Skip to content

Commit bc1802f

Browse files
vinit-chauhanvinit-chauhan
authored
[Enhancement] [PANW] Make enhancement in connector with best practices implementation (#4670)
* Add an on_failure processor to the date processor and mapped field source.user.name & source.user.domain properly * Update changelog entry * Resolved merege conflict
1 parent 34889a1 commit bc1802f

File tree

42 files changed

+2222
-483
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+2222
-483
lines changed

‎packages/panw/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,17 @@ services:
77
- ${SERVICE_LOGS_DIR}:/var/log
88
command: /bin/sh -c "cp /sample_logs/* /var/log/"
99
panw-panos-tls:
10-
image: docker.elastic.co/observability/stream:v0.6.2
10+
image: docker.elastic.co/observability/stream:v0.8.0
1111
volumes:
1212
- ./syslog_logs:/sample_logs:ro
1313
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=tls --insecure /sample_logs/*.log
1414
panw-panos-tcp:
15-
image: docker.elastic.co/observability/stream:v0.6.2
15+
image: docker.elastic.co/observability/stream:v0.8.0
1616
volumes:
1717
- ./syslog_logs:/sample_logs:ro
1818
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/*.log
1919
panw-panos-udp:
20-
image: docker.elastic.co/observability/stream:v0.6.2
20+
image: docker.elastic.co/observability/stream:v0.8.0
2121
volumes:
2222
- ./syslog_logs:/sample_logs:ro
2323
command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=udp /sample_logs/*.log

‎packages/panw/changelog.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
# newer versions go on top
2+
- version: "3.3.0"
3+
changes:
4+
- description: Add an on_failure processor to the date processor.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/4670
7+
- description: Field source.user.name & source.user.domain is not mapped properly.
8+
type: bugfix
9+
link: https://github.com/elastic/integrations/pull/4670
210
- version: "3.2.2"
311
changes:
412
- description: Support strings on `panos.certificate.size` field

‎packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-decryption-sample.log‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
<14>Nov 30 16:09:33 PA-220 1,2021/11/11 15:42:44,007051000184334,DECRYPTION,0,2561,2021/11/11 15:42:44,81.2.69.145,81.2.69.144,81.2.69.145,81.2.69.144,intrazone-default,,,incomplete,vsys1,LAN,LAN,ethernet1/2,ethernet1/2,,2021/11/11 15:42:44,33288,1,49908,443,49908,20077,0x1400000,tcp,allow,N/A,,,,,731a6a1a-9a62-4a92-a49a-0876025a9436,Server_Hello,Client_Hello,TLS1.2,ECDHE,AES_256_GCM,SHA384,,,Certificate,trusted,Trusted,GlobalProtect,ba67e84495b59512,a6a13e87221733b712ddbd0978da1ffdd69503dfd1f0a86f73d86bf90b743b85,2021/11/11 15:21:28,2022/11/11 15:21:28,V3,2048,9,9,0,0,:::::RSA,com.example.com,com.example.com,,,Received fatal alert CertificateUnknown from client,,,,,,,,2021-11-11T15:42:44.845-08:00,,,,,,,,,,,,,,,,,7028724914890736000,0x0,0,0,0,0,,PA-VM,1,unknown,unknown,unknown,1,,,incomplete,no
2-
<134>1 2022-11-03T13:40:34+01:00 PA-220 1,2021/11/11 15:42:44,007051000184334,DECRYPTION,0,2561,2021/11/11 15:42:44,81.2.69.145,81.2.69.144,81.2.69.145,81.2.69.144,intrazone-default,,,incomplete,vsys1,LAN,LAN,ethernet1/2,ethernet1/2,,2021/11/11 15:42:44,33288,1,49908,443,49908,20077,0x1400000,tcp,allow,N/A,,,,,731a6a1a-9a62-4a92-a49a-0876025a9436,Server_Hello,Client_Hello,TLS1.2,ECDHE,AES_256_GCM,SHA384,,,Certificate,trusted,Trusted,GlobalProtect,ba67e84495b59512,a6a13e87221733b712ddbd0978da1ffdd69503dfd1f0a86f73d86bf90b743b85,2021/11/11 15:21:28,2022/11/11 15:21:28,V3,Unknown,9,9,0,0,:::::RSA,com.example.com,com.example.com,,,Received fatal alert CertificateUnknown from client,,,,,,,,2021-11-11T15:42:44.845-08:00,,,,,,,,,,,,,,,,,7028724914890736000,0x0,0,0,0,0,,PA-VM,1,unknown,unknown,unknown,1,,,incomplete,no
2+
<134>1 2022-11-03T13:40:34+01:00 PA-220 1,2021/11/11 15:42:44,007051000184334,DECRYPTION,0,2561,2021/11/11 15:42:44,81.2.69.145,81.2.69.144,81.2.69.145,81.2.69.144,intrazone-default,,,incomplete,vsys1,LAN,LAN,ethernet1/2,ethernet1/2,,2021/11/11 15:42:44,33288,1,49908,443,49908,20077,0x1400000,tcp,allow,N/A,,,,,731a6a1a-9a62-4a92-a49a-0876025a9436,Server_Hello,Client_Hello,TLS1.2,ECDHE,AES_256_GCM,SHA384,,,Certificate,trusted,Trusted,GlobalProtect,ba67e84495b59512,a6a13e87221733b712ddbd0978da1ffdd69503dfd1f0a86f73d86bf90b743b85,2021/11/11 15:21:28,2022/11/11 15:21:28,V3,Unknown,9,9,0,0,:::::RSA,com.example.com,com.example.com,,,Received fatal alert CertificateUnknown from client,,,,,,,,2021-11-11T15:42:44.845-08:00,,,,,,,,,,,,,,,,,7028724914890736000,0x0,0,0,0,0,,PA-VM,1,unknown,unknown,unknown,1,,,incomplete,no

