Cyberark Privileged Access Security module#24803

Merged

adriansr merged 102 commits intoelastic:masterfrom

adriansr:cyberarkpas

Apr 19, 2021

Commits on Apr 19, 2021

Cyberarkpas module skeleton
adriansr
committed
Save Cyberark transform XSLT file
adriansr
committed
XSL: Escape some control characters
adriansr
committed
Mage update
adriansr
committed
WIP
adriansr
committed
proper failure modes
adriansr
committed
Cleanup temp fields on failure
adriansr
committed
Set event.code
adriansr
committed
Debug: Add raw key to JSON
adriansr
committed
Save raw fields
adriansr
committed
Initial test data
adriansr
committed
add samples from Cyberark
adriansr
committed
Transform CAProperties to an object
adriansr
committed
Remove empty fields
adriansr
committed
Fix missing timestamp in log
adriansr
committed
Split ExtraDetails key/values
adriansr
committed
Convert fields to snake_case
adriansr
committed
Make population of ExtraDetails more efficient
adriansr
committed
CAProperties values as array is unnecessary
adriansr
committed
Improve @timestamp calculation
adriansr
committed
Remove empty fields faster
adriansr
committed
small cleanup
adriansr
committed
Populate source.address/.ip/.domain
adriansr
committed
Populate observer fields
adriansr
committed
Populate destination.address and related.ip
adriansr
committed
Enrich events by message ID
adriansr
committed
Support logon/logoff/full gateway connection
adriansr
committed
Support 22 - Verify Password
adriansr
committed
Save message (temporary?)
adriansr
committed
event severity/type/action and corrections
adriansr
committed
Set event.type: error for errors
adriansr
committed
message_id: 4 -- User authentication failure
adriansr
committed
24 - CPM Change password
adriansr
committed
Correct event.type as an array
adriansr
committed
31 - CPM Reconcile Password (unsure)
adriansr
committed
32 - Add Owner to Safe
adriansr
committed
33 - Same as 32
adriansr
committed
38 - CPM Verify Password failed
adriansr
committed
small cleanup
adriansr
committed
Populate related.user
adriansr
committed
Refactor enrichment processor entries
adriansr
committed
Use event.reason instead of error.message
adriansr
committed
temporary comment
adriansr
committed
60 - CPM Reconcile Password Failed
adriansr
committed
130 - CPM Disable Password
adriansr
committed
s/failed/failure/g
adriansr
committed
295 - Retrieve Password succeeded
adriansr
committed
300 - PSM Connect
adriansr
committed
302 - PSM Disconnect
adriansr
committed
300 - PSM Connect
adriansr
committed
308 - Use Password
adriansr
committed
361 - Keystroke Logging
adriansr
committed
Don't populate observer.hostname unless present.
adriansr
committed
411 - Window Title
adriansr
committed
Use event.timezone for syslog timestamp
adriansr
committed
Set pipeline_error on error
adriansr
committed
set user.name from source.user.name
adriansr
committed
414 - CPM Verify SSH Key
adriansr
committed
428 - Retrive SSH Key
adriansr
committed
57 - CPM Change Password Failed
adriansr
committed
309 - Undefined User Logon
adriansr
committed
359 - SQL Command / network.protocol to application
adriansr
committed
Remove known unknowns
adriansr
committed
Configuration with TLS support
adriansr
committed
Fix
adriansr
committed
Make update
adriansr
committed
412 - Keystroke logging (cloned from 361)
adriansr
committed
Remove comment
adriansr
committed
Keep event.original if flag is set
adriansr
committed
Missing file
adriansr
committed
Add geoip processors
adriansr
committed
Define explicit fields instead of using flattened
adriansr
committed
Alternative population of Hostname field
adriansr
committed
Sample dashboard
adriansr
committed
Docs
adriansr
committed
Update docs
adriansr
committed
Document preserve_original_event flag
adriansr
committed
Populate host.name / host.hostname
adriansr
committed
Update dashboard
adriansr
committed
New dashboard image
adriansr
committed
User IAM events
adriansr
committed
Update dashboard again
adriansr
committed
Fix double backslashes
adriansr
committed
Use triple braces for mustache in processors
adriansr
committed
Remove duplicate observer fields
adriansr
committed
No need to populate host.hostname
adriansr
committed
Remove duplicated message_id
adriansr
committed
More triple braces for mustache
adriansr
committed
Mage update
adriansr
committed
Comment improvements
adriansr
committed
Disable debug in XSL file
adriansr
committed
Update XSL link.
adriansr
committed
Add changelog entry
adriansr
committed
Remove redundant test logs
adriansr
committed
Add network_direction
adriansr
committed
Use correct log.syslog.priority
adriansr
committed
Re-generate golden files with newer 7.13 ES
adriansr
committed
Determine if a field is a valid IP address the 7.13 way
adriansr
committed
Add station/gateway_station to related.ip
adriansr
committed
Remove bogus XSL distribution claim from docs
adriansr
committed
Add description to script processors
adriansr
committed
Make rfc5424 field a boolean
adriansr
committed