elastic · efd6 · Jul 9, 2026 · Jul 8, 2026
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.13.1"
+  changes:
+    - description: Fix detection pipeline marking events as pipeline_error when risk_level is non-numeric or request URL is malformed.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20047
 - version: "2.13.0"
   changes:
     - description: Use new `release` field for agentless deployment mode to establish as beta.

@@ -3,4 +3,5 @@
 {"eventTimeDT":"2022-07-11T13:35:34+00:00","tags":null,"uuid":"1234abcd-1234abcd-1234abcd-1234abcd-1234abcd","searchDL":"DDL","eventTime":1657546534000,"productCode":"sig","eventName":"WEB_POLICY_VIOLATION","rt_utc":"2022-07-11T13:35:34Z","rt":"2022-07-11T13:35:34+0000","act":["Block"],"aggregatedCount":"1","detectionType":"Web Reputation Service","deviceGUID":"456xyz-456xyz-456xyz-456xyz-456xyz","dst":["81.2.69.142"],"endpointGUID":"789pqr-789pqr-789pqr-789pqr-789pqr","endpointHostName":"ABC01","fileSize":"0","fileType":"ASCII Text","osName":"10.15.6","pname":"Secure Web Gateway","policyName":"default","pver":"1.0","requests":"http://example.com/","requestBase":"example.com","src":["81.2.69.142"],"suid":"user.name","urlCat":["Newly Observed Domain"],"userDomain":"example.com","profile":"Default threat protection profile","principalName":"user.name@example.com","policyUuid":"123123-abcd-123-abcd","sender":"Default cloud gateway","logKey":"123-123-123-abc-abc-abc","clientIp":["81.2.69.142"]}
 {"act":["not blocked"],"aggregatedCount":"1","app":"SMB2","appGroup":"CIFS","aptRelated":"0","clientFlag":"src","cnt":"8","compressedFileSize":"0","dceHash1":"0","dceHash2":"0","detectionType":"1","deviceDirection":"outbound","deviceGUID":"73487B369ACB-4179A816-9CE9-24B1-C575","deviceMacAddress":"00:11:22:33:44:55","devicePayloadId":"99:10786306:::","deviceRiskConfidenceLevel":3,"dhost":"samplehost","dmac":"00:00:0b:06:bc:87","dpt":445,"dst":["81.2.69.142"],"dstGroup":"Default","dstZone":"1","dvc":["81.2.69.142"],"dvchost":"EUABCDATE09","eventId":"100119","eventName":"SECURITY_RISK_DETECTION","eventSourceType":3,"eventTime":1696921180000,"eventTimeDT":"2023-10-10T06:59:40+00:00","filePath":" ","filePathName":" ","fileSize":"0","hasdtasres":"No","interestedGroup":"Default","interestedHost":"xxx-docker","interestedIp":["192.168.47.102"],"isHidden":"Yes","logKey":"123-123-123-abc-abc-abc","malType":"OTHERS","malTypeGroup":"Others","overSsl":"Not over SSL/TLS","pComp":"NCIE","peerGroup":"Default","peerHost":"samplehost","peerIp":["81.2.69.144"],"pname":"Deep Discovery Inspector","potentialRisk":"1","productCode":"pdi","pver":"6.5.1129","remarks":"[IP address: 81.2.69.144]","rt":"2023-10-10T06:59:40.0000000Z","rtDate":"2023-10-10T00:00:00.0000000Z","rtHour":10,"rtWeekDay":"Tuesday","rt_utc":"2023-10-10T06:59:40.0000000Z","ruleId":3498,"ruleName":"DOWNLOAD FILE - SMB2(REQUEST) - BETA","searchDL":"DDL","senderGUID":"73598B359BBF-4189A816-9AD9-24B1-C475","senderIp":["81.2.69.144"],"severity":2,"shost":"sampleshost","smac":"00:00:0b:06:bc:87","spt":52066,"src":["81.2.69.144"],"srcGroup":"Default","srcZone":"1","threatType":"99","uuid":"f4c08e8d-715e-4ac9-9469-2644b7cdt959","vLANId":4085}
 {"attachment":[{"attachmentFileHash":"5264bc98832d51837a1dd3705da7fe01d8f065e7","attachmentFileName":"image.png","attachmentFileSize":"-1","attachmentFileTlsh":""}],"attachmentFileHashes":["5124ba98812d51837a1dd3705da7fd00d8f067e6"],"attachmentFileHashs":["5124ba98812d51837a1dd3705da7fd00d8f067e6"],"attachmentFileName":["image.png"],"attachmentFileSizes":["-1"],"attachmentFileTlshes":[""],"attachmentFileTlshs":[""],"dataType":1,"description":"The subject (\"SOLICITAÇÃO DE CORTES SEMANA 33\") of this email is similar to known malicious mail subjects.","duser":["user@example.com.br","user2@example.com.br"],"eventId":"100009","eventName":"MESSAGE_SUSPICIOUS_DETECTION","eventSourceType":2,"eventTime":1754591294000,"eventTimeDT":"2025-08-07T18:28:14+00:00","fileCreation":"","filterRiskLevel":"info","groupId":"ec333310-1111-11e8-bb99-af11bd8888c7","groupIdCorrKey":"SUBJECT","groupIdCorrValues":["SOLICITAÇÃO DE CORTES SEMANA 33"],"logReceivedTime":"1754591305681","mailDeliveryTime":"","mailMsgDirection":21,"mailMsgSubject":"SOLICITAÇÃO DE CORTES SEMANA 33","mailReceivedTime":"","mailbox":"j.user3@example.com.br","msgId":"\u003cPPPPP80BB706167454555533336BEAA51AAAAA@AAAAAAA.aaaaaa.prod.outlook.com\u003e","msgUuid":"BBkAFgAAAAAABBBDEapmEc2byACqZY-FHg0A89ecNkvrvjJBwcWvipKPygABpXdddgAA","objectFileCreation":"","objectFileModified":"","orgId":"ec333310-1111-11e8-bb99-af11bd8888c7","pname":"Email Sensor","productCode":"xms","rt":"1754591294000","rt_utc":"2025-08-07T18:28:25.2070000Z","ruleName":"MA-01-030","ruleVer":"","samUser":"j.user3","scanTs":"","scanType":"realtime_mailmeta-exchange","searchDL":"DDL","subRuleName":"malicious_data_cluster","suser":["j.user3@example.com.br"],"tags":["XSJG.MA-01-030","MITRE.T1566.002"],"uuid":"d7777944-10c9-4197-9d97-0f8e66ef6666"}
+{"act":"Clean","cccaDetection":"Yes","cccaDetectionSource":"GLOBAL_INTELLIGENCE","cccaRiskLevel":"one","cnt":"1","detectionType":"File","deviceDirection":"outbound","endpointHostName":"test-host","eventId":"100200","eventName":"SECURITY_RISK_DETECTION","eventTime":1602724592000,"eventTimeDT":"2021-06-10T01:38:38+00:00","hostName":"test-host","pname":"Apex One","productCode":"sao","request":"[example.org]example.org]","rt":"2020-10-15T01:16:32.000Z","rt_utc":"2020-10-15T01:16:32.000Z","searchDL":"DDL","uuid":"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"}
 {"items":[],"progressRate":100}
@@ -853,6 +853,69 @@
                 }
             }
         },
+        {
+            "@timestamp": "2020-10-15T01:16:32.000Z",
+            "ecs": {
+                "version": "9.3.0"
+            },
+            "event": {
+                "action": "clean",
+                "category": [
+                    "intrusion_detection"
+                ],
+                "id": "100200",
+                "kind": "event",
+                "original": "{\"act\":\"Clean\",\"cccaDetection\":\"Yes\",\"cccaDetectionSource\":\"GLOBAL_INTELLIGENCE\",\"cccaRiskLevel\":\"one\",\"cnt\":\"1\",\"detectionType\":\"File\",\"deviceDirection\":\"outbound\",\"endpointHostName\":\"test-host\",\"eventId\":\"100200\",\"eventName\":\"SECURITY_RISK_DETECTION\",\"eventTime\":1602724592000,\"eventTimeDT\":\"2021-06-10T01:38:38+00:00\",\"hostName\":\"test-host\",\"pname\":\"Apex One\",\"productCode\":\"sao\",\"request\":\"[example.org]example.org]\",\"rt\":\"2020-10-15T01:16:32.000Z\",\"rt_utc\":\"2020-10-15T01:16:32.000Z\",\"searchDL\":\"DDL\",\"uuid\":\"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee\"}",
+                "type": [
+                    "info"
+                ]
+            },
+            "host": {
+                "hostname": "test-host",
+                "name": "test-host"
+            },
+            "network": {
+                "direction": "outbound"
+            },
+            "related": {
+                "hosts": [
+                    "test-host"
+                ]
+            },
+            "tags": [
+                "preserve_original_event",
+                "preserve_duplicate_custom_fields"
+            ],
+            "trend_micro_vision_one": {
+                "detection": {
+                    "action": "Clean",
+                    "detection": "Yes",
+                    "detection_source": "GLOBAL_INTELLIGENCE",
+                    "detection_type": "File",
+                    "device": {
+                        "direction": "outbound"
+                    },
+                    "endpoint": {
+                        "hostname": "test-host"
+                    },
+                    "event_id": "100200",
+                    "event_name": "SECURITY_RISK_DETECTION",
+                    "event_time": "2020-10-15T01:16:32.000Z",
+                    "event_time_dt": "2021-06-10T01:38:38.000Z",
+                    "hostname": "test-host",
+                    "product": {
+                        "code": "sao",
+                        "name": "Apex One"
+                    },
+                    "request": "[example.org]example.org]",
+                    "rt": "2020-10-15T01:16:32.000Z",
+                    "rt_utc": "2020-10-15T01:16:32.000Z",
+                    "search_data_lake": "DDL",
+                    "total_count": 1,
+                    "uuid": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
+                }
+            }
+        },
         null
     ]
 }
@@ -940,17 +940,17 @@ processors:
   - convert:
       field: trend_micro_vision_one.detection.risk_level
       tag: convert_risk_level_to_long
+      description: >-
+        The upstream API sometimes sends non-numeric strings in this
+        field despite documenting it as int. Drop silently on failure
+        rather than marking the event as a pipeline error.
       type: long
       ignore_missing: true
       on_failure:
         - remove:
             tag: remove_trend_micro_vision_one_detection_risk_level_d57f054f
             field: trend_micro_vision_one.detection.risk_level
             ignore_missing: true
-        - append:
-            tag: append_error_message_4c9d2b67
-            field: error.message
-            value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
   - script:
       lang: painless
       description: Resolve numeric risk level to text value.
@@ -1194,11 +1194,7 @@ processors:
       field: trend_micro_vision_one.detection.request
       tag: uri_parts_request
       ignore_missing: true
-      on_failure:
-        - append:
-            tag: append_error_message_3575cae8
-            field: error.message
-            value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
+      ignore_failure: true
   - user_agent:
       field: trend_micro_vision_one.detection.request_client_application
       tag: user_agent_request_client_application

@@ -1,7 +1,7 @@
 format_version: "3.3.2"
 name: trend_micro_vision_one
 title: TrendAI Vision One
-version: "2.13.0"
+version: "2.13.1"
 description: Collect logs from TrendAI Vision One with Elastic Agent.
 type: integration
 categories: