sentinel_one: fix duplicate event ingestion in threat_event and application_risk#20211
Merged
Merged
Conversation
efd6
added
Integration:sentinel_one
efd6
force-pushed
the
s7342-sentinel_one-highwater
branch
from
July 19, 2026 21:32
23ddcba to
25194e0
Compare
Contributor
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
Contributor
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
threat_event |
10060.36 | 5952.38 | -4107.98 (-40.83%) | 💔 |
application_risk |
13661.2 | 9442.87 | -4218.33 (-30.88%) | 💔 |
threat_event |
10060.36 | 8163.27 | -1897.09 (-18.86%) | 💔 |
To see the full report comment with /test benchmark fullreport
efd6
marked this pull request as ready for review
July 19, 2026 22:28
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
…cation_risk Add a time watermark (updatedAt__gte) to the threat_event CEL program so each interval only fetches threats updated since the last completed walk, rather than re-walking the entire catalog. The high-water mark is tracked in cursor.last_timestamp and seeded from a new initial_interval manifest variable on the first run. The default poll interval drops from 24h to 5m since the watermark eliminates full re-walks. Add fingerprint processors to both the threat_event and application_risk ingest pipelines so that re-emitted documents with the same id are rejected within a backing index rather than accumulating as duplicates.
efd6
force-pushed
the
s7342-sentinel_one-highwater
branch
from
July 20, 2026 08:10
25194e0 to
5e2e95f
Compare
Contributor
|
✅ All changelog entries have the correct PR link. |
💚 Build Succeeded
History
cc @efd6 |
mohitjha-elastic
approved these changes
Jul 20, 2026
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
Contributor
|
Package sentinel_one - 2.11.1 containing this change is available at https://epr.elastic.co/package/sentinel_one/2.11.1/ |
christophercutajar
pushed a commit
to christophercutajar/integrations
that referenced
this pull request
Jul 21, 2026
…cation_risk (elastic#20211) Add a time watermark (updatedAt__gte) to the threat_event CEL program so each interval only fetches threats updated since the last completed walk, rather than re-walking the entire catalog. The high-water mark is tracked in cursor.last_timestamp and seeded from a new initial_interval manifest variable on the first run. The default poll interval drops from 24h to 5m since the watermark eliminates full re-walks. Add fingerprint processors to both the threat_event and application_risk ingest pipelines so that re-emitted documents with the same id are rejected within a backing index rather than accumulating as duplicates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots