[cisco_meraki] Add event.action and message to specific events

packages/cisco_meraki/changelog.yml

@@ -1,5 +1,10 @@
 # newer versions go on top
-- version: 1.14.0
+- version: "1.15.0"
+  changes:
+    - description: Add event.action and message to specific events.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/7791
+- version: "1.14.0"
   changes:
     - description: ECS version updated to 8.10.0.
       type: enhancement

packages/cisco_meraki/data_stream/events/sample_event.json

@@ -1,11 +1,11 @@
 {
     "@timestamp": "2018-02-11T00:00:00.123Z",
     "agent": {
-        "ephemeral_id": "077a2d93-4b1d-4908-b2d5-7c3a0218df3a",
-        "id": "878982e9-a174-4ed8-abe3-19378c1473de",
+        "ephemeral_id": "9a78410b-655d-4ff4-9fd6-5c47d2b1e28b",
+        "id": "29d48081-6d4f-4236-b959-925451410f6f",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "8.8.0"
+        "version": "8.0.0"
     },
     "cisco_meraki": {
         "event": {
@@ -40,9 +40,9 @@
         "version": "8.10.0"
     },
     "elastic_agent": {
-        "id": "878982e9-a174-4ed8-abe3-19378c1473de",
+        "id": "29d48081-6d4f-4236-b959-925451410f6f",
         "snapshot": false,
-        "version": "8.8.0"
+        "version": "8.0.0"
     },
     "event": {
         "action": "Cellular came up",
@@ -51,7 +51,7 @@
             "network"
         ],
         "dataset": "cisco_meraki.events",
-        "ingested": "2023-06-01T20:29:21Z",
+        "ingested": "2023-09-20T09:09:47Z",
         "original": "{\"alertData\":{\"connection\":\"LTE\",\"local\":\"192.168.1.2\",\"model\":\"UML290VW\",\"provider\":\"Purview Wireless\",\"remote\":\"1.2.3.5\"},\"alertId\":\"0000000000000000\",\"alertLevel\":\"informational\",\"alertType\":\"Cellular came up\",\"alertTypeId\":\"cellular_up\",\"deviceMac\":\"00:11:22:33:44:55\",\"deviceModel\":\"MX\",\"deviceName\":\"My appliance\",\"deviceSerial\":\"Q234-ABCD-5678\",\"deviceTags\":[\"tag1\",\"tag2\"],\"deviceUrl\":\"https://n1.meraki.com//n//manage/nodes/new_list/000000000000\",\"networkId\":\"N_24329156\",\"networkName\":\"Main Office\",\"networkTags\":[],\"networkUrl\":\"https://n1.meraki.com//n//manage/nodes/list\",\"occurredAt\":\"2018-02-11T00:00:00.123450Z\",\"organizationId\":\"2930418\",\"organizationName\":\"My organization\",\"organizationUrl\":\"https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview\",\"sentAt\":\"2021-10-07T08:42:00.926325Z\",\"sharedSecret\":\"secret\",\"version\":\"0.1\"}",
         "type": [
             "info",

packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json

@@ -362,6 +362,7 @@
                     "allowed"
                 ]
             },
+            "message": "lease of ip 10.0.2.213 from mx mac 68:3A:1E:42:60:59 for client mac E0:CB:BC:02:4F:80 from router 10.0.0.1 on subnet 255.255.252.0 with dns 10.0.0.1",
             "network": {
                 "protocol": "dhcp"
             },
@@ -400,6 +401,7 @@
                     "denied"
                 ]
             },
+            "message": "no offers for mac A4:83:E7:02:A2:F1 host = 192.168.10.1",
             "network": {
                 "protocol": "dhcp"
             },
@@ -449,6 +451,7 @@
                     "start"
                 ]
             },
+            "message": "user id 'jwick@wwvpn.net' local ip 172.16.0.145 connected from 81.2.69.193",
             "network": {
                 "forwarded_ip": "172.16.0.145"
             },
@@ -667,6 +670,9 @@
                 "version": "8.10.0"
             },
             "event": {
+                "action": [
+                    "multiple_dhcp_servers_detected"
+                ],
                 "category": [
                     "network"
                 ],
@@ -718,6 +724,9 @@
                 "version": "8.10.0"
             },
             "event": {
+                "action": [
+                    "multiple_dhcp_servers_detected"
+                ],
                 "category": [
                     "network"
                 ],
@@ -1073,6 +1082,7 @@
                     "priority": 134
                 }
             },
+            "message": "Blocked ARP Packet from ab:01:02:03:04:05 with IP 81.2.69.144 on VLAN 123",
             "observer": {
                 "hostname": "TCP9001",
                 "ingress": {
@@ -1126,6 +1136,7 @@
                     "priority": 134
                 }
             },
+            "message": "Port 4 changed STP role from designated to disabled",
             "observer": {
                 "hostname": "TCP9001"
             },
@@ -1158,6 +1169,7 @@
                     "priority": 134
                 }
             },
+            "message": "port 4 status changed from 100fdx to down",
             "observer": {
                 "hostname": "TCP9001"
             },
@@ -1190,6 +1202,7 @@
                     "priority": 134
                 }
             },
+            "message": "Port 1 changed STP role from disabled to designated",
             "observer": {
                 "hostname": "TCP9001"
             },
@@ -1222,6 +1235,7 @@
                     "priority": 134
                 }
             },
+            "message": "port 1 status changed from down to 100fdx",
             "observer": {
                 "hostname": "TCP9001"
             },

packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -213,6 +213,8 @@ processors:
         "multiple_dhcp_servers_detected":
           type:
             - protocol
+          action: 
+            - multiple_dhcp_servers_detected
         "dfs_event":
           action: dynamic-frequency-selection-detected
         "aps_association_reject":

packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/events.yml

@@ -70,6 +70,11 @@ processors:
     field: cisco_meraki.event_subtype
     value: dhcp_no_offer
     if: ctx?.msgtype.toLowerCase() == "dhcp" && ctx?._temp?.dhcp_op.toLowerCase() == 'no' && ctx?._temp?.dhcp_op2.toLowerCase() == 'offers'
+- grok:
+    field: event.original
+    patterns: 
+      - "events dhcp %{GREEDYDATA:message}$"
+    if: ctx?.msgtype.toLowerCase() == "dhcp"
 ####################################################
 # Handle Site-to-Site VPN message
 ####################################################
@@ -91,7 +96,7 @@ processors:
 - grok:
     field: event.original
     patterns: 
-      - '%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}%{BLOCKEDARP:_temp.blocked_arp} from %{MAC:source.mac} with IP %{IP:source.ip} on %{NOTSPACE} %{GREEDYDATA:observer.ingress.vlan.id}$'
+      - '^%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}(?<message>%{BLOCKEDARP:_temp.blocked_arp} from %{MAC:source.mac} with IP %{IP:source.ip} on %{NOTSPACE} %{GREEDYDATA:observer.ingress.vlan.id})$'
     pattern_definitions:
       SYSLOGPRI: '<%{NONNEGINT:log.syslog.priority:long}>'
       SYSLOGVER: '\b(?:\d{1,2})\b'
@@ -118,7 +123,7 @@ processors:
 - grok:
     field: event.original
     patterns: 
-      - '(?i)%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}port %{NOTSPACE} %{PORTACTION:_temp.port_action}'
+      - '^(?i)%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}(?<message>port %{NOTSPACE} %{PORTACTION:_temp.port_action}.*)$'
     pattern_definitions:
       SYSLOGPRI: '<%{NONNEGINT:log.syslog.priority:long}>'
       SYSLOGVER: '\b(?:\d{1,2})\b'
@@ -233,6 +238,11 @@ processors:
     field: event.original
     pattern: "%{} events client_vpn_connect user id '%{user.name}' local ip %{network.forwarded_ip} connected from %{_temp.client_ip}"
     if: ctx?.cisco_meraki?.event_subtype == "client_vpn_connect"
+- grok:
+    field: event.original
+    patterns: 
+      - "events client_vpn_connect %{GREEDYDATA:message}$"
+    if: ctx?.cisco_meraki?.event_subtype == "client_vpn_connect"
 
 ####################################################
 # parse dissected IP values and convert to IP type

packages/cisco_meraki/data_stream/log/sample_event.json

@@ -1,11 +1,11 @@
 {
     "@timestamp": "2021-11-23T18:13:18.348Z",
     "agent": {
-        "ephemeral_id": "eedc7205-9a4a-44e7-8574-3c9450a28434",
-        "id": "878982e9-a174-4ed8-abe3-19378c1473de",
+        "ephemeral_id": "6a7dac67-b13a-40d5-a45a-7df6ac73e739",
+        "id": "29d48081-6d4f-4236-b959-925451410f6f",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "8.8.0"
+        "version": "8.0.0"
     },
     "cisco_meraki": {
         "event_subtype": "ids_alerted",
@@ -30,9 +30,9 @@
         "version": "8.10.0"
     },
     "elastic_agent": {
-        "id": "878982e9-a174-4ed8-abe3-19378c1473de",
+        "id": "29d48081-6d4f-4236-b959-925451410f6f",
         "snapshot": false,
-        "version": "8.8.0"
+        "version": "8.0.0"
     },
     "event": {
         "action": "ids-signature-matched",
@@ -42,7 +42,7 @@
             "threat"
         ],
         "dataset": "cisco_meraki.log",
-        "ingested": "2023-06-01T20:31:15Z",
+        "ingested": "2023-09-20T09:12:35Z",
         "original": "\u003c134\u003e1 1637691198.348361125 MX84 security_event ids_alerted signature=1:29708:4 priority=1 timestamp=1637691198.330873 dhost=D0:AB:D5:7B:43:73 direction=ingress protocol=tcp/ip src=67.43.156.12:80 dst=10.0.3.162:56391 decision=allowed message: BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected",
         "type": [
             "info",
@@ -54,7 +54,7 @@
     },
     "log": {
         "source": {
-            "address": "192.168.224.4:50508"
+            "address": "172.20.0.4:40170"
         }
     },
     "network": {

