviceFacility
to: observer.type
# Gateway interface, where the connection is received from in case of an outbound connection
<snip>
What version of fumpt
are you using?
There is some weird behavior found when trying to run
fumpt -w -pipeline
on the Elastic CEF integration package.https://github.com/elastic/integrations/blob/main/packages/cef/data_stream/log/elasticsearch/ingest_pipeline/cp-pipeline.yml#L35
The top of the painless script:
Before formatting:
After formatting: