Update review-database dependency - #916
Conversation
Allow packet-attribute triage policies to select DCE/RPC events now that review-database exposes the corresponding raw event kind. Cover the GraphQL input and output conversion with a policy round-trip test. Closes #873
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #916 +/- ##
==========================================
+ Coverage 85.33% 85.96% +0.63%
==========================================
Files 77 77
Lines 31160 31562 +402
==========================================
+ Hits 26591 27133 +542
+ Misses 4569 4429 -140 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Further test and documentation improvements were made to the existing changes. Coverage was added for country filtering without a locator and for originator/responder IP aggregation direction, the related CHANGELOG and documentation for |
|
@kimhanbeom What do you think about squashing 882 related commits to the second commit, and 883 related commits to the third commit? |
Use country codes stored with events for filtering and aggregation so event queries no longer depend on an IP2Location database at request time. Cover deployments without a configured event locator and keep the group query regression tests beside the resolvers they protect. Document the separate roles of the store and GraphQL IP locators. The dependency update also fixes mixed IPv4/IPv6 triage exclusions, so record that user-visible behavior in the release notes. Closes #882
Align event IP aggregations with the terminology used by the updated review-database API while preserving the existing GraphQL schema and aggregation behavior. Exercise the originator and responder GraphQL aggregations with distinct endpoint addresses so reversing the helper mapping cannot pass unnoticed. Closes #883
a9ebbb3 to
29c4132
Compare
|
@sophie-cluml |
2 participants
Summary
review-databaserevisiondf42710e13a640RawEventKind.ca438d1023257f61e01d8dd7bfd2Out of scope
The update to
review-databasecommit1285590, which migrates the event API tojiff::Timestamp, is deferred to a separate PR because it requires broader changes to GraphQL timestamp handling and related tests.Closes #873
Closes #882
Closes #883