Adding new fields to the allowlist for alert telemetry (#90868)

elastic · Feb 10, 2021 · d1653bc · d1653bc
1 parent f563a82
commit d1653bc
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 0 deletions.
diff --git a/x-pack/plugins/security_solution/common/endpoint/generate_data.ts b/x-pack/plugins/security_solution/common/endpoint/generate_data.ts
@@ -558,6 +558,8 @@ export class EndpointDocGenerator {
             version: '3.0.33',
           },
           temp_file_path: 'C:/temp/fake_malware.exe',
+          quarantine_result: true,
+          quarantine_message: 'fake quarantine message',
         },
       },
       process: {

diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.test.ts
@@ -47,6 +47,8 @@ describe('TelemetryEventsSender', () => {
               malware_classification: {
                 key1: 'X',
               },
+              quarantine_result: true,
+              quarantine_message: 'this file is bad',
               something_else: 'nope',
             },
           },
@@ -79,6 +81,8 @@ describe('TelemetryEventsSender', () => {
               malware_classification: {
                 key1: 'X',
               },
+              quarantine_result: true,
+              quarantine_message: 'this file is bad',
             },
           },
           host: {

diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts b/x-pack/plugins/security_solution/server/lib/telemetry/sender.ts
@@ -320,6 +320,8 @@ const allowlistEventFields: AllowlistFields = {
     Ext: {
       code_signature: true,
       malware_classification: true,
+      quarantine_result: true,
+      quarantine_message: true,
     },
   },
   host: {