Skip to content

Commit

Permalink
Fix Azure log analytics results translation. (#1612)
Browse files Browse the repository at this point in the history
Updating azure log analytics review comments.
1. Added transformer for converting int to float for latitude.
2.Updated TimestampConversion transformer to handle without milliseconds and added mappings for first and last observed.
3. Updated transformer to handle ConfidenceScore value is 'nan'.
  • Loading branch information
thangaraj-ramesh authored and DerekRushton committed Nov 16, 2023
1 parent 2d41003 commit 6518434
Show file tree
Hide file tree
Showing 4 changed files with 227 additions and 71 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -47,10 +47,17 @@
"transformer": "ConvertToReal"
}
],
"EndTime": {
"key": "x-ibm-finding.end",
"object": "finding"
},
"EndTime": [
{
"key": "x-ibm-finding.end",
"object": "finding",
"transformer": "TimestampConversion"
},
{
"key": "last_observed",
"transformer": "TimestampConversion"
}
],
"ExtendedProperties": {
"resourceType": {
"key": "x-cloud-resource.resource_type",
Expand All @@ -59,7 +66,8 @@
},
"ProcessingEndTime": {
"key": "x-ibm-finding.x_processing_endtime",
"object": "finding"
"object": "finding",
"transformer": "TimestampConversion"
},
"ProductComponentName": {
"key": "software.x_product_component_name",
Expand Down Expand Up @@ -88,10 +96,17 @@
"key": "x-cloud-resource.resource_id",
"object": "cloud_resource"
},
"StartTime": {
"key": "x-ibm-finding.start",
"object": "finding"
},
"StartTime": [
{
"key": "x-ibm-finding.start",
"object": "finding",
"transformer": "TimestampConversion"
},
{
"key": "first_observed",
"transformer": "TimestampConversion"
}
],
"Status": {
"key": "x-ibm-finding.x_status",
"object": "finding"
Expand All @@ -118,7 +133,8 @@
},
"TimeGenerated": {
"key": "x-ibm-finding.time_observed",
"object": "finding"
"object": "finding",
"transformer": "TimestampConversion"
},
"Type": {
"key": "x-ibm-finding.finding_type",
Expand Down Expand Up @@ -165,27 +181,37 @@
},
"ClosedTime": {
"key": "x-incident-info.closed_time",
"object": "incident"
"object": "incident",
"transformer": "TimestampConversion"
},
"Comments": {
"key": "x-incident-info.comments",
"object": "incident"
},
"CreatedTime": {
"key": "x-ibm-finding.start",
"object": "finding"
},
"CreatedTime": [
{
"key": "x-ibm-finding.start",
"object": "finding",
"transformer": "TimestampConversion"
},
{
"key": "first_observed",
"transformer": "TimestampConversion"
}
],
"Description": {
"key": "x-ibm-finding.description",
"object": "finding"
},
"FirstActivityTime": {
"key": "x-incident-info.first_activity",
"object": "incident"
"object": "incident",
"transformer": "TimestampConversion"
},
"FirstModifiedTime": {
"key": "x-incident-info.first_modified",
"object": "incident"
"object": "incident",
"transformer": "TimestampConversion"
},
"IncidentName": {
"key": "x-ibm-finding.x_incident_name",
Expand Down Expand Up @@ -216,12 +242,21 @@
},
"LastActivityTime": {
"key": "x-incident-info.last_active",
"object": "incident"
},
"LastModifiedTime": {
"key": "x-ibm-finding.end",
"object": "finding"
"object": "incident",
"transformer": "TimestampConversion"
},
"LastModifiedTime": [
{
"key": "x-ibm-finding.end",
"object": "finding",
"transformer": "TimestampConversion"
},
{
"key": "last_observed",
"transformer": "TimestampConversion"
}

],
"ModifiedBy": {
"key": "x-ibm-finding.x_modified_by",
"object": "finding"
Expand Down Expand Up @@ -280,10 +315,17 @@
"key": "x-ibm-finding.alert_id",
"object": "finding"
},
"PreviousTime": {
"key": "x-ibm-finding.start",
"object": "finding"
},
"PreviousTime": [
{
"key": "x-ibm-finding.start",
"object": "finding",
"transformer": "TimestampConversion"
},
{
"key": "first_observed",
"transformer": "TimestampConversion"
}
],
"EventID": {
"key": "x-oca-event.code",
"object": "event"
Expand Down Expand Up @@ -708,7 +750,8 @@
},
"CreationTimeUtc": {
"key": "process.created",
"object": "process1"
"object": "process1",
"transformer": "TimestampConversion"
},
"ElevationToken": {
"key": "process.x_elevation_token",
Expand All @@ -733,7 +776,8 @@
},
"CreationTimeUtc": {
"key": "process.created",
"object": "parent_process"
"object": "parent_process",
"transformer": "TimestampConversion"
},
"ElevationToken": {
"key": "process.x_elevation_token",
Expand Down Expand Up @@ -958,11 +1002,13 @@
},
"StartTimeUtc": {
"key": "x-host-logon-session.start_time",
"object": "logon_session"
"object": "logon_session",
"transformer": "TimestampConversion"
},
"EndTimeUtc": {
"key": "x-host-logon-session.end_time",
"object": "logon_session"
"object": "logon_session",
"transformer": "TimestampConversion"
}
},
"file": {
Expand Down Expand Up @@ -1054,11 +1100,13 @@
},
"Longitude": {
"key": "x-geo-location.longitude",
"object": "location"
"object": "location",
"transformer": "ToFloat"
},
"Latitude": {
"key": "x-geo-location.latitude",
"object": "location"
"object": "location",
"transformer": "ToFloat"
},
"Organization": {
"key": "x-geo-location.organization",
Expand Down
Loading

0 comments on commit 6518434

Please sign in to comment.