Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Cilium Tetragon integration #11610

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Add Cilium Tetragon integration #11610

wants to merge 7 commits into from

Conversation

mjwolf
Copy link
Contributor

@mjwolf mjwolf commented Oct 31, 2024

Proposed commit message

Add an integration to capture data from Cilium Tetragon.

As Tetragon is a cloud-native tool, the deployment model of this integration is a bit different than most. It doesn't require, or support, being installed with Elastic Agent or Fleet. Instead, data is ingested by setting up a filebeat sidecar container in the Tetragon k8s pod. The instructions on how to do this are in the integration README.

This integration mainly exists as an easy way to package the elasticsearch assets required, the ingest pipeline and index template, and to make support for Tetragon easy to find by having it published in the package registry.

There are no dashboards included with this integration because the Tetragon data can work with the existing default security dashboards.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Follow steps from the integration's README to install the integration with Tetragon

@mjwolf mjwolf added enhancement New feature or request Team:Security-Deployment and Devices Deployment and Devices Security team [elastic/sec-deployment-and-devices] labels Oct 31, 2024
@elasticmachine
Copy link

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

@mjwolf mjwolf requested a review from a team October 31, 2024 21:27
@elasticmachine
Copy link

elasticmachine commented Oct 31, 2024

💔 Build Failed

Failed CI Steps

History

Copy link

Quality Gate failed Quality Gate failed

Failed conditions
28.5% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request New Integration Team:Security-Deployment and Devices Deployment and Devices Security team [elastic/sec-deployment-and-devices]
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants