-
Notifications
You must be signed in to change notification settings - Fork 526
ti_misp: Fix the processing of ISO8601 dates #11402
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ti_misp: Fix the processing of ISO8601 dates #11402
Conversation
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
|
|
|
Remember to convert the commit message from md, git history is not markdown. |
|
Package ti_misp - 1.35.6 containing this change is available at https://epr.elastic.co/search?package=ti_misp |
The current implementation assumes that first_seen and last_seen attributes are in UNIX epoch format, microseconds granularity. Now we have seen examples of dates in ISO8601 format, as the MISP documentation states. Changes introduced at this PR make sure that the pipeline is able to process both formats.
The current implementation assumes that first_seen and last_seen attributes are in UNIX epoch format, microseconds granularity. Now we have seen examples of dates in ISO8601 format, as the MISP documentation states. Changes introduced at this PR make sure that the pipeline is able to process both formats.




Proposed commit message
The current implementation assumes that
first_seenandlast_seenattributes are in UNIX epoch format, microseconds granularity.Now we have seen examples of dates in ISO8601 format, as the MISP documentation states. Leading to the following error:
Changes introduced at this PR make sure that the pipeline is able to process both formats.
Checklist
changelog.ymlfile.