Commits on Feb 25, 2021

1. [Security Solution][Detections] Set default indicator path to reduce … …

   …friction with new filebeat modules (elastic#92081)
   
   * Distinguish source and destination config for indicator matches
   
   We were previously conflating the path to retrieve indicator fields with
   the path to persist indicator fields, since they were the same value.
   
   To reduce friction in use with the new filebeat modules, we've decided
   to make the default source path threatintel.indicator. However, we still
   want to persist to threat.indicator, so we add a new constant, here.
   
   * Update our integration tests following change of default
   
   These tests were assuming a default path of threat.indicator. Since that
   is the ECS standard, we're not going to rewrite the tests but instead
   just add this rule override. In the future if the default changes, this
   parameter might be unnecessary.
   
   * DRY up unit tests a bit
   
   * Add a note for future devs
   
   If/when that constant changes, I imagine this will be useful context.
   
   Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

   

   rylnd and kibanamachine committed Feb 25, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for 39523a9
   • Browse repository at this point

   Copy the full SHA

   39523a9 View commit details

   Browse the repository at this point in the history