trend_micro_vision_one: fix detection pipeline marking events as pipeline_error#20047
Conversation
…line_error The convert_risk_level_to_long and uri_parts_request processors both had on_failure handlers that appended to error.message. The pipeline epilogue marks any document with error.message as pipeline_error, so events with non-numeric risk levels or malformed URLs were classified as errors instead of being indexed normally. Remove the error.message append from convert_risk_level_to_long (keeping the field removal since the mapping is long) and replace the uri_parts_request on_failure block with ignore_failure. Test case was manually constructed based on a report.
8a18c2a to
bfeb32c
Compare
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
|
✅ All changelog entries have the correct PR link. |
💚 Build Succeeded
cc @efd6 |
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
|
No issues across the latest commits bfeb32c.
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
|
Tick the box to add this pull request to the merge queue (same as
|
|
Package trend_micro_vision_one - 2.13.1 containing this change is available at https://epr.elastic.co/package/trend_micro_vision_one/2.13.1/ |
Proposed commit message
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots