Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Third-party integrations maintenance #675

Merged
merged 2 commits into from
Feb 5, 2025
Merged

Conversation

AlexRuiz7
Copy link
Member

@AlexRuiz7 AlexRuiz7 commented Feb 4, 2025

Description

This PR add maintenance operations to the third party integrations with the Indexer, including:

  • Bump Wazuh version to 4.10.1.
  • Bump Elastic version to 8.17.1.
  • Remove documentation about integrations with the manager (no longer maintained).

Related Issues

Resolves #674

Check List

  • The Docker Compose project starts without errors.
  • The data arrives to the destination.
  • All the dashboards can be imported successfully.
  • All the dashboards are populated with data.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@AlexRuiz7 AlexRuiz7 self-assigned this Feb 4, 2025
@AlexRuiz7 AlexRuiz7 requested a review from a team as a code owner February 4, 2025 16:13
@AlexRuiz7
Copy link
Member Author

AlexRuiz7 commented Feb 4, 2025

Elastic integrations

aws
image

docker
image

incident response
image

malware detection
image

pci dss
image

security events ⚠️
image

Warning

Error on authentication_failed summary dashboard

Details

Error message: Query rewrite failed: too many clauses

Query response

{
  "error": {
    "type": "status_exception",
    "reason": "error while executing search",
    "caused_by": {
      "type": "search_phase_execution_exception",
      "reason": "all shards failed",
      "phase": "query",
      "grouped": true,
      "failed_shards": [
        {
          "shard": 0,
          "index": "wazuh-alerts-4.x-2025.02.04",
          "node": "WIqeYvOySr6S-Uj2POy4Aw",
          "reason": {
            "type": "illegal_argument_exception",
            "reason": "Query rewrite failed: too many clauses",
            "caused_by": {
              "type": "too_many_nested_clauses",
              "reason": "Query contains too many nested clauses; maxClauseCount is set to 1024"
            }
          }
        }
      ],
      "caused_by": {
        "type": "illegal_argument_exception",
        "reason": "Query rewrite failed: too many clauses",
        "caused_by": {
          "type": "illegal_argument_exception",
          "reason": "Query rewrite failed: too many clauses",
          "caused_by": {
            "type": "too_many_nested_clauses",
            "reason": "Query contains too many nested clauses; maxClauseCount is set to 1024"
          }
        }
      }
    }
  },
  "rawResponse": {
    "took": 5,
    "timed_out": false,
    "terminated_early": false,
    "num_reduce_phases": 0,
    "_shards": {
      "total": 3,
      "successful": 0,
      "skipped": 0,
      "failed": 3,
      "failures": [
        {
          "shard": 0,
          "index": "wazuh-alerts-4.x-2025.02.04",
          "node": "WIqeYvOySr6S-Uj2POy4Aw",
          "reason": {
            "type": "illegal_argument_exception",
            "reason": "Query rewrite failed: too many clauses",
            "caused_by": {
              "type": "too_many_nested_clauses",
              "reason": "Query contains too many nested clauses; maxClauseCount is set to 1024"
            }
          }
        }
      ]
    },
    "hits": {
      "total": {
        "value": 0,
        "relation": "gte"
      },
      "max_score": null,
      "hits": []
    }
  }
}

vulnerabilities
image

Copy link
Member

@mcasas993 mcasas993 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@AlexRuiz7 AlexRuiz7 merged commit 73d86bd into master Feb 5, 2025
9 checks passed
@AlexRuiz7 AlexRuiz7 deleted the 674-integrations-maintenance branch February 5, 2025 11:55
f-galland pushed a commit that referenced this pull request Feb 20, 2025
* Upgrade integrations

* Update compatibility matrix
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Month 2] Integrations maintenance request
2 participants