Skip to content

Commit 32be741

Browse files
anthonythleunganthonythleung
authored
[1Password] Add 1Password Events API Audit Events (#5496)
* add 1Password Events API audit events * update dashboard * bump kibana version
1 parent 4a47d75 commit 32be741

24 files changed

+2469
-1152
lines changed

‎packages/1password/_dev/build/docs/README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,14 @@ This uses the 1Password Events API to retrieve information about items in shared
3636
{{fields "item_usages"}}
3737

3838
{{event "item_usages"}}
39+
40+
41+
### Audit Events
42+
43+
This uses the 1Password Events API to retrieve information about audit events. Events includes information about actions performed by team members such as account updates, access and invitations, device authorization, changes to vault permissions, and more.
44+
45+
*Exported fields*
46+
47+
{{fields "audit_events"}}
48+
49+
{{event "audit_events"}}

‎packages/1password/_dev/deploy/docker/config.yml‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@ rules:
4444
- "application/json; charset=utf-8"
4545
body: |-
4646
{"cursor":"cursor_1","has_more":false,"items":[]}
47-
4847
# SignInAttempts
4948
- path: /api/v1/signinattempts
5049
methods: ["POST"]
@@ -91,3 +90,48 @@ rules:
9190
- "application/json; charset=utf-8"
9291
body: |-
9392
{"cursor":"cursor_1","has_more":false,"items":[]}
93+
- path: /api/v1/auditevents
94+
methods: ["POST"]
95+
request_headers:
96+
Content-Type:
97+
- "application/json"
98+
Authorization:
99+
- "Bearer --token--"
100+
request_body: '{"limit":1000}'
101+
responses:
102+
- status_code: 200
103+
headers:
104+
Content-Type:
105+
- "application/json; charset=utf-8"
106+
body: |-
107+
{"cursor":"cursor_0","has_more":false,"items":[{"uuid": "3UQOGUC7DVOCN4OZP2MDKHFLSG","timestamp": "2022-10-24T21:16:52.827288935Z","actor_uuid": "GLF6WUEKS5CSNDJ2OG6TCZD3M4","action": "suspend","object_type": "user","object_uuid":"ZRQCUD6A65AKHFETOUFO7NL4OM","session":{"uuid": "ODOHXUYQCJBUJKRGZNNPBJURPE","login_time": "2022-10-24T21:07:34.703106271Z","device_uuid":"rqtd557fn2husnstp5nc66w2xa","ip":"89.160.20.156"},"location":{"country":"Canada","region": "Ontario","city": "Toronto","latitude": 43.64,"longitude": -79.433}}]}
108+
- path: /api/v1/auditevents
109+
methods: ["POST"]
110+
request_headers:
111+
Content-Type:
112+
- "application/json"
113+
Authorization:
114+
- "Bearer --token--"
115+
request_body: '{"cursor":"cursor_0"}'
116+
responses:
117+
- status_code: 200
118+
headers:
119+
Content-Type:
120+
- "application/json; charset=utf-8"
121+
body: |-
122+
{"cursor":"cursor_1","has_more":false,"items":[{"uuid": "3UQOGUC7DVOCN4OZP2MDKHFLSG","timestamp": "2022-10-24T21:16:52.827288935Z","actor_uuid": "GLF6WUEKS5CSNDJ2OG6TCZD3M4","action": "suspend","object_type": "user","object_uuid":"ZRQCUD6A65AKHFETOUFO7NL4OM","session":{"uuid": "ODOHXUYQCJBUJKRGZNNPBJURPE","login_time": "2022-10-24T21:07:34.703106271Z","device_uuid":"rqtd557fn2husnstp5nc66w2xa","ip":"89.160.20.156"}}]}
123+
- path: /api/v1/auditevents
124+
methods: ["POST"]
125+
request_headers:
126+
Content-Type:
127+
- "application/json"
128+
Authorization:
129+
- "Bearer --token--"
130+
request_body: '{"cursor":"cursor_1"}'
131+
responses:
132+
- status_code: 200
133+
headers:
134+
Content-Type:
135+
- "application/json; charset=utf-8"
136+
body: |-
137+
{"cursor":"cursor_1","has_more":false,"items":[]}

‎packages/1password/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.10.0"
3+
changes:
4+
- description: Add audit events to 1Password Events Reporting
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/5496
27
- version: "1.9.0"
38
changes:
49
- description: Allow configuration of HTTP keep-alive to allow for connection reuse.

