Skip to content

Commit 9a72007

Browse files
bhapasbhapas
authored
[sentinel_one_cloud_funnel] Add system test for aws-s3 input (#8386)
* Add system test for aws-s3 input * Fix fields and bump version
1 parent d28782e commit 9a72007

File tree

10 files changed

+237
-81
lines changed

10 files changed

+237
-81
lines changed

‎packages/sentinel_one_cloud_funnel/_dev/deploy/tf/env.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: '2.3'
2+
services:
3+
terraform:
4+
environment:
5+
- AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
6+
- AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
7+
- AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
8+
- AWS_PROFILE=${AWS_PROFILE}
9+
- AWS_REGION=${AWS_REGION:-us-east-1}

‎packages/sentinel_one_cloud_funnel/_dev/deploy/tf/files/test-command-script.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"timestamp":"10:47:24.180","src.process.parent.isStoryline™Root":false,"event.category":"command_script","src.process.parent.image.sha1":"134fd2ad04cf59b0c10596230da5daf6fc711bd1","site.id":"123456789123456789","src.process.image.binaryIsExecutable":true,"src.process.parent.displayName":"MicrosoftCompatibilityTelemetry","src.process.user":"NTAUTHORITY\\SYSTEM","src.process.parent.subsystem":"SYS_WIN32","src.process.indicatorRansomwareCount":0,"src.process.crossProcessDupRemoteProcessHandleCount":0,"src.process.activeContent.signedStatus":"unsigned","src.process.tgtFileCreationCount":0,"src.process.indicatorInjectionCount":0,"src.process.moduleCount":284,"src.process.parent.name":"CompatTelRunner.exe","i.version":"preprocess-lib-1.0","src.process.activeContentType":"CLI","sca:atlantisIngestTime":1666684057507,"src.process.image.md5":"7353f60b1739074eb17c5f4dddefe239","src.process.indicatorReconnaissanceCount":8,"src.process.Storyline™.id":"87EE3C19E0250305","src.process.childProcCount":1,"mgmt.url":"asdf-123.sentinelone.org","src.process.crossProcessOpenProcessCount":0,"cmdScript.isComplete":true,"src.process.subsystem":"SYS_WIN32","meta.event.name":"SCRIPTS","src.process.parent.integrityLevel":"SYSTEM","src.process.indicatorExploitationCount":0,"src.process.parent.Storyline™.id":"87EE3C19E0250305","i.scheme":"edr","src.process.integrityLevel":"SYSTEM","site.name":"ASDF","src.process.netConnInCount":0,"event.time":1666684044180,"account.id":"123456789123456789","dataSource.name":"SentinelOne","endpoint.name":"asdf1","src.process.image.sha1":"6cbce4a295c163791b60fc23d285e6d84f28ee4c","src.process.isStoryline™Root":false,"cmdScript.applicationName":"PowerShell_C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe_10.0.17763.1","src.process.parent.image.path":"C:\\Windows\\System32\\CompatTelRunner.exe","src.process.pid":5912,"tgt.file.isSigned":"signed","sca:ingestTime":1666684063,"dataSource.category":"security","src.process.cmdline":"powershell.exe-ExecutionPolicyRestricted-CommandWrite-Host'Finalresult:1';","src.process.publisher":"MICROSOFTWINDOWS","src.process.crossProcessThreadCreateCount":0,"src.process.parent.isNative64Bit":false,"src.process.parent.isRedirectCmdProcessor":false,"src.process.signedStatus":"signed","src.process.crossProcessCount":0,"event.id":"01GG71RXEEHZQFY6XZ1WGS2BAE_168","src.process.parent.cmdline":"C:\\Windows\\system32\\CompatTelRunner.exe-m:appraiser.dll-f:DoScheduledTelemetryRun-cv:1DRRwZous0W15sCL.2","cmdScript.content":"$global:?","src.process.image.path":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","src.process.tgtFileModificationCount":4,"src.process.indicatorEvasionCount":1,"src.process.netConnOutCount":0,"cmdScript.sha256":"feb60de98632d9f666e16e89bd1c99174801c761115d4a9f52f05ef41e397d2d","src.process.crossProcessDupThreadHandleCount":0,"endpoint.os":"windows","src.process.tgtFileDeletionCount":0,"src.process.startTime":1666684041917,"mgmt.id":"1337","os.name":"WindowsServer2019Standard","src.process.activeContent.id":"3EFA3EFA3EFA3EFA","src.process.displayName":"WindowsPowerShell","src.process.activeContent.path":"\\\\Unknowndevice\\Unknownfile","src.process.isNative64Bit":false,"src.process.parent.sessionId":0,"src.process.uid":"230B188E26085676","src.process.parent.image.md5":"47dd94d79d9bac54a2c3a1cf502770c6","src.process.indicatorInfostealerCount":0,"src.process.indicatorBootConfigurationUpdateCount":0,"process.unique.key":"230B188E26085676","cmdScript.originalSize":18,"agent.version":"22.1.4.10010","src.process.parent.uid":"8608188E26085676","src.process.parent.image.sha256":"046f009960f70981597cd7b3a1e44cbb4ba5893cc1407734366aa55fbeda5d66","src.process.sessionId":0,"src.process.netConnCount":0,"mgmt.osRevision":"17763","group.id":"asdf","src.process.isRedirectCmdProcessor":false,"src.process.verifiedStatus":"verified","src.process.parent.publisher":"MICROSOFTWINDOWS","src.process.parent.startTime":1666683971590,"src.process.dnsCount":0,"endpoint.type":"server","trace.id":"01GG71RXEEHZQFY6XZ1WGS2BAE","src.process.name":"powershell.exe","agent.uuid":"asdf356783457dfds4456d65","src.process.activeContent.hash":"a8ae2c841e3f0f39d494a45370815a90cf00421e","src.process.image.sha256":"de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c","src.process.indicatorGeneralCount":49,"src.process.crossProcessOutOfStoryline™Count":0,"src.process.registryChangeCount":0,"packet.id":"9CB6AC4F10C34F5BB0A2788760E870F5","src.process.indicatorPersistenceCount":0,"src.process.parent.signedStatus":"signed","src.process.parent.user":"NTAUTHORITY\\SYSTEM","event.type":"CommandScript","src.process.indicatorPostExploitationCount":0,"src.process.parent.pid":6008}

