elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
200 stars 431 forks source link

[docs] Fix wrong Check Point fields in the documentation #5002

Closed toby-sutor closed 1 year ago

toby-sutor commented 1 year ago

Several wrong field names exist in our public documentation for the "Check Point" integration. E.g., checkpoint.source_user_name is correct according to the source at https://github.com/elastic/integrations/blob/dde705792f084b9041468e0e2f7fa8fab542f3ed/packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml#L102 but documented is checkpoint.src_user_name at https://docs.elastic.co/en/integrations/checkpoint.

This leads to pipeline errors if users follow the documentation. Some other fields should also be correctly aligned with the source. Thank you.

elasticmachine commented 1 year ago

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

efd6 commented 1 year ago

@toby-sutor I had a look at the situation and it's not quite just a discordance between the docs and correct code; the code in the case described is incorrect and the docs are right (though when the code is corrected they won't be).

I looked for other cases by searching for discordances between the pipeline-referred fields and the fields that are defined in filewall/fields/*.yml. This is fields that are referenced in the pipeline in such a way that they would remain in the final document and we don't have test data to support (fields covered by tests will be picked up in testing) but do not have a corresponding field definition. There was none.

Are there specific fields that you are referring to in the "other fields should also be correctly aligned with the source"?

efd6 commented 1 year ago

Absent any additional information here, I am going to close this. @toby-sutor If you believe this is incorrect, please reopen.