-
Notifications
You must be signed in to change notification settings - Fork 598
Creating Cyberark PTA integration #3908
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 22 commits
Commits
Show all changes
28 commits
Select commit
Hold shift + click to select a range
8b2b922
initial creation of the integration, with fields and settings
kgeller 13864ca
beginning of pipelines and example corrected
kgeller 1e08de7
putting version back
kgeller ea12402
adding processors for cef fields not automatically populated
kgeller 9f8834a
adding codeowners
kgeller a37ee90
removing log file processor, cleaning up processors
kgeller eb0424d
clearing the error for invalid ip from
kgeller cefb60a
tests added; docs templated, fields updated
kgeller 591f806
tweaks for getting ready for review
kgeller f8173a2
formatting
kgeller d0ef208
fixes to pipeline and adding kibana dashboard
kgeller c88147e
Merge branch 'main' of github.com:elastic/integrations into create-cy…
kgeller 6ea12be
updates
kgeller 7f0b1cb
more updates
kgeller 33df3d1
unlinked dashboards
kgeller 88591f9
re-added dashboard but for 7.17
kgeller 17cbf34
updating
kgeller ec1884c
fixing dashboard
kgeller 8099399
fixing filter
kgeller 66fbec2
cleanup
kgeller d61b6d7
sample event
kgeller 5ac4862
build
kgeller bf57cb0
typo
kgeller 08408fa
updating ecs version
kgeller cb7f72b
adding in tls/ssl
kgeller 7aa0a07
Merge branch 'main' of github.com:elastic/integrations into create-cy…
kgeller 1a5e144
screenshot added
kgeller 8509021
Merge branch 'main' of github.com:elastic/integrations into create-cy…
kgeller File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| dependencies: | ||
| ecs: | ||
| reference: git@v8.3.0 | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| # Cyberark Privileged Threat Analytics | ||
|
|
||
| CyberArk's Privileged Threat Analytics (PTA) continuously monitors the use of privileged accounts that are managed in the CyberArk Privileged Access Security (PAS) platform. This integration collects analytics from PTA's syslog via CEF-formatted logs. | ||
|
|
||
| ### Configuration | ||
|
|
||
| Follow the steps described under [Send PTA syslog records to SIEM](https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PTA/Outbound-Sending-%20PTA-syslog-Records-to-SIEM.htm) documentation to setup the integration: | ||
|
|
||
| - Sample syslog configuration for `systemparm.properties`: | ||
|
|
||
| ```ini | ||
| [SYSLOG] | ||
| syslog_outbound=[{"siem": "Elastic", "format": "CEF", "host": "SIEM_MACHINE_ADDRESS", "port": 9301, "protocol": "TCP"}] | ||
| ``` | ||
|
|
||
| ### Example event | ||
| An example event for pta looks as following: | ||
|
|
||
| ```json | ||
| { | ||
| "cef": { | ||
| "device": { | ||
| "event_class_id": "1", | ||
| "product": "PTA", | ||
| "vendor": "CyberArk", | ||
| "version": "12.6" | ||
| }, | ||
| "extensions": { | ||
| "destinationAddress": "175.16.199.0", | ||
| "destinationHostName": "dev1.domain.com", | ||
| "destinationUserName": "andy@dev1.domain.com", | ||
| "deviceCustomDate1": "2014-01-01T12:05:00.000Z", | ||
| "deviceCustomDate1Label": "detectionDate", | ||
| "deviceCustomString1": "None", | ||
| "deviceCustomString1Label": "ExtraData", | ||
| "deviceCustomString2": "52b06812ec3500ed864c461e", | ||
| "deviceCustomString2Label": "EventID", | ||