‎packages/sentinel_one_cloud_funnel/_dev/deploy/tf/main.tf‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
provider "aws" {
2+
region = "us-east-1"
3+
default_tags {
4+
tags = {
5+
environment = var.ENVIRONMENT
6+
repo = var.REPO
7+
branch = var.BRANCH
8+
build = var.BUILD_ID
9+
created_date = var.CREATED_DATE
10+
}
11+
}
12+
}
13+
14+
resource "aws_s3_bucket" "bucket" {
15+
bucket = "elastic-package-sentinel-one-bucket-${var.TEST_RUN_ID}"
16+
}
17+
18+
resource "aws_sqs_queue" "queue" {
19+
name = "elastic-package-sentinel-one-queue-${var.TEST_RUN_ID}"
20+
policy = <<POLICY
21+
{
22+
"Version": "2012-10-17",
23+
"Statement": [
24+
{
25+
"Effect": "Allow",
26+
"Principal": "*",
27+
"Action": "sqs:SendMessage",
28+
"Resource": "arn:aws:sqs:*:*:elastic-package-sentinel-one-queue-${var.TEST_RUN_ID}",
29+
"Condition": {
30+
"ArnEquals": { "aws:SourceArn": "${aws_s3_bucket.bucket.arn}" }
31+
}
32+
}
33+
]
34+
}
35+
POLICY
36+
}
37+
38+
resource "aws_s3_bucket_notification" "bucket_notification" {
39+
bucket = aws_s3_bucket.bucket.id
40+
41+
queue {
42+
queue_arn = aws_sqs_queue.queue.arn
43+
events = ["s3:ObjectCreated:*"]
44+
}
45+
}
46+
47+
resource "aws_s3_object" "object" {
48+
bucket = aws_s3_bucket.bucket.id
49+
key = "command_script.log"
50+
source = "./files/test-command-script.log"
51+
52+
depends_on = [aws_sqs_queue.queue]
53+
}
54+
55+
output "queue_url" {
56+
value = aws_sqs_queue.queue.url
57+
}

‎packages/sentinel_one_cloud_funnel/_dev/deploy/tf/variables.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
variable "BRANCH" {
2+
description = "Branch name or pull request for tagging purposes"
3+
default = "unknown-branch"
4+
}
5+
6+
variable "BUILD_ID" {
7+
description = "Build ID in the CI for tagging purposes"
8+
default = "unknown-build"
9+
}
10+
11+
variable "CREATED_DATE" {
12+
description = "Creation date in epoch time for tagging purposes"
13+
default = "unknown-date"
14+
}
15+
16+
variable "ENVIRONMENT" {
17+
default = "unknown-environment"
18+
}
19+
20+
variable "REPO" {
21+
default = "unknown-repo-name"
22+
}
23+
24+
variable "TEST_RUN_ID" {
25+
default = "detached"
26+
}

‎packages/sentinel_one_cloud_funnel/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "0.7.1"
3+
changes:
4+
- description: Add missing fields from beats input
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/8386
27
- version: "0.7.0"
38
changes:
49
- description: Improve 'event.original' check to avoid errors if set.

‎packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/system/test-default-config.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
input: aws-s3
2+
wait_for_data_timeout: 20m
3+
vars:
4+
access_key_id: "{{AWS_ACCESS_KEY_ID}}"
5+
secret_access_key: "{{AWS_SECRET_ACCESS_KEY}}"
6+
session_token: "{{AWS_SESSION_TOKEN}}"
7+
queue_url: "{{TF_OUTPUT_queue_url}}"
8+
data_stream:
9+
vars:
10+
preserve_original_event: true
11+
file_selectors: |
12+
- regex: '^(.+?)\.log'

‎packages/sentinel_one_cloud_funnel/data_stream/event/fields/beats.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,18 @@
77
- name: tags
88
type: keyword
99
description: User defined tags.
10+
- name: aws.s3
11+
type: group
12+
fields:
13+
- name: bucket
14+
type: group
15+
fields:
16+
- name: name
17+
type: keyword
18+
- name: arn
19+
type: keyword
20+
- name: object
21+
type: group
22+
fields:
23+
- name: key
24+
type: keyword

0 commit comments

Comments
 (0)