[New Connector] Sandfly Security #3522
Conversation
|
💚 CLA has been signed |
|
Our company CEO signed the contributor agreement and added me as an authorized contributor. Can we recheck the CLA to see if that is working now? |
Sorry, I think we missed this comment. The best way to re-trigger it would be to add an empty commit, like: If that doesn't work, there's probably a commit in the history that's attributed to an email that hasn't signed the CLA. You can squash all the commits into one, and force-push with that single commit signed by the right email. |
|
buildkite test this |
There was a problem hiding this comment.
Hey @sandflysnapp , I'm coming back to this, and by and large the connector looks good! Thank you for addressing the comments from myself and Artem 🙂
How confident are you in the functional test coverage provided by the fixtures under fixtures/sandfly? Do you feel it is sufficient for capturing the functionality of the connector?
For context, we run functional tests as part of our CI, and if we merge this, we'd most likely integrate Sandfly's functional tests into our CI pipeline.
I tried to make sure that the functional tests covered all of the basic functionality. Ping, license check, Results ingest, SSH Keys ingest, and Hosts ingest (both full and incremental sync). Our JSON blobs can be pretty large, but only a small subset of fields are touched during the sync process, so those are all tested and verified during the testing. So yes, I am confident that the functionality is tested. I have also tested the small/med/large data size tests and all of them ran without errors and returned the expected number of documents. I have also been running the connector pretty consistently the last few weeks, both with an Elastic Cloud deployment and our own internal deployment, with large amounts of data and frequent incremental sync operations, and I am very happy with how it is performing. Happy to address any other issues you may find. --Steve |
There was a problem hiding this comment.
Hey Steve,
If Sandfly is confident with the coverage provided by the e2e tests then we are good to go 👍
Just wanted to note something about 'community' connectors before we merge - we will most likely move this (and other community connectors) to a directory called /community soon, so that our users can differentiate between connector sources developed by Elastic vs. those contributed by the open source community. We'll encourage any future support questions/requests about this connector tag @sandflysecurity so that you can assist.
|
Excellent and thanks for the update. Let me know if there is anything else you need from us. |
|
@sandflysnapp Great! Whenever you are able, go ahead and update this branch with |
Done, thanks. |
|
buildkite test this |
💔 Failed to create backport PR(s)The backport operation could not be completed due to the following error: The backport PRs will be merged automatically after passing CI. To backport manually run: |
Closes #3510
New connector for Sandfly Security
Sandfly Security
Sandfly is an agentless, instantly deployable, and safe Linux Endpoint Detection and Response (EDR) platform. Sandfly protects virtually any Linux system, from modern cloud deployments to decade-old devices, regardless of distribution or CPU architecture. And, we do it without loading agents on your endpoints that can cause performance and stability impacts.
Besides traditional EDR capabilities, Sandfly also tracks SSH credentials, audits for weak passwords, detects unauthorized changes with drift detection, and allows custom modules to help incident responders find emerging threats.
Sandfly connector
The connector will initiate a REST API connection to the Sandfly Server with the supplied credentials and ingest the following types of data:
Checklists
Pre-Review Checklist
config.yml.example)v7.13.2,v7.14.0,v8.0.0)Changes Requiring Extra Attention
Release Note