| "deviceCustomString3": "https://1.128.0.0/incidents/52b06812ec3500ed864c461e", | ||
| "deviceCustomString3Label": "PTAlink", | ||
| "deviceCustomString4": "https://myexternallink.com", | ||
| "deviceCustomString4Label": "ExternalLink", | ||
| "sourceAddress": "1.128.0.0", | ||
| "sourceHostName": "prod1.domain.com", | ||
| "sourceUserName": "mike2@prod1.domain.com" | ||
| }, | ||
| "name": "Suspected credentials theft", | ||
| "severity": "8", | ||
| "version": "0" | ||
| }, | ||
| "destination": { | ||
| "domain": "dev1.domain.com", | ||
| "ip": "175.16.199.0", | ||
| "user": { | ||
| "name": "andy@dev1.domain.com" | ||
| } | ||
| }, | ||
| "ecs": { | ||
| "version": "8.3.0" | ||
| }, | ||
| "event": { | ||
| "code": "1", | ||
| "created": [ | ||
| "2014-01-01T12:05:00.000Z" | ||
| ], | ||
| "id": [ | ||
| "52b06812ec3500ed864c461e" | ||
| ], | ||
| "ingested": "2022-07-28T14:05:49Z", | ||
| "original": "CEF:0|CyberArk|PTA|12.6|1|Suspected credentials theft|8|suser=mike2@prod1.domain.com shost=prod1.domain.com src=1.128.0.0 duser=andy@dev1.domain.com dhost=dev1.domain.com dst=175.16.199.0 cs1Label=ExtraData cs1=None cs2Label=EventID cs2=52b06812ec3500ed864c461e deviceCustomDate1Label=detectionDate deviceCustomDate1=1388577900000 cs3Label=PTAlink cs3=https://1.128.0.0/incidents/52b06812ec3500ed864c461e cs4Label=ExternalLink cs4=https://myexternallink.com", | ||
| "reference": [ | ||
| "https://1.128.0.0/incidents/52b06812ec3500ed864c461e" | ||
| ], | ||
| "severity": 8, | ||
| "url": [ | ||
| "https://myexternallink.com" | ||
| ] | ||
| }, | ||
| "message": "Suspected credentials theft", | ||
| "observer": { | ||
| "product": "PTA", | ||
| "vendor": "CyberArk", | ||
| "version": "12.6" | ||
| }, | ||
| "source": { | ||
| "domain": "prod1.domain.com", | ||
| "ip": "1.128.0.0", | ||
| "user": { | ||
| "name": "mike2@prod1.domain.com" | ||
| } | ||
| }, | ||
| "tags": [ | ||
| "cyberark_pta", | ||
| "forwarded" | ||
| ] | ||
| } | ||
| ``` | ||
|
|
||
| **Exported fields** | ||
|
|
||
| {{fields "events"}} |
12 changes: 12 additions & 0 deletions
12
packages/cyberark_pta/_dev/deploy/docker/docker-compose.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| version: "2.3" | ||
| services: | ||
| cyberark-pta-udp: | ||
| image: docker.elastic.co/observability/stream:v0.6.2 | ||
| volumes: | ||
| - ./sample_logs:/sample_logs:ro | ||
| command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=udp /sample_logs/*.log | ||
| cyberark-pta-tcp: | ||
| image: docker.elastic.co/observability/stream:v0.6.2 | ||
| volumes: | ||
| - ./sample_logs:/sample_logs:ro | ||
| command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/*.log |
1 change: 1 addition & 0 deletions
1
packages/cyberark_pta/_dev/deploy/docker/sample_logs/active_dormant_user.log
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| CEF:0|CyberArk|PTA|11.4|26|Active dormant Vault user|5|suser=Administrator(Vault user) shost=None src=None duser=svc_account@components.cyberark.local dhost=components.cyberark.local dst=10.0.1.20 cs1Label=ExtraData cs1=None cs2Label=EventID cs2=62bb9d97c2dcd9b6beb4cc15 deviceCustomDate1Label=DetectionDate deviceCustomDate1=1656462743000 cs3Label=PTALink cs3=https://components.cyberark.local:443/PasswordVault/v10/pta/events/62bb9d97c2dcd9b6beb4cc15 cs4Label=ExternalLink cs4=None. | ||
|
kgeller marked this conversation as resolved.
