Conversation
…rity events from CrowdStrike Falcon platform
…gregation examples
…gregation examples
…itor' into backlog/add-sql-hints-to-code-editor # Conflicts: # frontend/src/app/shared/components/code-editor/components/query-suggestions/query-suggestions.component.ts
…rowdStrike module
…rowdStrike module
… logs display Signed-off-by: Manuel Abascal <mjabascal10@gmail.com>
…itor' into backlog/add-sql-hints-to-code-editor
…editor Backlog/add sql hints to code editor
… logs display Signed-off-by: Manuel Abascal <mjabascal10@gmail.com>
…into release/v11.2.0
…into release/v11.2.0
…ilter handling Signed-off-by: Manuel Abascal <mjabascal10@gmail.com>
… correlation rules
…ctor component Signed-off-by: Manuel Abascal <mjabascal10@gmail.com>
… audit and application logs Signed-off-by: Manuel Abascal <mjabascal10@gmail.com>
…ctor component Signed-off-by: Manuel Abascal <mjabascal10@gmail.com>
… correlation rules
…f` with `catcher.Error`, ensure functions return errors where applicable, and improve file resource management
… variable parsing in `config` plugin
This reverts commit afe2209.
…ptions Signed-off-by: Manuel Abascal <mjabascal10@gmail.com>
There was a problem hiding this comment.
Pull request overview
This pull request implements release v11.2.1, which introduces a new ThreadWinds ingestion plugin, updates multiple plugins to use the latest SDK version (v1.1.7), and modernizes the codebase with improved error handling and logging practices.
Changes:
- Added ThreadWinds ingestion plugin for processing UTMStack incidents/alerts
- Updated all plugins to use go-sdk v1.1.7 and Go 1.25.5
- Standardized error logging across plugins with process identification
- Enhanced alert correlation with GroupBy functionality
Reviewed changes
Copilot reviewed 179 out of 239 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| plugins/threadwinds-ingestion/* | New plugin for ThreadWinds threat intelligence integration |
| plugins/*/go.mod | Updated Go version to 1.25.5 and dependencies to latest versions |
| plugins/*/main.go | Modernized plugin initialization and added process identifiers to logs |
| plugins/alerts/main.go | Enhanced correlation logic with deduplication vs grouping support |
| plugins/soc-ai/* | Removed custom logger in favor of SDK catcher |
| plugins/config/main.go | Added GroupBy field support in correlation rules |
| plugins/stats/main.go | Refactored statistics tracking to handle multiple topics |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if err != nil && is(err, exception) { | ||
| if !xErrorWasLogged { | ||
| _ = catcher.Error("An error occurred (%s), will keep retrying indefinitely...", err, nil) | ||
| _ = catcher.Error("An error occurred, will keep retrying indefinitely...", err, map[string]any{"process": "plugin_com.utmstack.sophos"}) |
There was a problem hiding this comment.
The error message is generic and doesn't specify what error occurred. Consider making it more descriptive, e.g., 'Connection error occurred, will keep retrying indefinitely...'
| _ = catcher.Error("An error occurred, will keep retrying indefinitely...", err, map[string]any{"process": "plugin_com.utmstack.sophos"}) | |
| _ = catcher.Error(fmt.Sprintf("An error matching %q occurred, will keep retrying indefinitely...", exception), err, map[string]any{"process": "plugin_com.utmstack.sophos"}) |
| tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, | ||
| tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, |
There was a problem hiding this comment.
The removal of PreferServerCipherSuites: true on line 102 may affect security behavior. Ensure this change is intentional and doesn't compromise the TLS configuration security posture.
| bb.FilterTerm("name.keyword", alert.Name) | ||
|
|
||
| // Compile regex for array index stripping | ||
| reArrayIndex := regexp.MustCompile(`\.[0-9]+(\.|$)`) |
There was a problem hiding this comment.
The regex is being compiled inside the function which is called for every alert. Consider compiling this regex once at package level as a variable to avoid repeated compilation overhead.
6 participants
PLEASE READ BEFORE CONTINUING
To help us understand your contribution, please include the following in your pull request: