TYCHON Initial Agent Upload by joeperuzzi · Pull Request #6701 · elastic/integrations

joeperuzzi · 2023-06-26T16:52:54Z

Enhancement

What does this PR do?

This is TYCHON's initial push of its Agentless Beta plugin code base, the software this has been integrated with is a licensed product but the sample JSON files represent a single-line response. This is being released initially as Beta as the product has only been tested using local repo's and QA needs to test from hosted Github code.

Checklist

[X ] I have reviewed tips for building integrations and this pull request is aligned with them.
[ X ] I have verified that all data streams collect metrics or logs.
[ X ] I have added an entry to my package's changelog.yml file.
[ X ] I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Use the sample data to ingest data into the Elastic Agent Pipelines. The provided dashboards shall validate that data is being transferred.

elasticmachine · 2023-06-26T16:56:22Z

💔 Build Failed

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-08-24T22:39:27.929+0000
Duration: 6 min 42 sec

Steps errors

Expand to view the steps failures

`Checks and builds Go sources`

Took 0 min 24 sec . View more details here
Description: mage -debug check

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

elasticmachine · 2023-06-27T13:54:15Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

efd6

This will need to have a line added to .github/CODEOWNERS

/packages/tychon @elastic/security-external-integrations

(in alphabetical position)

There are no tests, are you able to add these?

efd6 · 2023-06-28T00:18:25Z

packages/tychon/LICENSE.txt

Please delete this file. It is not needed since the file in the root of the repo cover the code here.

packages/tychon/_dev/build/build.yml

efd6 · 2023-06-28T00:19:09Z

packages/tychon/changelog.yml

@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.0.10"


Suggested change

- version: "0.0.10"

- version: "0.0.1"

packages/tychon/changelog.yml

packages/tychon/data_stream/tychon_cve/agent/stream/stream.yml.hbs

packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml

packages/tychon/data_stream/tychon_cve/sample_event.json

packages/tychon/docs/README.md

packages/tychon/manifest.yml

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

…of the repo cover the code here

….hbs Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

Changed {{#each paths as |path i|}} to {{#each paths as |path|}} per efd6 request

Added new line to end per efd6 request.

Updated ecs.version per efd6 request

Added new line to end per efd6 request

Added descriptions to names.

Removed Asset Identification and updated exported field for tychon_cve

jsoriano · 2023-06-29T08:50:55Z

LICENSE.txt

@@ -1,93 +0,0 @@
-Elastic License 2.0


Why are we removing this license here?

@jsoriano the comment above suggested we remove the file:

packages/tychon/LICENSE.txt
Outdated
Contributor
@efd6 efd6 yesterday
Please delete this file. It is not needed since the file in the root of the repo cover the code here.

Wrong LICENSE.txt. The file in root needs to stay, I was asking to remove the file that was added in this PR.

License file was added back in

This is still not right. The LICENSE.txt in the root needs to exist, the LICENSE.txt file in packages/tychon/LICENSE.txt should not exist. Please do git mv packages/tychon/LICENSE.txt . && git commit -m "replace license file" in the root of the repo.

moved to the root of the package, hopefully, this is correct :)

cla-checker-service · 2023-07-18T13:45:42Z

💚 CLA has been signed

skidmoco · 2023-07-18T15:31:21Z

❌ Author of the following commits did not sign a Contributor Agreement: , , , , , , , , , , , , , , , , , , , , , , , , , f67356b, f6c27ea, 86439db, f5734d8, aa3e668

Please, read and sign the above mentioned agreement if you want to contribute to this project

I have read and signed agreement

efd6 · 2023-07-18T21:17:32Z

@skidmoco Please check that the email address you have used to sign the CLA matches the email address in your commits.

Updating description of vulnerability ds

joeperuzzi · 2023-08-03T11:04:32Z

@efd6 what is the status of this PR? We have customers waiting on this plugin, is there any way we can jump on a call or something to get this plugin approved and pushed? Is there a faster process?

efd6 · 2023-08-06T22:04:52Z

packages/tychon/data_stream/tychon_cve/_dev/test/pipeline/test-cve.json-config.yml

+dynamic_fields:
+  "@timestamp": ".*"
+  event.ingested: ".*"
+


Please fix these so that they have a final newline, not a final space. There are other cases throughout. (the *-expected.json should not be altered).

Suggested change

efd6 · 2023-08-06T22:08:19Z

packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml

+      source: if(ctx.vulnerability?.result == 'fail'){
+                ctx.event.outcome = "failure"
+              }else if(ctx.vulnerability?.result == 'pass'){
+                ctx.event.outcome = "success"
+              }else{
+                ctx.event.outcome = "unknown"
+              }


Please use the YAML pipe syntax for scripts as shown here.

efd6 · 2023-08-06T22:08:59Z

packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml

+  - script:
+      source: ctx.host.mac = ctx.host.mac.replace(':','-')


This can be done with a gsub.

efd6 · 2023-08-06T22:21:34Z

packages/tychon/data_stream/tychon_cve/agent/stream/stream.yml.hbs

+json:
+  keys_under_root: true
+  expand_keys: true
+


Suggested change

efd6 · 2023-08-06T22:21:47Z

packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml

+  - append:
+      field: error.message
+      value: '{{{ _ingest.on_failure_message }}}'
+


Suggested change

efd6 · 2023-08-06T22:22:23Z

packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json-config.yml

+dynamic_fields:
+  "@timestamp": ".*"
+  event.ingested: ".*"
+


Suggested change

efd6 · 2023-08-06T22:22:35Z

packages/tychon/data_stream/tychon_epp/agent/stream/stream.yml.hbs

+{{/if}}
+json:
+  keys_under_root: true
+  expand_keys: true


Suggested change

expand_keys: true

expand_keys: true

efd6 · 2023-08-06T22:22:49Z

packages/tychon/data_stream/tychon_epp/elasticsearch/ingest_pipeline/default.yml

+  - append:
+      field: error.message
+      value: '{{{ _ingest.on_failure_message }}}'
+


Suggested change

efd6 · 2023-08-06T22:23:28Z

packages/tychon/data_stream/tychon_stig/agent/stream/stream.yml.hbs

+{{/if}}
+json:
+  keys_under_root: true
+  expand_keys: true	


Suggested change

expand_keys: true

expand_keys: true

efd6 · 2023-08-06T22:23:40Z

packages/tychon/data_stream/tychon_stig/elasticsearch/ingest_pipeline/default.yml

+  - append:
+      field: error.message
+      value: '{{{ _ingest.on_failure_message }}}'
+


Suggested change

efd6 · 2023-08-06T22:24:44Z

/test

modified: packages/tychon/changelog.yml modified: packages/tychon/data_stream/tychon_cve/_dev/test/test-cve.json-config.yml modified: packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml modified: packages/tychon/data_stream/tychon_cve/fields/ecs.yml modified: packages/tychon/data_stream/tychon_cve/fields/fields.yml modified: packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json-config.yml modified: packages/tychon/data_stream/tychon_epp/elasticsearch/ingest_pipeline/default.yml modified: packages/tychon/data_stream/tychon_epp/fields/ecs.yml modified: packages/tychon/data_stream/tychon_epp/fields/fields.yml modified: packages/tychon/data_stream/tychon_epp/manifest.yml modified: packages/tychon/data_stream/tychon_stig/_dev/test/pipeline/test-stig.json-config.yml modified: packages/tychon/data_stream/tychon_stig/elasticsearch/ingest_pipeline/default.yml modified: packages/tychon/data_stream/tychon_stig/fields/ecs.yml modified: packages/tychon/data_stream/tychon_stig/fields/fields.yml modified: packages/tychon/data_stream/tychon_stig/manifest.yml

modified: packages/tychon/data_stream/tychon_stig/manifest.yml

modified: packages/tychon/changelog.yml

Bruce changes no sync

efd6 · 2023-08-24T22:39:13Z

/test

bhapas

Please note that comment applies to all pipeline files

bhapas · 2023-08-25T07:29:30Z

packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml

      value: "{{id}}"
+  - set:
+      field: tychon.ipv4
+      value: "{{host.ipv4}}"


Suggested change

value: "{{host.ipv4}}"

- set:

field: tychon.ipv4

copy_from: host.ipv4

ignore_empty_value: true

This way you don't have empty/null values into tychon.ipv4

joeperuzzi · 2023-08-25T18:23:08Z

We have a new, much larger version of this integration being released in the coming days, I'm closing this PR as the change causes this version to be obsolete and will be pushed to a new PR before this one can be completed.

TYCHON Inital Agent Upload

c99b314

jamiehynds requested a review from a team June 27, 2023 13:54

jamiehynds added the Team:Security-External Integrations label Jun 27, 2023

jamiehynds added the New Integration Issue or pull request for creating a new integration package. label Jun 27, 2023

efd6 reviewed Jun 28, 2023

View reviewed changes

joeperuzzi and others added 6 commits June 28, 2023 07:19

Update packages/tychon/changelog.yml

12651b6

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

Update packages/tychon/_dev/build/build.yml

9bc9902

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

Update packages/tychon/changelog.yml

ed2c9c1

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

Update packages/tychon/manifest.yml

4a0fa02

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

Please delete this file. It is not needed since the file in the root …

bb3ea07

…of the repo cover the code here

Removed file based on PR Request

4e3ff95

joeperuzzi requested a review from a team as a code owner June 28, 2023 11:27

joeperuzzi and others added 10 commits June 28, 2023 07:29

Update packages/tychon/data_stream/tychon_cve/agent/stream/stream.yml…

933b66b

….hbs Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>

adding TYCHON package to codeowners file

3f2a742

Update stream.yml.hbs

be4c100

Changed {{#each paths as |path i|}} to {{#each paths as |path|}} per efd6 request

Update stream.yml.hbs

8c23a3b

Added new line to end per efd6 request.

Update default.yml

f109f93

Updated ecs.version per efd6 request

Update default.yml

1ec1865

Added new line to end per efd6 request

Update stream.yml.hbs

32d77c6

Update fields.yml

e0bad7a

Added descriptions to names.

Update README.md

6035366

Removed Asset Identification and updated exported field for tychon_cve

Update README.md and Fields.

c6660a2

jsoriano reviewed Jun 29, 2023

View reviewed changes

andrewkroh added the Integration:tychon TYCHON Agentless (Partner supported) label Jun 29, 2023

tychon1 added 4 commits June 29, 2023 14:05

Update missing descriptions

b8f8608

Put License back

782a7fc

Added pipeline tests

ee83a6c

Updated pipeline tests

8e83866

tychon1 and others added 3 commits July 28, 2023 20:24

Added ARF

1723f65

Updating description of vulnerability ds

c4404a8

Merge pull request #3 from joeperuzzi/justins

35874d1

Updating description of vulnerability ds

efd6 reviewed Aug 6, 2023

View reviewed changes

tychon1 and others added 16 commits August 8, 2023 17:42

Converted pipeline method to gsub

9a76695

Updated script to yaml pipe syntax

f72e9ad

Changes to be committed:

681f1f5

modified: packages/tychon/data_stream/tychon_stig/manifest.yml

Merge branch 'bruceUpdates' into BruceLatest&Greatest

bd27659

Changes to be committed:

7dc7b0f

modified: packages/tychon/changelog.yml

Delete test-arf.json-config.yml

cf48b30

Create test-arf.json-config.yml

a4803e3

Update default.yml

a9a38fc

Update default.yml

b20ed4b

Update test-epp.json-expected.json

73b7b79

Update default.yml

63a0620

Update test-stig.json-expected.json

c1ba00f

updated fields

6256e4c

Removed ARF

ad8c478

Merge pull request #6 from joeperuzzi/BruceChangesNoSync

7e25d28

Bruce changes no sync

bhapas reviewed Aug 25, 2023

View reviewed changes

joeperuzzi closed this Aug 25, 2023

efd6 mentioned this pull request Oct 9, 2023

Tychon Agentless version 56 #8123

Closed

1 task

		@@ -0,0 +1,6 @@
		# newer versions go on top
		- version: "0.0.10"

		- script:
		source: ctx.host.mac = ctx.host.mac.replace(':','-')

Conversation

joeperuzzi commented Jun 26, 2023 • edited by andrewkroh Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Checklist

How to test this PR locally

Uh oh!

elasticmachine commented Jun 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Build stats

Steps errors

Checks and builds Go sources

🤖 GitHub comments

Uh oh!

elasticmachine commented Jun 27, 2023

Uh oh!

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cla-checker-service bot commented Jul 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

skidmoco commented Jul 18, 2023

Uh oh!

efd6 commented Jul 18, 2023

Uh oh!

joeperuzzi commented Aug 3, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

efd6 commented Aug 6, 2023

Uh oh!

efd6 commented Aug 24, 2023

Uh oh!

bhapas left a comment

Choose a reason for hiding this comment

Uh oh!

joeperuzzi commented Jun 26, 2023 •

edited by andrewkroh

Loading

elasticmachine commented Jun 26, 2023 •

edited

Loading

`Checks and builds Go sources`

cla-checker-service bot commented Jul 18, 2023 •

edited

Loading