diff --git a/packages/o365/changelog.yml b/packages/o365/changelog.yml index e5efd5989bd..eb76e1969af 100644 --- a/packages/o365/changelog.yml +++ b/packages/o365/changelog.yml @@ -1,4 +1,11 @@ # newer versions go on top +- version: "2.16.1" + changes: + - description: | + Ignore failures in rename process for organization fields to avoid collision with Agentless organization field. + This is a temporary workaround until https://github.com/elastic/kibana/issues/221312 is addressed. + type: bugfix + link: https://github.com/elastic/integrations/pull/13983 - version: "2.16.0" changes: - description: Populate `message` field from the O365 Audit Log `Name` field instead of `Comments` in SecurityComplianceAlerts events to better reflect Alert Titles. diff --git a/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index ab43289afdc..c058b4a0fe1 100644 --- a/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -85,6 +85,7 @@ processors: field: o365audit.OrganizationId target_field: organization.id ignore_missing: true + ignore_failure: true - json: tag: json-extract-stringly-AdditionalInfo @@ -361,6 +362,7 @@ processors: field: o365audit.OrganizationName target_field: organization.name ignore_missing: true + ignore_failure: true if: ctx.event?.code == "ExchangeAdmin" - rename: field: o365audit.OriginatingServer @@ -388,6 +390,7 @@ processors: field: o365audit.OrganizationName target_field: organization.name ignore_missing: true + ignore_failure: true if: ctx.event?.code == "ExchangeItem" - rename: field: o365audit.OriginatingServer @@ -1092,6 +1095,7 @@ processors: - lowercase: field: organization.id ignore_missing: true + ignore_failure: true - set: field: host.id copy_from: organization.id diff --git a/packages/o365/manifest.yml b/packages/o365/manifest.yml index 1c2ea164baa..d09449c4d49 100644 --- a/packages/o365/manifest.yml +++ b/packages/o365/manifest.yml @@ -1,6 +1,6 @@ name: o365 title: Microsoft Office 365 -version: "2.16.0" +version: "2.16.1" description: Collect logs from Microsoft Office 365 with Elastic Agent. type: integration format_version: "3.2.3"