Send Endpoint Alert _id field up as insights docs track that on status changes (#116687)
* Send Endpoint Alert _id field up as insights docs track that on status changes * Added test to make sure top-level underscore-prefixed fields are allowed Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
parent
b59b132ff4
commit
478d138c32
2 changed files with 4 additions and 0 deletions
|
@ -10,6 +10,7 @@ import { copyAllowlistedFields } from './filters';
|
|||
describe('Security Telemetry filters', () => {
|
||||
describe('allowlistEventFields', () => {
|
||||
const allowlist = {
|
||||
_id: true,
|
||||
a: true,
|
||||
b: true,
|
||||
c: {
|
||||
|
@ -19,12 +20,14 @@ describe('Security Telemetry filters', () => {
|
|||
|
||||
it('filters top level', () => {
|
||||
const event = {
|
||||
_id: 'id',
|
||||
a: 'a',
|
||||
a1: 'a1',
|
||||
b: 'b',
|
||||
b1: 'b1',
|
||||
};
|
||||
expect(copyAllowlistedFields(allowlist, event)).toStrictEqual({
|
||||
_id: 'id',
|
||||
a: 'a',
|
||||
b: 'b',
|
||||
});
|
||||
|
|
|
@ -105,6 +105,7 @@ const allowlistBaseEventFields: AllowlistFields = {
|
|||
// blindly. Object contents means that we only copy the fields that appear explicitly in
|
||||
// the sub-object.
|
||||
export const allowlistEventFields: AllowlistFields = {
|
||||
_id: true,
|
||||
'@timestamp': true,
|
||||
agent: true,
|
||||
Endpoint: true,
|
||||
|
|
Loading…
Reference in a new issue