packages/cisco_meraki/docs/README.md

@@ -298,11 +298,11 @@ An example event for `log` looks as following:
 {
     "@timestamp": "2021-11-23T18:13:18.348Z",
     "agent": {
-        "ephemeral_id": "eedc7205-9a4a-44e7-8574-3c9450a28434",
-        "id": "878982e9-a174-4ed8-abe3-19378c1473de",
+        "ephemeral_id": "6a7dac67-b13a-40d5-a45a-7df6ac73e739",
+        "id": "29d48081-6d4f-4236-b959-925451410f6f",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "8.8.0"
+        "version": "8.0.0"
     },
     "cisco_meraki": {
         "event_subtype": "ids_alerted",
@@ -327,9 +327,9 @@ An example event for `log` looks as following:
         "version": "8.10.0"
     },
     "elastic_agent": {
-        "id": "878982e9-a174-4ed8-abe3-19378c1473de",
+        "id": "29d48081-6d4f-4236-b959-925451410f6f",
         "snapshot": false,
-        "version": "8.8.0"
+        "version": "8.0.0"
     },
     "event": {
         "action": "ids-signature-matched",
@@ -339,7 +339,7 @@ An example event for `log` looks as following:
             "threat"
         ],
         "dataset": "cisco_meraki.log",
-        "ingested": "2023-06-01T20:31:15Z",
+        "ingested": "2023-09-20T09:12:35Z",
         "original": "\u003c134\u003e1 1637691198.348361125 MX84 security_event ids_alerted signature=1:29708:4 priority=1 timestamp=1637691198.330873 dhost=D0:AB:D5:7B:43:73 direction=ingress protocol=tcp/ip src=67.43.156.12:80 dst=10.0.3.162:56391 decision=allowed message: BROWSER-IE Microsoft Internet Explorer CSS uninitialized object access attempt detected",
         "type": [
             "info",
@@ -351,7 +351,7 @@ An example event for `log` looks as following:
     },
     "log": {
         "source": {
-            "address": "192.168.224.4:50508"
+            "address": "172.20.0.4:40170"
         }
     },
     "network": {
@@ -623,11 +623,11 @@ An example event for `events` looks as following:
 {
     "@timestamp": "2018-02-11T00:00:00.123Z",
     "agent": {
-        "ephemeral_id": "077a2d93-4b1d-4908-b2d5-7c3a0218df3a",
-        "id": "878982e9-a174-4ed8-abe3-19378c1473de",
+        "ephemeral_id": "9a78410b-655d-4ff4-9fd6-5c47d2b1e28b",
+        "id": "29d48081-6d4f-4236-b959-925451410f6f",
         "name": "docker-fleet-agent",
         "type": "filebeat",
-        "version": "8.8.0"
+        "version": "8.0.0"
     },
     "cisco_meraki": {
         "event": {
@@ -662,9 +662,9 @@ An example event for `events` looks as following:
         "version": "8.10.0"
     },
     "elastic_agent": {
-        "id": "878982e9-a174-4ed8-abe3-19378c1473de",
+        "id": "29d48081-6d4f-4236-b959-925451410f6f",
         "snapshot": false,
-        "version": "8.8.0"
+        "version": "8.0.0"
     },
     "event": {
         "action": "Cellular came up",
@@ -673,7 +673,7 @@ An example event for `events` looks as following:
             "network"
         ],
         "dataset": "cisco_meraki.events",
-        "ingested": "2023-06-01T20:29:21Z",
+        "ingested": "2023-09-20T09:09:47Z",
         "original": "{\"alertData\":{\"connection\":\"LTE\",\"local\":\"192.168.1.2\",\"model\":\"UML290VW\",\"provider\":\"Purview Wireless\",\"remote\":\"1.2.3.5\"},\"alertId\":\"0000000000000000\",\"alertLevel\":\"informational\",\"alertType\":\"Cellular came up\",\"alertTypeId\":\"cellular_up\",\"deviceMac\":\"00:11:22:33:44:55\",\"deviceModel\":\"MX\",\"deviceName\":\"My appliance\",\"deviceSerial\":\"Q234-ABCD-5678\",\"deviceTags\":[\"tag1\",\"tag2\"],\"deviceUrl\":\"https://n1.meraki.com//n//manage/nodes/new_list/000000000000\",\"networkId\":\"N_24329156\",\"networkName\":\"Main Office\",\"networkTags\":[],\"networkUrl\":\"https://n1.meraki.com//n//manage/nodes/list\",\"occurredAt\":\"2018-02-11T00:00:00.123450Z\",\"organizationId\":\"2930418\",\"organizationName\":\"My organization\",\"organizationUrl\":\"https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview\",\"sentAt\":\"2021-10-07T08:42:00.926325Z\",\"sharedSecret\":\"secret\",\"version\":\"0.1\"}",
         "type": [
             "info",

packages/cisco_meraki/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 2.11.0
 name: cisco_meraki
 title: Cisco Meraki
-version: "1.14.0"
+version: "1.15.0"
 description: Collect logs from Cisco Meraki with Elastic Agent.
 type: integration
 categories: