[1password] Add new event.action to 1Password item usages

packages/1password/_dev/build/docs/README.md

@@ -22,16 +22,16 @@ Uses the 1Password Events API to retrieve information about sign-in attempts. Ev
 
 *Exported fields*
 
-{{fields "item_usages"}}
+{{fields "signin_attempts"}}
 
-{{event "item_usages"}}
+{{event "signin_attempts"}}
 
 ### Item Usages
 
 Uses the 1Password Events API to retrieve information about items in shared vaults that have been modified, accessed, or used. Events include the name and IP address of the user who accessed the item, when it was accessed, and the vault where the item is stored.
 
 *Exported fields*
 
-{{fields "signin_attempts"}}
+{{fields "item_usages"}}
 
-{{event "signin_attempts"}}
+{{event "item_usages"}}

packages/1password/_dev/deploy/docker/config.yml

@@ -13,7 +13,7 @@ rules:
           Content-Type:
             - "application/json; charset=utf-8"
         body: |-
-          {"cursor":"cursor_0","has_more":true,"items":[{"uuid":"MCQODBBWJD5HISKYNP3HJPV2DV","timestamp":"2021-08-30T18:57:42.484Z","used_version":1,"vault_uuid":"jaqxqf5qylslqiitnduawrndc5","item_uuid":"bvwmmwxisuca7wbehrbyqhag54","user":{"uuid":"OJQGU46KAPROEJLCK674RHSAY5","name":"Name","email":"email@1password.com"},"client":{"app_name":"1Password Browser Extension","app_version":"1109","platform_name":"Chrome","platform_version":"93.0.4577.62","os_name":"Android","os_version":"10","ip_address":"1.1.1.1"}}]}
+          {"cursor":"cursor_0","has_more":true,"items":[{"uuid":"MCQODBBWJD5HISKYNP3HJPV2DV","timestamp":"2021-08-30T18:57:42.484Z","used_version":1,"vault_uuid":"jaqxqf5qylslqiitnduawrndc5","item_uuid":"bvwmmwxisuca7wbehrbyqhag54","user":{"uuid":"OJQGU46KAPROEJLCK674RHSAY5","name":"Name","email":"email@1password.com"},"client":{"app_name":"1Password Browser Extension","app_version":"1109","platform_name":"Chrome","platform_version":"93.0.4577.62","os_name":"Android","os_version":"10","ip_address":"1.1.1.1"}, "location": {"country": "Canada","region": "Ontario","city": "Toronto","latitude": 43.64,"longitude": -79.433}, "action": "reveal"}]}
   - path: /api/v1/itemusages
     methods: ["POST"]
     request_headers:

packages/1password/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.2.0"
+  changes:
+    - description: Add new "event.action" to item_usages events.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/2775
 - version: "1.1.1"
   changes:
     - description: Fix field mapping conflict for ECS `event.created`.

packages/1password/data_stream/item_usages/_dev/test/pipeline/test-itemusages.json

@@ -2,7 +2,7 @@
     "events": [
         {
             "@timestamp": "2021-08-30T22:57:42.484Z",
-            "message": "{\"uuid\":\"MCQODBBWJD5HISKYNP3HJPV2DV\",\"timestamp\":\"2021-08-30T18:57:42.484Z\",\"used_version\":1,\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}}"
+            "message": "{\"uuid\":\"MCQODBBWJD5HISKYNP3HJPV2DV\",\"timestamp\":\"2021-08-30T18:57:42.484Z\",\"used_version\":1,\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}, \"location\": {\"country\": \"Canada\",\"region\": \"Ontario\",\"city\": \"Toronto\",\"latitude\": 43.64,\"longitude\": -79.433}, \"action\":\"reveal\"}"
         },
         {
             "@timestamp": "2021-08-30T22:57:42.484Z",

packages/1password/data_stream/item_usages/_dev/test/pipeline/test-itemusages.json-expected.json

@@ -6,12 +6,13 @@
                 "version": "8.0.0"
             },
             "event": {
+                "action": "reveal",
                 "category": [
                     "file"
                 ],
                 "created": "2021-08-30T22:57:42.484Z",
                 "kind": "event",
-                "original": "{\"uuid\":\"MCQODBBWJD5HISKYNP3HJPV2DV\",\"timestamp\":\"2021-08-30T18:57:42.484Z\",\"used_version\":1,\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}}",
+                "original": "{\"uuid\":\"MCQODBBWJD5HISKYNP3HJPV2DV\",\"timestamp\":\"2021-08-30T18:57:42.484Z\",\"used_version\":1,\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}, \"location\": {\"country\": \"Canada\",\"region\": \"Ontario\",\"city\": \"Toronto\",\"latitude\": 43.64,\"longitude\": -79.433}, \"action\":\"reveal\"}",
                 "type": [
                     "access"
                 ]

packages/1password/data_stream/item_usages/elasticsearch/ingest_pipeline/default.yml

