Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Comments

[BugFix] Removescript_block_signature - Performance Problems#15907

Merged
marc-gr merged 2 commits intomainfrom
rm_script_block_signature
Nov 10, 2025
Merged

[BugFix] Removescript_block_signature - Performance Problems#15907
marc-gr merged 2 commits intomainfrom
rm_script_block_signature

Conversation

@w0rk3r
Copy link
Contributor

Proposed commit message

Remove the `script_block_signature` field to improve pipeline performance.

Summary

It seems that the gsub processor I added in#15834 to handle the way PowerShell scripts contain the signature is too expensive and it is causing performance problems.

As I mentioned in#15834, the field was not being populated in my cluster and detection rules telemetry, and will not be populated in most PowerShell scripts as it ends up being split in two different events, so I propose to remove it to solve the problem.

Another point is that most PowerShell scripts with signatures end up having them truncated, since PowerShell logs have size limits, the signature often gets split across two events (Example).

Checklist

  • I have reviewedtips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package'schangelog.yml file.
  • I have verified that Kibana version constraints are current according toguidelines.
  • I have verified that any added dashboard complies with Kibana'sDashboard good practices

thau0x01 reacted with thumbs up emoji
@w0rk3rw0rk3r requested a review frommarc-grNovember 9, 2025 21:20
@w0rk3rw0rk3r self-assigned thisNov 9, 2025
@w0rk3rw0rk3r added bugfixPull request that fixes a bug issue Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations] labelsNov 9, 2025
@w0rk3rw0rk3r requested review froma team ascode ownersNovember 9, 2025 21:20
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod

🚀 Benchmarks report

To see the full report comment with/test benchmark fullreport

@elasticmachine
Copy link

💚 Build Succeeded

History

cc@w0rk3r

@pierrehilbertpierrehilbert added the Team:Elastic-Agent-Data-PlaneAgent Data Plane team [elastic/elastic-agent-data-plane] labelNov 10, 2025
@elasticmachine
Copy link

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@marc-grmarc-gr merged commit7f2ab1f intomainNov 10, 2025
7 checks passed
@marc-grmarc-gr deleted the rm_script_block_signature branchNovember 10, 2025 11:47
@elastic-vault-github-plugin-prod

Package windows - 3.2.2 containing this change is available athttps://epr.elastic.co/package/windows/3.2.2/

@andrewkrohandrewkroh added documentationImprovements or additions to documentation. Applied to PRs that modify *.md files. Integration:windowsWindows labelsNov 10, 2025
tehbooom pushed a commit to tehbooom/integrations that referenced this pull requestNov 19, 2025
…tic#15907)* [BugFix] Remove `script_block_signature` - Performance Problems* ++
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@marc-grmarc-grmarc-gr approved these changes

@AndersonQAndersonQAwaiting requested review from AndersonQAndersonQ is a code owner automatically assigned from elastic/elastic-agent-data-plane

@VihasMakwanaVihasMakwanaAwaiting requested review from VihasMakwanaVihasMakwana is a code owner automatically assigned from elastic/elastic-agent-data-plane

Assignees

@w0rk3rw0rk3r

Labels

bugfixPull request that fixes a bug issuedocumentationImprovements or additions to documentation. Applied to PRs that modify *.md files.Integration:windowsWindowsTeam:Elastic-Agent-Data-PlaneAgent Data Plane team [elastic/elastic-agent-data-plane]Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@w0rk3r@elasticmachine@marc-gr@pierrehilbert@andrewkroh

[8]ページ先頭

©2009-2026 Movatter.jp