‎packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-globalprotect-sample.log-expected.json‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -838,7 +838,7 @@
838838
"10.1.1.1"
839839
],
840840
"user": [
841-
"host"
841+
"user"
842842
]
843843
},
844844
"source": {
@@ -847,7 +847,8 @@
847847
"ip": "10.1.1.1"
848848
},
849849
"user": {
850-
"name": "host"
850+
"domain": "host",
851+
"name": "user"
851852
}
852853
},
853854
"tags": [

‎packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-traffic-sample.log‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,4 +196,4 @@ Nov 30 16:09:52 PA-220 1,2018/11/30 16:09:52,012801096514,TRAFFIC,end,2049,2018/
196196
1,2021/10/26 14:32:02,,TRAFFIC,end,2561,2021/10/26 14:32:02,81.2.69.144,81.2.69.145,,,intrazone-default,,,syslog,vsys1,LAN,LAN,ethernet1/2,ethernet1/2,LFPpan,2021/10/26 14:32:02,15843,1,37151,30514,0,0,0x10005e,udp,allow,1231,641,590,2,2021/10/26 14:31:26,0,any,,7022390495259151734,0x0,United States,United States,,1,1,aged-out,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:32:02.775-07:00
197197
1,2021/10/26 14:31:37,,TRAFFIC,end,2561,2021/10/26 14:31:37,81.2.69.144,81.2.69.145,,,intrazone-default,,,syslog,vsys1,LAN,LAN,ethernet1/2,ethernet1/2,LFPpan,2021/10/26 14:31:37,15840,1,43096,30514,0,0,0x10005e,udp,allow,2544,1364,1180,4,2021/10/26 14:31:01,0,any,,7022390495259151733,0x0,United States,United States,,2,2,aged-out,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:37.773-07:00
198198
1,2021/10/26 14:31:32,,TRAFFIC,start,2561,2021/10/26 14:31:32,81.2.69.193,81.2.69.193,192.168.10.111,81.2.69.193,LAn-TO-WAn,,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15845,1,64898,53,60860,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151732,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.773-07:00
199-
1,2021/10/26 14:31:32,,TRAFFIC,start,2561,2021/10/26 14:31:32,81.2.69.193,81.2.69.193,192.168.10.111,81.2.69.193,LAn-TO-WAn,,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15844,1,64624,53,32849,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151731,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.772-07:00
199+
1,2021/10/26 14:31:32,,TRAFFIC,start,2561,2021/10/26 14:31:32,81.2.69.193,81.2.69.193,192.168.10.111,81.2.69.193,LAn-TO-WAn,,,dns,vsys1,LAN,WAN,ethernet1/2,ethernet1/1,LFPpan,2021/10/26 14:31:32,15844,1,64624,53,32849,53,0x400000,udp,allow,93,93,0,1,2021/10/26 14:31:31,0,any,,7022390495259151731,0x0,169.254.0.0-169.254.255.255,United States,,1,0,n/a,0,0,0,0,,PA-VM,from-policy," ", , , , , , , , , , , , , , , , , , , ,,,,2021-10-26T14:31:32.772-07:00

‎packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/authentication.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,13 +49,13 @@ processors:
4949
- append:
5050
field: source.user.name
5151
value: '{{{_temp_.user}}}'
52-
if: ctx._temp_?.user != null && ctx._temp_?.user != ''
52+
if: ctx._temp_?.user != null && ctx._temp_.user != ''
5353
allow_duplicates: false
5454
ignore_failure: true
5555
- append:
5656
field: source.user.name
5757
value: '{{{panw.panos.normalize_user}}}'
58-
if: ctx.panw?.panos?.normalize_user != null && ctx.panw?.panos?.normalize_user != ''
58+
if: ctx.panw?.panos?.normalize_user != null && ctx.panw.panos.normalize_user != ''
5959
allow_duplicates: false
6060
ignore_failure: true
6161

@@ -94,7 +94,6 @@ processors:
9494
field: panw.panos.user_agent
9595
copy_from: _temp_.user_agent
9696
ignore_failure: true
97-
9897
on_failure:
9998
- append:
10099
field: error.message

‎packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/correlated_event.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ processors:
5353
field: panw.panos.source.user
5454
copy_from: _temp_.srcuser
5555
ignore_failure: true
56-
56+
5757
on_failure:
5858
- append:
5959
field: error.message

‎packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/decryption.yml‎

Lines changed: 32 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -116,35 +116,55 @@ processors:
116116
field: panw.panos.certificate.not_after
117117
target_field: panw.panos.certificate.not_after
118118
formats:
119-
- "yyyy/MM/dd HH:mm:ss"
120-
- "strict_date_optional_time_nanos"
121-
ignore_failure: true
119+
- 'yyyy/MM/dd HH:mm:ss'
120+
- 'strict_date_optional_time_nanos'
121+
on_failure:
122+
- remove:
123+
field: panw.panos.certificate.not_after
124+
- append:
125+
field: error.message
126+
value: '{{{_ingest.on_failure_message}}}'
122127
- date:
123128
if: ctx.event?.timezone != null
124129
field: panw.panos.certificate.not_after
125130
target_field: panw.panos.certificate.not_after
126131
formats:
127-
- "yyyy/MM/dd HH:mm:ss"
128-
- "strict_date_optional_time_nanos"
132+
- 'yyyy/MM/dd HH:mm:ss'
133+
- 'strict_date_optional_time_nanos'
129134
timezone: '{{{ event.timezone }}}'
130-
ignore_failure: true
135+
on_failure:
136+
- remove:
137+
field: panw.panos.certificate.not_after
138+
- append:
139+
field: error.message
140+
value: '{{{_ingest.on_failure_message}}}'
131141
- date:
132142
if: ctx.event?.timezone == null
133143
field: panw.panos.certificate.not_before
134144
target_field: panw.panos.certificate.not_before
135145
formats:
136-
- "yyyy/MM/dd HH:mm:ss"
137-
- "strict_date_optional_time_nanos"
138-
ignore_failure: true
146+
- 'yyyy/MM/dd HH:mm:ss'
147+
- 'strict_date_optional_time_nanos'
148+
on_failure:
149+
- remove:
150+
field: panw.panos.certificate.not_before
151+
- append:
152+
field: error.message
153+
value: '{{{_ingest.on_failure_message}}}'
139154
- date:
140155
if: ctx.event?.timezone != null
141156
field: panw.panos.certificate.not_before
142157
target_field: panw.panos.certificate.not_before
143158
formats:
144-
- "yyyy/MM/dd HH:mm:ss"
145-
- "strict_date_optional_time_nanos"
159+
- 'yyyy/MM/dd HH:mm:ss'
160+
- 'strict_date_optional_time_nanos'
146161
timezone: '{{{ event.timezone }}}'
147-
ignore_failure: true
162+
on_failure:
163+
- remove:
164+
field: panw.panos.certificate.not_before
165+
- append:
166+
field: error.message
167+
value: '{{{_ingest.on_failure_message}}}'
148168

149169
# Set event.kind & event.category field.
150170
- set:

0 commit comments

Comments
 (0)