‎packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"events": [
3+
{
4+
"@timestamp": "2022-10-24T21:16:62.827288935Z",
5+
"message": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"},\"location\":{\"country\":\"Canada\",\"region\": \"Ontario\",\"city\": \"Toronto\",\"latitude\": 43.64,\"longitude\": -79.433}}"
6+
},
7+
{
8+
"@timestamp": "2022-10-24T21:16:62.827288935Z",
9+
"message": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"}}"
10+
}
11+
]
12+
}

‎packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json-config.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
fields:
2+
"@timestamp": "2022-10-24T21:16:62.827288935Z"
3+
tags:
4+
- preserve_original_event

‎packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json-expected.json‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2022-10-24T21:16:52.827Z",
5+
"ecs": {
6+
"version": "8.6.0"
7+
},
8+
"event": {
9+
"action": "suspend",
10+
"category": [
11+
"configuration"
12+
],
13+
"created": "2022-10-24T21:16:62.827288935Z",
14+
"kind": "event",
15+
"original": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"},\"location\":{\"country\":\"Canada\",\"region\": \"Ontario\",\"city\": \"Toronto\",\"latitude\": 43.64,\"longitude\": -79.433}}",
16+
"type": [
17+
"access"
18+
]
19+
},
20+
"onepassword": {
21+
"object_type": "user",
22+
"object_uuid": "ZRQCUD6A65AKHFETOUFO7NL4OM",
23+
"session": {
24+
"device_uuid": "rqtd557fn2husnstp5nc66w2xa",
25+
"login_time": "2022-10-24T21:07:34.703106271Z",
26+
"uuid": "ODOHXUYQCJBUJKRGZNNPBJURPE"
27+
},
28+
"uuid": "3UQOGUC7DVOCN4OZP2MDKHFLSG"
29+
},
30+
"related": {
31+
"ip": [
32+
"89.160.20.156"
33+
],
34+
"user": [
35+
"GLF6WUEKS5CSNDJ2OG6TCZD3M4",
36+
"ZRQCUD6A65AKHFETOUFO7NL4OM"
37+
]
38+
},
39+
"source": {
40+
"as": {
41+
"number": 29518,
42+
"organization": {
43+
"name": "Bredband2 AB"
44+
}
45+
},
46+
"geo": {
47+
"city_name": "Linköping",
48+
"continent_name": "Europe",
49+
"country_iso_code": "SE",
50+
"country_name": "Sweden",
51+
"location": {
52+
"lat": 58.4167,
53+
"lon": 15.6167
54+
},
55+
"region_iso_code": "SE-E",
56+
"region_name": "Östergötland County"
57+
},
58+
"ip": "89.160.20.156"
59+
},
60+
"tags": [
61+
"preserve_original_event"
62+
],
63+
"user": {
64+
"id": "GLF6WUEKS5CSNDJ2OG6TCZD3M4"
65+
}
66+
},
67+
{
68+
"@timestamp": "2022-10-24T21:16:52.827Z",
69+
"ecs": {
70+
"version": "8.6.0"
71+
},
72+
"event": {
73+
"action": "suspend",
74+
"category": [
75+
"configuration"
76+
],
77+
"created": "2022-10-24T21:16:62.827288935Z",
78+
"kind": "event",
79+
"original": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"}}",
80+
"type": [
81+
"access"
82+
]
83+
},
84+
"onepassword": {
85+
"object_type": "user",
86+
"object_uuid": "ZRQCUD6A65AKHFETOUFO7NL4OM",
87+
"session": {
88+
"device_uuid": "rqtd557fn2husnstp5nc66w2xa",
89+
"login_time": "2022-10-24T21:07:34.703106271Z",
90+
"uuid": "ODOHXUYQCJBUJKRGZNNPBJURPE"
91+
},
92+
"uuid": "3UQOGUC7DVOCN4OZP2MDKHFLSG"
93+
},
94+
"related": {
95+
"ip": [
96+
"89.160.20.156"
97+
],
98+
"user": [
99+
"GLF6WUEKS5CSNDJ2OG6TCZD3M4",
100+
"ZRQCUD6A65AKHFETOUFO7NL4OM"
101+
]
102+
},
103+
"source": {
104+
"as": {
105+
"number": 29518,
106+
"organization": {
107+
"name": "Bredband2 AB"
108+
}
109+
},
110+
"geo": {
111+
"city_name": "Linköping",
112+
"continent_name": "Europe",
113+
"country_iso_code": "SE",
114+
"country_name": "Sweden",
115+
"location": {
116+
"lat": 58.4167,
117+
"lon": 15.6167
118+
},
119+
"region_iso_code": "SE-E",
120+
"region_name": "Östergötland County"
121+
},
122+
"ip": "89.160.20.156"
123+
},
124+
"tags": [
125+
"preserve_original_event"
126+
],
127+
"user": {
128+
"id": "GLF6WUEKS5CSNDJ2OG6TCZD3M4"
129+
}
130+
}
131+
]
132+
}

‎packages/1password/data_stream/audit_events/_dev/test/system/test-default-config.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
input: httpjson
2+
service: 1password_eventsapi_mock
3+
vars:
4+
url: http://{{Hostname}}:{{Port}}
5+
token: --token--
6+
preserve_original_event: true
7+
data_stream:
8+
vars: ~
9+
assert:
10+
hit_count: 2

‎packages/1password/data_stream/audit_events/agent/stream/httpjson.yml.hbs‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
config_version: 2
2+
interval: {{interval}}
3+
request.url: {{url}}/api/v1/auditevents
4+
request.method: POST
5+
{{#if proxy_url }}
6+
request.proxy_url: {{proxy_url}}
7+
{{/if}}
8+
{{#if ssl}}
9+
request.ssl: {{ssl}}
10+
{{/if}}
11+
{{#if http_client_timeout}}
12+
request.timeout: {{http_client_timeout}}
13+
{{/if}}
14+
request.transforms:
15+
- set:
16+
target: "header.Content-Type"
17+
value: "application/json"
18+
- set:
19+
target: "header.User-Agent"
20+
value: "1Password-Elastic-Filebeat/0.1.0"
21+
- set:
22+
target: "header.Authorization"
23+
value: 'Bearer {{token}}'
24+
- set:
25+
target: body.cursor
26+
value: '[[if not (eq (len .cursor) 0)]][[.cursor.last_cursor]][[end]]'
27+
- set:
28+
target: body.limit
29+
value_type: int
30+
value: '[[if eq (len .cursor) 0]]{{limit}}[[end]]'
31+
cursor:
32+
last_cursor:
33+
value: '[[.last_response.body.cursor]]'
34+
response.decode_as: application/json
35+
response.split:
36+
target: body.items
37+
response.pagination:
38+
- set:
39+
target: body.cursor
40+
value: '[[.last_response.body.cursor]]'
41+
fail_on_template_error: true
42+
- delete:
43+
target: body.limit
44+
tags:
45+
{{#if preserve_original_event}}
46+
- preserve_original_event
47+
{{/if}}
48+
{{#each tags as |tag|}}
49+
- {{tag}}
50+
{{/each}}
51+
{{#contains "forwarded" tags}}
52+
publisher_pipeline.disable_host: true
53+
{{/contains}}
54+
{{#if processors}}
55+
processors:
56+
{{processors}}
57+
{{/if}}

0 commit comments

Comments
 (0)