@@ -16,7 +16,7 @@ processors:
   #######################
   - set:
       field: ecs.version
-      value: '8.0.0'
+      value: "8.0.0"
   # Sets event.created from the @timestamp field generated by filebeat before being overwritten further down
   - set:
       field: event.created
@@ -30,6 +30,10 @@ processors:
   - append:
       field: event.type
       value: [access]
+  - rename:
+      field: onepassword.action
+      target_field: event.action
+      ignore_missing: true
 
   #########################
   ## ECS Related Mapping ##
@@ -125,6 +129,7 @@ processors:
       field:
         - onepassword.timestamp
         - onepassword.user
+        - onepassword.location # Use the included GeoIP processor
       ignore_missing: true
   - remove:
       field: event.original

packages/1password/data_stream/item_usages/fields/ecs.yml

@@ -12,6 +12,8 @@
   name: event.type
 - external: ecs
   name: event.created
+- external: ecs
+  name: event.action
 - external: ecs
   name: user.id
 - external: ecs

packages/1password/data_stream/item_usages/sample_event.json

@@ -1,11 +1,11 @@
 {
     "@timestamp": "2021-08-30T18:57:42.484Z",
     "agent": {
-        "ephemeral_id": "d02e8bec-48d2-46c8-bd33-5982bd82059f",
-        "id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7",
+        "ephemeral_id": "cbcdd98f-456d-47bb-9f43-cf589ccd810d",
+        "id": "8652330e-4de6-4596-a16f-4463a6c56e9e",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "8.0.0-beta1"
+        "version": "8.0.0"
     },
     "data_stream": {
         "dataset": "1password.item_usages",
@@ -16,18 +16,19 @@
         "version": "8.0.0"
     },
     "elastic_agent": {
-        "id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7",
+        "id": "8652330e-4de6-4596-a16f-4463a6c56e9e",
         "snapshot": false,
-        "version": "8.0.0-beta1"
+        "version": "8.0.0"
     },
     "event": {
+        "action": "reveal",
         "agent_id_status": "verified",
         "category": [
             "file"
         ],
-        "created": "2021-12-24T00:23:21.039Z",
+        "created": "2022-03-03T21:25:12.198Z",
         "dataset": "1password.item_usages",
-        "ingested": "2021-12-24T00:23:22Z",
+        "ingested": "2022-03-03T21:25:13Z",
         "kind": "event",
         "type": [
             "access"

packages/1password/data_stream/signin_attempts/elasticsearch/ingest_pipeline/default.yml

@@ -16,7 +16,7 @@ processors:
   #######################
   - set:
       field: ecs.version
-      value: '8.0.0'
+      value: "8.0.0"
   # Sets event.created from the @timestamp field generated by filebeat before being overwritten further down
   - set:
       field: event.created
@@ -139,6 +139,7 @@ processors:
       field:
         - onepassword.timestamp
         - onepassword.target_user
+        - onepassword.location # Use the included GeoIP processor
       ignore_missing: true
   - remove:
       field: event.original

packages/1password/data_stream/signin_attempts/sample_event.json

@@ -1,11 +1,11 @@
 {
     "@timestamp": "2021-08-11T14:28:03.000Z",
     "agent": {
-        "ephemeral_id": "62178cbe-1897-48de-b439-417b38bac0cb",
-        "id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7",
+        "ephemeral_id": "6a1b2121-406e-47fc-8ab0-3ab3b521f341",
+        "id": "8652330e-4de6-4596-a16f-4463a6c56e9e",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "8.0.0-beta1"
+        "version": "8.0.0"
     },
     "data_stream": {
         "dataset": "1password.signin_attempts",
@@ -16,19 +16,19 @@
         "version": "8.0.0"
     },
     "elastic_agent": {
-        "id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7",
+        "id": "8652330e-4de6-4596-a16f-4463a6c56e9e",
         "snapshot": false,
-        "version": "8.0.0-beta1"
+        "version": "8.0.0"
     },
     "event": {
         "action": "success",
         "agent_id_status": "verified",
         "category": [
             "authentication"
         ],
-        "created": "2021-12-24T00:23:56.674Z",
+        "created": "2022-03-03T21:25:49.160Z",
         "dataset": "1password.signin_attempts",
-        "ingested": "2021-12-24T00:23:57Z",
+        "ingested": "2022-03-03T21:25:52Z",
         "kind": "event",
         "outcome": "success",
         "type": [