From 2a2df62c81e0fe02f16e419dd3f9a3ef91d1c840 Mon Sep 17 00:00:00 2001 From: chemamartinez Date: Tue, 4 Aug 2026 17:53:56 +0200 Subject: [PATCH 1/3] Use inclusive >= cursor boundary for host data stream --- packages/crowdstrike/changelog.yml | 5 +++++ .../host/_dev/test/policy/test-default.expected | 10 ++++++++-- .../data_stream/host/agent/stream/cel.yml.hbs | 10 ++++++++-- packages/crowdstrike/manifest.yml | 2 +- 4 files changed, 22 insertions(+), 5 deletions(-) diff --git a/packages/crowdstrike/changelog.yml b/packages/crowdstrike/changelog.yml index fc14c2ea1ef..015a4fe38cb 100644 --- a/packages/crowdstrike/changelog.yml +++ b/packages/crowdstrike/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "4.5.1" + changes: + - description: Use inclusive >= cursor boundary in host CEL program to avoid permanently skipping same-timestamp records at page or error boundaries. + type: bugfix + link: https://github.com/elastic/integrations/pull/20190 - version: "4.5.0" changes: - description: Map CommandHistory events to ECS process fields. diff --git a/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected b/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected index a41426ca6dc..6ce67b558ad 100644 --- a/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected +++ b/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected @@ -45,7 +45,10 @@ inputs: optional.of( [ [ - ?filter.optMap(f, "modified_timestamp:>\"" + f + "\""), + // Inclusive lower bound: records sharing the boundary timestamp can span a page + // or error boundary, so ">=" avoids permanently skipping same-timestamp records. + // Re-fetched records are de-duplicated downstream by the fingerprint _id + ?filter.optMap(f, "modified_timestamp:>=\"" + f + "\""), ?state.?query.optMap(q, "(" + q + ")"), ].join("+"), ] @@ -154,7 +157,10 @@ inputs: "sort": ["modified_timestamp|asc"], "filter": [ [ - "modified_timestamp:>'" + start_time + "'", + // Inclusive lower bound: records sharing the boundary timestamp can span a page + // or error boundary, so ">=" avoids permanently skipping same-timestamp records. + // Re-fetched records are de-duplicated downstream by the fingerprint _id + "modified_timestamp:>='" + start_time + "'", ?state.?query.optMap(q, "(" + q + ")"), ].join("+"), ], diff --git a/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs b/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs index a7d3ee90272..63ce5c6b920 100644 --- a/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs +++ b/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs @@ -64,7 +64,10 @@ program: |- optional.of( [ [ - ?filter.optMap(f, "modified_timestamp:>\"" + f + "\""), + // Inclusive lower bound: records sharing the boundary timestamp can span a page + // or error boundary, so ">=" avoids permanently skipping same-timestamp records. + // Re-fetched records are de-duplicated downstream by the fingerprint _id + ?filter.optMap(f, "modified_timestamp:>=\"" + f + "\""), ?state.?query.optMap(q, "(" + q + ")"), ].join("+"), ] @@ -173,7 +176,10 @@ program: |- "sort": ["modified_timestamp|asc"], "filter": [ [ - "modified_timestamp:>'" + start_time + "'", + // Inclusive lower bound: records sharing the boundary timestamp can span a page + // or error boundary, so ">=" avoids permanently skipping same-timestamp records. + // Re-fetched records are de-duplicated downstream by the fingerprint _id + "modified_timestamp:>='" + start_time + "'", ?state.?query.optMap(q, "(" + q + ")"), ].join("+"), ], diff --git a/packages/crowdstrike/manifest.yml b/packages/crowdstrike/manifest.yml index 11adba50b19..df73f1f36d7 100644 --- a/packages/crowdstrike/manifest.yml +++ b/packages/crowdstrike/manifest.yml @@ -1,6 +1,6 @@ name: crowdstrike title: CrowdStrike -version: "4.5.0" +version: "4.5.1" description: Collect logs from Crowdstrike with Elastic Agent. type: integration format_version: "3.4.0" From 4fa98762de291f996e4b275e2385b88c1f0fb20e Mon Sep 17 00:00:00 2001 From: chemamartinez Date: Tue, 4 Aug 2026 17:58:17 +0200 Subject: [PATCH 2/3] Update changelog --- packages/crowdstrike/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/crowdstrike/changelog.yml b/packages/crowdstrike/changelog.yml index 015a4fe38cb..e6fa3c105c7 100644 --- a/packages/crowdstrike/changelog.yml +++ b/packages/crowdstrike/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Use inclusive >= cursor boundary in host CEL program to avoid permanently skipping same-timestamp records at page or error boundaries. type: bugfix - link: https://github.com/elastic/integrations/pull/20190 + link: https://github.com/elastic/integrations/pull/20524 - version: "4.5.0" changes: - description: Map CommandHistory events to ECS process fields. From a7774fce7ebca9250961f4e1266e4cafd1117e00 Mon Sep 17 00:00:00 2001 From: chemamartinez Date: Wed, 5 Aug 2026 11:34:19 +0200 Subject: [PATCH 3/3] Reset offset on failures --- .../data_stream/host/_dev/test/policy/test-default.expected | 2 ++ packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs | 2 ++ 2 files changed, 4 insertions(+) diff --git a/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected b/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected index 6ce67b558ad..b453936356a 100644 --- a/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected +++ b/packages/crowdstrike/data_stream/host/_dev/test/policy/test-default.expected @@ -84,6 +84,7 @@ inputs: ), }, }, + "offset": 0, "want_more": false, "next": {}, } @@ -131,6 +132,7 @@ inputs: ), }, }, + "offset": 0, "want_more": false, "next": {}, } diff --git a/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs b/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs index 63ce5c6b920..58659496cc1 100644 --- a/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs +++ b/packages/crowdstrike/data_stream/host/agent/stream/cel.yml.hbs @@ -103,6 +103,7 @@ program: |- ), }, }, + "offset": 0, "want_more": false, "next": {}, } @@ -150,6 +151,7 @@ program: |- ), }, }, + "offset": 0, "want_more": false, "next": {}, }