elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.49k stars 8.05k forks source link

[CDR][Findings page] Replace latest findings data view with global data view #187226

Open JordanSh opened 2 weeks ago

JordanSh commented 2 weeks ago

Summary

Currently, our findings page pulls data exclusively from the latest findings DataView. With the introduction of third-party (3P) integrations, starting with Wiz, we need to replace our data view query to include a generic index pattern that fetches data from all 3P integrations, specifically logs-*_latest_misconfigurations_cdr*.

Please refer to the detailed guide in the RFC Combining 3rd party data with native Cloud Security Posture data for comprehensive instructions.

Definition of Done

Out of Scope

Related Links

elasticmachine commented 2 weeks ago

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

JordanSh commented 1 week ago

moving to blocked for now, no point to start working on data pulling until Investigate options to query findings to combine native and 3rd party data is done