Skip to content

{,ti_}crowdstrike: set User-Agent header for HTTP requests#20241

Open
efd6 wants to merge 1 commit into
elastic:mainfrom
efd6:14136-crowdstrike
Open

{,ti_}crowdstrike: set User-Agent header for HTTP requests#20241
efd6 wants to merge 1 commit into
elastic:mainfrom
efd6:14136-crowdstrike

Conversation

@efd6

@efd6 efd6 commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

{,ti_}crowdstrike: set User-Agent header for HTTP requests

The value of the header is set to Elastic-crowdstrike/x.y.z where x.y.z
is the package version if it is available (this is the case for stacks
at or above 9.3), otherwise the version is set to "unknown".

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@efd6 efd6 self-assigned this Jul 21, 2026
@efd6 efd6 added enhancement New feature or request Integration:crowdstrike CrowdStrike Integration:ti_crowdstrike CrowdStrike Falcon Intelligence Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Jul 21, 2026
@efd6
efd6 force-pushed the 14136-crowdstrike branch from 27294bf to 27663bc Compare July 21, 2026 03:04
@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@efd6 efd6 mentioned this pull request Jul 21, 2026
Open
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

Package crowdstrike 👍(7) 💚(4) 💔(3)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
falcon 5154.64 2948.98 -2205.66 (-42.79%) 💔
identity_protection_timeline 8223.68 6906.08 -1317.6 (-16.02%) 💔
falcon 5154.64 3891.05 -1263.59 (-24.51%) 💔

To see the full report comment with /test benchmark fullreport

andrewkroh
andrewkroh reviewed Jul 24, 2026
View reviewed changes

@andrewkroh andrewkroh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This approach LGTM.

Comment thread packages/crowdstrike/data_stream/alert/_dev/test/policy/test-traced.expected
state:
batch_size: 1000
initial_interval: 24h
user_agent: Elastic-crowdstrike/unknown

@andrewkroh andrewkroh Jul 24, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This unknown string in the golden file will change depending on the Kibana version and the package version and certainly presents a testing challenge.

@efd6 efd6 Jul 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this is a concern. With the current state of the package (kibana.version before 9.3) we will not see any instability except in periodic serverless CI builds, after that it will be required to update the policy golden files for each package version bump. At the moment, there will always be CI build failures with the serverless CI builds since they will be using a version that is after 9.3. I have sent elastic/elastic-package#3771 to address both of these.

@efd6
efd6 force-pushed the 14136-crowdstrike branch from 27663bc to 680ba4b Compare July 27, 2026 02:07
@efd6
{,ti_}crowdstrike: set User-Agent header for HTTP requests
403c9b8 
The value of the header is set to Elastic-crowdstrike/x.y.z where x.y.z
is the package version if it is available (this is the case for stacks
at or above 9.3), otherwise the version is set to "unknown".
@efd6
efd6 force-pushed the 14136-crowdstrike branch from 680ba4b to 403c9b8 Compare July 27, 2026 02:09
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 27, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @efd6

@efd6
efd6 marked this pull request as ready for review July 27, 2026 04:11
@efd6
efd6 requested review from a team as code owners July 27, 2026 04:11
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 27, 2026

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@vera-review-bot

vera-review-bot Bot commented Jul 27, 2026

Copy link
Copy Markdown

⚠️ @efd6 I couldn't complete the review for commits 403c9b8 after several attempts. A maintainer can re-run it with @vera-review-bot review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewkroh andrewkroh andrewkroh left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@efd6 efd6

Labels

enhancement New feature or request Integration:crowdstrike CrowdStrike Integration:ti_crowdstrike CrowdStrike Falcon Intelligence Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@efd6 @andrewkroh