Outdated
|
||
1 change: 1 addition & 0 deletions
1
packages/cyberark_pta/_dev/deploy/docker/sample_logs/suspected_cred_theft.log
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| CEF:0|CyberArk|PTA|12.6|1|Suspected credentials theft|8|suser=mike2@prod1.domain.com shost=prod1.domain.com src=1.1.1.1 duser=andy@dev1.domain.com dhost=dev1.domain.com dst=2.2.2.2 cs1Label=ExtraData cs1=None cs2Label=EventID cs2=52b06812ec3500ed864c461e deviceCustomDate1Label=detectionDate deviceCustomDate1=1388577900000 cs3Label=PTAlink cs3=https://1.1.1.1/incidents/52b06812ec3500ed864c461e cs4Label=ExternalLink cs4=None |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| # newer versions go on top | ||
| - version: "0.1.0" | ||
| changes: | ||
| - description: initial beta release | ||
| type: enhancement | ||
| link: https://github.com/elastic/integrations/pull/3908 |
65 changes: 65 additions & 0 deletions
65
packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-active-dormant-user.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| { | ||
| "events": [ | ||
| { | ||
| "cef": { | ||
| "severity": "5", | ||
| "extensions": { | ||
| "deviceCustomString3Label": "PTALink", | ||
| "destinationAddress": "10.0.1.20", | ||
| "sourceAddress": "10.0.0.3", | ||
| "sourceHostName": "None", | ||
| "sourceUserName": "Administrator(Vault user)", | ||
| "deviceCustomString1": "None", | ||
| "deviceCustomDate1": "2022-06-29T00:32:23.000Z", | ||
| "deviceCustomString3": "https://components.cyberark.local:443/PasswordVault/v10/pta/events/62bb9d97c2dcd9b6beb4cc15", | ||
| "deviceCustomString1Label": "ExtraData", | ||
| "deviceCustomString2": "62bb9d97c2dcd9b6beb4cc15", | ||
| "destinationHostName": "components.cyberark.local", | ||
| "deviceCustomString4": "None.", | ||
| "destinationUserName": "svc_account@components.cyberark.local", | ||
| "deviceCustomString4Label": "ExternalLink", | ||
| "deviceCustomDate1Label": "DetectionDate", | ||
| "deviceCustomString2Label": "EventID" | ||
| }, | ||
| "name": "Active dormant Vault user", | ||
| "version": "0", | ||
| "device": { | ||
| "product": "PTA", | ||
| "event_class_id": "26", | ||
| "vendor": "CyberArk", | ||
| "version": "11.4" | ||
| } | ||
| }, | ||
| "destination": { | ||
| "domain": "components.cyberark.local", | ||
| "ip": "10.0.1.20", | ||
| "user": { | ||
| "name": "svc_account@components.cyberark.local" | ||
| } | ||
| }, | ||
| "source": { | ||
| "ip": "10.0.0.3", | ||
| "domain": "None", | ||
| "user": { | ||
| "name": "Administrator(Vault user)" | ||
| } | ||
| }, | ||
| "message": "Active dormant Vault user", | ||
| "tags": [ | ||
| "cyberark_pta", | ||
| "forwarded" | ||
| ], | ||
| "observer": { | ||
| "product": "PTA", | ||
| "vendor": "CyberArk", | ||
| "version": "11.4" | ||
| }, | ||
| "event": { | ||
| "severity": 5, | ||
| "ingested": "2022-07-29T16:33:40Z", | ||
| "original": "CEF:0|CyberArk|PTA|11.4|26|Active dormant Vault user|5|suser=Administrator(Vault user) shost=None src=10.0.0.3 duser=svc_account@components.cyberark.local dhost=components.cyberark.local dst=10.0.1.20 cs1Label=ExtraData cs1=None cs2Label=EventID cs2=62bb9d97c2dcd9b6beb4cc15 deviceCustomDate1Label=DetectionDate deviceCustomDate1=1656462743000 cs3Label=PTALink cs3=https://components.cyberark.local:443/PasswordVault/v10/pta/events/62bb9d97c2dcd9b6beb4cc15 cs4Label=ExternalLink cs4=None.", | ||
| "code": "26" | ||
| } | ||
| } | ||
| ] | ||
| } |
77 changes: 77 additions & 0 deletions
77
...ark_pta/data_stream/events/_dev/test/pipeline/test-active-dormant-user.json-expected.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| { | ||
| "expected": [ | ||
| { | ||
| "@timestamp": "2022-06-29T00:32:23.000Z", | ||
| "cef": { | ||
| "device": { | ||
| "event_class_id": "26", | ||
| "product": "PTA", | ||
| "vendor": "CyberArk", | ||
| "version": "11.4" | ||
| }, | ||
| "extensions": { | ||
| "destinationAddress": "10.0.1.20", | ||
| "destinationHostName": "components.cyberark.local", | ||
| "destinationUserName": "svc_account@components.cyberark.local", | ||
| "deviceCustomDate1": "2022-06-29T00:32:23.000Z", | ||
| "deviceCustomDate1Label": "DetectionDate", | ||
| "deviceCustomString1": "None", | ||
| "deviceCustomString1Label": "ExtraData", | ||
| "deviceCustomString2": "62bb9d97c2dcd9b6beb4cc15", | ||
| "deviceCustomString2Label": "EventID", | ||
| "deviceCustomString3": "https://components.cyberark.local:443/PasswordVault/v10/pta/events/62bb9d97c2dcd9b6beb4cc15", | ||
| "deviceCustomString3Label": "PTALink", | ||
| "deviceCustomString4": "None.", | ||
| "deviceCustomString4Label": "ExternalLink", | ||
| "sourceAddress": "10.0.0.3", | ||
| "sourceHostName": "None", | ||
| "sourceUserName": "Administrator(Vault user)" | ||
| }, | ||
| "name": "Active dormant Vault user", | ||
| "severity": "5", | ||
| "version": "0" | ||
| }, | ||
| "cyberark_pta": { | ||
| "log": { | ||
| "event_type": "26" | ||
| } | ||
| }, | ||
| "destination": { | ||
| "domain": "components.cyberark.local", | ||
| "ip": "10.0.1.20", | ||
| "user": { | ||
| "name": "svc_account@components.cyberark.local" | ||
| } | ||
| }, | ||
| "ecs": { | ||
| "version": "8.3.0" | ||
| }, | ||
| "event": { | ||
| "code": "26", | ||
| "id": "62bb9d97c2dcd9b6beb4cc15", | ||
| "ingested": "2022-07-29T16:33:40Z", | ||
| "original": "CEF:0|CyberArk|PTA|11.4|26|Active dormant Vault user|5|suser=Administrator(Vault user) shost=None src=10.0.0.3 duser=svc_account@components.cyberark.local dhost=components.cyberark.local dst=10.0.1.20 cs1Label=ExtraData cs1=None cs2Label=EventID cs2=62bb9d97c2dcd9b6beb4cc15 deviceCustomDate1Label=DetectionDate deviceCustomDate1=1656462743000 cs3Label=PTALink cs3=https://components.cyberark.local:443/PasswordVault/v10/pta/events/62bb9d97c2dcd9b6beb4cc15 cs4Label=ExternalLink cs4=None.", | ||
| "reason": "Active dormant Vault user", | ||
| "reference": "https://components.cyberark.local:443/PasswordVault/v10/pta/events/62bb9d97c2dcd9b6beb4cc15", | ||
| "severity": 5, | ||
| "url": "None." | ||
| }, | ||
| "observer": { | ||
| "product": "PTA", | ||
| "vendor": "CyberArk", | ||
| "version": "11.4" | ||
| }, | ||
| "source": { | ||
| "domain": "None", | ||
| "ip": "10.0.0.3", | ||
| "user": { | ||
| "name": "Administrator(Vault user)" | ||
| } | ||
| }, | ||
| "tags": [ | ||
| "cyberark_pta", | ||
| "forwarded" | ||
| ] | ||
| } | ||
| ] | ||
| } |
6 changes: 6 additions & 0 deletions
6
packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-generated.log-config.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| dynamic_fields: | ||
| event.ingested: ".*" | ||
| fields: | ||
| tags: | ||
| - preserve_original_event | ||
| - cyberark_pta |
65 changes: 65 additions & 0 deletions
65
packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-suspected-cred-theft.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| { | ||
| "events": [ | ||
| { | ||
| "cef": { | ||
| "severity": "8", | ||
| "extensions": { | ||
| "destinationAddress": "175.16.199.0", | ||
| "deviceCustomString3Label": "PTAlink", | ||
| "sourceHostName": "prod1.domain.com", | ||
| "sourceAddress": "1.128.0.0", | ||
| "sourceUserName": "mike2@prod1.domain.com", | ||
| "deviceCustomString1": "None", | ||
| "deviceCustomDate1": "2014-01-01T12:05:00.000Z", | ||
| "deviceCustomString3": "https://1.128.0.0/incidents/52b06812ec3500ed864c461e", | ||
| "deviceCustomString2": "52b06812ec3500ed864c461e", | ||
| "deviceCustomString1Label": "ExtraData", | ||
| "destinationHostName": "dev1.domain.com", | ||
| "deviceCustomString4": "https://myexternallink.com", | ||
| "destinationUserName": "andy@dev1.domain.com", | ||
| "deviceCustomString4Label": "ExternalLink", | ||
| "deviceCustomDate1Label": "detectionDate", | ||
| "deviceCustomString2Label": "EventID" | ||
| }, | ||
| "name": "Suspected credentials theft", | ||
| "version": "0", | ||
| "device": { | ||
| "product": "PTA", | ||
| "event_class_id": "1", | ||
| "vendor": "CyberArk", | ||
| "version": "12.6" | ||
| } | ||
| }, | ||
| "destination": { | ||
| "domain": "dev1.domain.com", | ||
| "ip": "175.16.199.0", | ||
| "user": { | ||
| "name": "andy@dev1.domain.com" | ||
| } | ||
| }, | ||
| "source": { | ||
| "domain": "prod1.domain.com", | ||
| "ip": "1.128.0.0", | ||
| "user": { | ||
| "name": "mike2@prod1.domain.com" | ||
| } | ||
| }, | ||
| "message": "Suspected credentials theft", | ||
| "tags": [ | ||
| "cyberark_pta", | ||
| "forwarded" | ||
| ], | ||
| "observer": { | ||
| "product": "PTA", | ||
| "vendor": "CyberArk", | ||
| "version": "12.6" | ||
| }, | ||
| "event": { | ||
| "severity": 8, | ||
| "original": "CEF:0|CyberArk|PTA|12.6|1|Suspected credentials theft|8|suser=mike2@prod1.domain.com shost=prod1.domain.com src=1.128.0.0 duser=andy@dev1.domain.com dhost=dev1.domain.com dst=175.16.199.0 cs1Label=ExtraData cs1=None cs2Label=EventID cs2=52b06812ec3500ed864c461e deviceCustomDate1Label=detectionDate deviceCustomDate1=1388577900000 cs3Label=PTAlink cs3=https://1.128.0.0/incidents/52b06812ec3500ed864c461e cs4Label=ExternalLink cs4=https://myexternallink.com", | ||
| "code": "1", | ||
| "ingested": "2022-07-28T14:05:49Z" | ||
| } | ||
| } | ||
| ] | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.