💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

🤖 GitHub comments

Hi Colin,

Thanks for the PR!

Turning on preserve_original_event for the system tests and having that show in the sample event and documentation is good.

Currently, event.original should only be added if preserve_original_event is set, so I think removing it otherwise is redundant. Note that it's the preserve_original_event setting that determines adding the field and the tag, rather the field addition/retention being based on a tag added in another way.

I notice that the string conversion step is generating a stringified object that isn't in JSON format:
{standard_id=indicator--cde0a6e1-c622-52c4-b857-e9aeac56131b, ...} vs
{"standard_id":"indicator--cde0a6e1-c622-52c4-b857-e9aeac56131b", ...}.
I'm inclined to stringify to valid JSON where the field is inserted, in the CEL expression, like this:

diff --git a/packages/ti_opencti/data_stream/indicator/agent/stream/cel.yml.hbs b/packages/ti_opencti/data_stream/indicator/agent/stream/cel.yml.hbs
index 3f6d08388..f07a0025c 100644
--- a/packages/ti_opencti/data_stream/indicator/agent/stream/cel.yml.hbs
+++ b/packages/ti_opencti/data_stream/indicator/agent/stream/cel.yml.hbs
@@ -53,7 +53,7 @@ program: |
     bytes(resp.Body).decode_json().as(body, state.with({
       "events": body.data.indicators.edges.map(e, e.node.with(
         has(state.preserve_original_event) && state.preserve_original_event ?
-          { "event": { "original": e.node } } :
+          { "event": { "original": e.node.encode_json() } } :
           {}
       )),
       "want_more": body.data.indicators.pageInfo.hasNextPage,

What do you think?

Ah yes! I didn't actually double check the result in event.original :-(

Yeap, doing it there instead also makes sense, zero issues.

I'll adjust the PR.

/test

To make the tests pass, run elastic-package build and commit the updated packages/ti_opencti/docs/README.md.
(docs/README.md is generated from _dev/build/docs/README.md using Handlebars templating).

rebuild done

@colin-stubbs One more thing: there are conflicts to resolve, since a couple of other changes went in since the PR was opened.

🌐 Coverage report

Package ti_opencti - 0.3.1 containing this change is available at https://epr.elastic.co/search?package=ti_opencti