Skip to content

Add packetbeat migration to siem docs#6695

Draft
sodhikirti07 wants to merge 3 commits into
mainfrom
add-packetbeat-migration-to-siem-docs
Draft

Add packetbeat migration to siem docs#6695
sodhikirti07 wants to merge 3 commits into
mainfrom
add-packetbeat-migration-to-siem-docs

Conversation

@sodhikirti07
Copy link
Copy Markdown
Contributor

Summary

In 9.5, we are migrating two packetbeat jobs from the security_packetbeat module to the security_network module to improve compatibility with additional integrations such as Defend. This PR updates the list of security_packetbeat and security_network jobs accordingly.

  • The packetbeat jobs packetbeat_dns_tunneling_ea and packetbeat_rare_dns_question_ea are updated from tag version 9.4+ to ga 9.0- 9.4. Moving forward, these jobs will no longer exist under the security_packetbeat module.
  • Starting in 9.5, these jobs are renamed to dns_tunneling_ea and rare_dns_question_ea and moved under the security_network module with a tag version of 9.5+.

Generative AI disclosure

  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?
  • Yes
  • No

@github-actions
Copy link
Copy Markdown
Contributor

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

  • Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 25, 2026

🔍 Preview links for changed docs

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 25, 2026

✅ Vale Linting Results

No issues found on modified lines!


The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

::::{applies-switch}

:::{applies-item} {stack: ga 9.4+, serverless: ga}
:::{applies-item} {stack: ga 9.0-9.4}
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this 9.0-9.4 and is there other working examples of this syntax?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added 9.0-9.4 here as this job will not exist after 9.4. I think you could refer to the jobs tagged with stack 9.0-9.3.
Can someone from the docs team also confirm the tag? @natasha-moore-elastic

Copy link
Copy Markdown
Contributor

@natasha-moore-elastic natasha-moore-elastic May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @sodhikirti07, if I remember correctly, the _ea suffixed jobs were only introduced in 9.4. If this is being removed in 9.5 (i.e. it will exist in 9.4 only), then the syntax should be {stack: removed 9.5+, ga =9.4}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, updated the tags on packetbeat jobs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants