ti_abusech: Update Fleet status message on API 402

packages/tenable_io/changelog.yml

@@ -1,7 +1,7 @@
 # newer versions go on top
 - version: "3.10.1"
   changes:
-    - description: Fix default request trace enabled behavior.
+    - description: Update Fleet error message on API 402.
       type: bugfix
       link: https://github.com/elastic/integrations/pull/13712
 - version: "3.10.0"

packages/ti_abusech/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.9.3"
+  changes:
+    - description: Avoid agent DEGRADED state on API 402.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/13718
 - version: "2.9.2"
   changes:
     - description: Fix default request trace enabled behavior.

packages/ti_abusech/data_stream/malware/agent/stream/cel.yml.hbs

@@ -42,6 +42,22 @@ program: |
         ),
         "url": state.url
       })
+    : resp.StatusCode == 402 ?
+      {
+        "events": [{
+          "error": {
+            "code": string(resp.StatusCode),
+            "id": string(resp.Status),
+            "message": "GET "+ state.url.trim_right("/") + ":" + (
+              size(resp.Body) != 0 ?
+                string(resp.Body)
+              :
+                string(resp.Status) + ' (' + string(resp.StatusCode) + ')'
+            ) + "\n Use Auth Key (API Key) to avoid rate limiting issues. Please refer https://abuse.ch/blog/community-first/",
+          },
+        }],
+        "want_more": false,
+      }
     :
       {
         "events": {

packages/ti_abusech/data_stream/malware/elasticsearch/ingest_pipeline/default.yml

@@ -7,6 +7,10 @@ processors:
   - set:
       field: ecs.version
       value: '8.11.0'
+  - fail:
+      tag: data_collection_error
+      if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null
+      message: error message set and no data to process.
   - set:
       field: event.kind
       value: enrichment

packages/ti_abusech/data_stream/malwarebazaar/agent/stream/cel.yml.hbs

@@ -60,13 +60,29 @@ program: |
           "url": state.url
         }
       )
+    : resp.StatusCode == 402 ?
+      {
+        "events": {
+          "error": {
+            "code": string(resp.StatusCode),
+            "id": string(resp.Status),
+            "message": "POST "+ state.url.trim_right("/") + ":" + (
+              size(resp.Body) != 0 ?
+                string(resp.Body)
+              :
+                string(resp.Status) + ' (' + string(resp.StatusCode) + ')'
+            ) + "\n Use Auth Key (API Key) to avoid rate limiting issues. Please refer https://abuse.ch/blog/community-first/",
+          },
+        },
+        "want_more": false,
+      }
     :
       {
         "events": {
           "error": {
             "code": string(resp.StatusCode),
             "id": string(resp.Status),
-            "message": "POST:"+(
+            "message": "POST "+ state.url.trim_right("/") + ":" + (
               size(resp.Body) != 0 ?
                 string(resp.Body)
               :

packages/ti_abusech/data_stream/malwarebazaar/elasticsearch/ingest_pipeline/default.yml

@@ -7,6 +7,10 @@ processors:
   - set:
       field: ecs.version
       value: '8.11.0'
+  - fail:
+      tag: data_collection_error
+      if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null
+      message: error message set and no data to process.
   - set:
       field: event.kind
       value: enrichment

packages/ti_abusech/data_stream/threatfox/agent/stream/cel.yml.hbs

@@ -48,6 +48,22 @@ program: |
         "initial_interval": state.initial_interval,
         "url": state.url
       })
+    : resp.StatusCode == 402 ?
+      {
+        "events": {
+          "error": {
+            "code": string(resp.StatusCode),
+            "id": string(resp.Status),
+            "message": "POST "+ state.url.trim_right("/") + ":" + (
+              size(resp.Body) != 0 ?
+                string(resp.Body)
+              :
+                string(resp.Status) + ' (' + string(resp.StatusCode) + ')'
+            ) + "\n Use Auth Key (API Key) to avoid rate limiting issues. Please refer https://abuse.ch/blog/community-first/",
+          },
+        },
+        "want_more": false,
+      }
     :
       {
         "events": {

packages/ti_abusech/data_stream/threatfox/elasticsearch/ingest_pipeline/default.yml

@@ -7,6 +7,10 @@ processors:
   - set:
       field: ecs.version
       value: '8.11.0'
+  - fail:
+      tag: data_collection_error
+      if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null
+      message: error message set and no data to process.
   - set:
       field: event.kind
       value: enrichment

packages/ti_abusech/data_stream/url/agent/stream/cel.yml.hbs

@@ -49,6 +49,22 @@ program: |
           "url": state.url
         }
       )
+    : resp.StatusCode == 402 ?
+      {
+        "events": {
+          "error": {
+            "code": string(resp.StatusCode),
+            "id": string(resp.Status),
+            "message": "GET "+ state.url.trim_right("/") + ":" + (
+              size(resp.Body) != 0 ?
+                string(resp.Body)
+              :
+                string(resp.Status) + ' (' + string(resp.StatusCode) + ')'
+            ) + "\n Use Auth Key (API Key) to avoid rate limiting issues. Please refer https://abuse.ch/blog/community-first/",
+          },
+        },
+        "want_more": false,
+      }
     :
       {
         "events": {

packages/ti_abusech/data_stream/url/elasticsearch/ingest_pipeline/default.yml

@@ -7,6 +7,10 @@ processors:
   - set:
       field: ecs.version
       value: '8.11.0'
+  - fail:
+      tag: data_collection_error
+      if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null
+      message: error message set and no data to process.
   - set:
       field: event.kind
       value: enrichment

packages/ti_abusech/manifest.yml

@@ -1,6 +1,6 @@
 name: ti_abusech
 title: AbuseCH
-version: "2.9.2"
+version: "2.9.3"
 description: Ingest threat intelligence indicators from URL Haus, Malware Bazaar, and Threat Fox feeds with Elastic Agent.
 type: integration
 format_version: "3.2.3"