XSUP-46487 - Linux Parsing Rule Update (#38492)

* Updated ParsingRules * Updated ReleaseNotes * Updated ReleaseNotes
demisto · Feb 4, 2025 · 011e1f7 · 011e1f7
1 parent 7edf618
commit 011e1f7
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/...tion/ParsingRules/LinuxEventsCollectionParsingRules/LinuxEventsCollectionParsingRules.xif b/...tion/ParsingRules/LinuxEventsCollectionParsingRules/LinuxEventsCollectionParsingRules.xif
@@ -1,6 +1,6 @@
 [INGEST:vendor="linux", product="linux", target_dataset="linux_linux_raw", no_hit=keep]
 // Filter applies to log records which contain a full RFC 3339 / ISO 8601 style timestamp with an explicit timezone offset or Zulu time suffix (UTC)
-filter _raw_log ~= "\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s*(?:[+-]\d{2}:?\d{2}|Z)"
+filter _raw_log ~= "\d{4}\-\d{2}\-\d{2}[T\s]\d{2}:\d{2}:\d{2}(?:\.\d+)?\s*(?:[+-]\d{2}:?\d{2}|Z)" and _raw_log not contains "kubelet-serving: Certificate expiration"
 | alter tmp_json_payload = arrayindex(regextract(_raw_log, "({.+})"), 0) // extract inner json payload from _raw_log if such exists
 | alter tmp_timestamp = coalesce( // extract timestamp field from json payload if it exists or the raw text if it does not
     tmp_json_payload -> time,

diff --git a/Packs/LinuxEventsCollection/ReleaseNotes/1_0_15.md b/Packs/LinuxEventsCollection/ReleaseNotes/1_0_15.md
@@ -0,0 +1,6 @@
+
+#### Parsing Rules
+
+##### Linux Events Collection Parsing Rule
+
+- Updated the Linux Events Collection Parsing Rule logic to disregard **kubelet-serving: Certificate expiration** log messages for timestamp ingestion.
diff --git a/Packs/LinuxEventsCollection/pack_metadata.json b/Packs/LinuxEventsCollection/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Linux Events Collection",
     "description": "Linux is an operating system for servers, desktops, cloud, and IoTs",
     "support": "xsoar",
-    "currentVersion": "1.0.14",
+    "currentVersion": "1.0.15",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",